Function at 0x140049cd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
cmp dword [rsp + 0x98], 0x20
je 0x140049d05
cmp dword [rsp + 0x98], 0x25
je 0x140049d05
cmp dword [rsp + 0x98], 0x27
je 0x140049d05
xor al, al
jmp 0x14004a2f8
mov rax, qword [rsp + 0x90]
cmp qword [rax + 0xa0], 0
jne 0x140049d1e
mov al, 1
jmp 0x14004a2f8
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x140049d38
mov dword [rsp + 0x48], 1
jmp 0x140049d40
mov dword [rsp + 0x48], 0
movzx eax, byte [rsp + 0x48]
mov byte [rsp + 0x40], al
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x140049d63
mov dword [rsp + 0x50], 1
jmp 0x140049d6b
mov dword [rsp + 0x50], 0
movzx eax, byte [rsp + 0x50]
mov byte [rsp + 0x38], al
mov eax, dword [rsp + 0x98]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0x20
je 0x140049da1
cmp dword [rsp + 0x44], 0x25
je 0x140049f5b
cmp dword [rsp + 0x44], 0x27
je 0x14004a11d
jmp 0x14004a2f6
movzx eax, byte [rsp + 0x40]
test eax, eax
je 0x140049e62
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x90]
mov eax, dword [rax + 0x2c]
mov dword [rcx + 0xac], eax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0xa0]
lea rdx, [rsp + 0x34]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x3c]
mov qword [rsp + 0x20], rdx
mov r9d, 2
mov r8d, dword [rax + 0x2c]
mov edx, dword [rcx + 0x2c]
mov rcx, qword [rsp + 0x90]
call fcn.1400487a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x90]
call fcn.1400481c0
movzx eax, al
test eax, eax
je 0x140049e5d
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140049f56
movzx eax, byte [rsp + 0x38]
test eax, eax
je 0x140049f56
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0xac]
cmp dword [rax + 0x2c], ecx
jbe 0x140049ebb
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xac]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x54], eax
jmp 0x140049ee3
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x4c], eax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0xac]
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x4c]
mov rcx, qword [rsp + 0x90]
call fcn.1400487a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x90]
call fcn.1400481c0
movzx eax, al
test eax, eax
je 0x140049f56
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x14004a2f6
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x34]
and eax, 1
test eax, eax
jne 0x140049fb3
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax]
shr eax, 2
and eax, 1
test eax, eax
je 0x140049fb3
xor r8d, r8d
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x90]
call fcn.140047910
jmp 0x14004a118
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
cmp dword [rax + 0x30], 0
je 0x14004a118
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x30]
dec eax
mov dword [rsp + 0x68], eax
cmp dword [rsp + 0x30], 0
je 0x14004a118
mov eax, dword [rsp + 0x30]
dec eax
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x128]
mov ecx, dword [rsp + 0x30]
mov rax, qword [rax + 8]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov ecx, dword [rsp + 0x68]
cmp dword [rax + 0x30], ecx
jne 0x14004a113
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0xa0], rcx
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
mov ecx, dword [rcx + 0x2c]
mov dword [rax + 0xac], ecx
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.140048f20
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x90]
call fcn.140048ac0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, dword [rsp + 0x30]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x90]
call fcn.1400487a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x90]
call fcn.1400481c0
movzx eax, al
test eax, eax
je 0x14004a104
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rsp + 0x90]
call fcn.14004dbe0
jmp 0x14004a118
jmp 0x140049ffa
jmp 0x14004a2f6
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x34]
and eax, 1
test eax, eax
jne 0x14004a2f6
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax]
shr eax, 2
and eax, 1
test eax, eax
jne 0x14004a179
mov r8b, 1
mov rax, qword [rsp + 0x90]
mov rdx, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x90]
call fcn.140047910
jmp 0x14004a2f6
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x2c]
inc eax
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x128]
cmp eax, dword [rcx]
jae 0x14004a2f6
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x128]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0xa0]
mov ecx, dword [rcx + 0x2c]
inc ecx
mov ecx, ecx
mov rax, qword [rax + 8]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x30]
inc eax
mov rcx, qword [rsp + 0x58]
cmp dword [rcx + 0x30], eax
jne 0x14004a2f6
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0xa0], rcx
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0x2c]
mov dword [rax + 0xac], ecx
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov eax, dword [rax + 0x2c]
inc eax
mov edx, eax
mov rcx, qword [rsp + 0x90]
call fcn.140048f20
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x90]
call fcn.140048ac0
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0xa0]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0xa0]
lea rdx, [rsp + 0x34]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x3c]
mov qword [rsp + 0x20], rdx
mov r9d, 4
mov r8d, dword [rax + 0x2c]
mov edx, dword [rcx + 0x2c]
mov rcx, qword [rsp + 0x90]
call fcn.1400487a0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
mov rcx, qword [rsp + 0x90]
call fcn.1400481c0
movzx eax, al
test eax, eax
je 0x14004a2e9
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rax, qword [rsp + 0x90]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rsp + 0x90]
call fcn.14004dbe0
mov al, 1
add rsp, 0x88
ret