Function at 0x140002d00
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0xf8]
sub rsp, 0x1e0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1402be8f8]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rdi, rcx
call fcn.140024b04
mov dword [rsp + 0x30], 3
xor r14d, r14d
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1402c82b0]
mov rcx, rdi
call fcn.140035f9c
mov r9, qword [rdi + 0x170]
mov edx, 0x80
lea r8d, [r14 + 1]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [rdi + 0x170]
xor r8d, r8d
mov edx, 0x80
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call fcn.140026830
mov rcx, rax
test rax, rax
jne 0x140002dbe
mov ecx, 0x80004005
call fcn.140002830
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov ecx, 0x67
call fcn.140036224
test rax, rax
je 0x140002e0d
mov r8d, 0x67
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002e0d
mov edx, 0x3ea
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, 0x66
call fcn.140036224
test rax, rax
je 0x140002e4d
mov r8d, 0x66
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002e4d
mov edx, 0x3e9
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, VarBstrFromDisp
call fcn.140036224
test rax, rax
je 0x140002e8d
mov r8d, VarBstrFromDisp
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002e8d
mov edx, 0x3f6
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, VarBstrFromDisp
call fcn.140036224
test rax, rax
je 0x140002ecd
mov r8d, VarBstrFromDisp
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002ecd
mov edx, 0x3f7
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, 0x68
call fcn.140036224
test rax, rax
je 0x140002f0d
mov r8d, 0x68
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002f0d
mov edx, 0x3eb
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, 0x69
call fcn.140036224
test rax, rax
je 0x140002f4d
mov r8d, 0x69
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002f4d
mov edx, 0x3ec
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, 0x6a
call fcn.140036224
test rax, rax
je 0x140002f8d
mov r8d, 0x6a
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002f8d
mov edx, 0x3ed
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, 0x6b
call fcn.140036224
test rax, rax
je 0x140002fcd
mov r8d, 0x6b
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140002fcd
mov edx, 0x3ee
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, VarBstrFromDisp
call fcn.140036224
test rax, rax
je 0x14000300d
mov r8d, VarBstrFromDisp
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x14000300d
mov edx, 0x3f8
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov ecx, 0x6c
call fcn.140036224
test rax, rax
je 0x14000304d
mov r8d, 0x6c
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x14000304d
mov edx, 0x3f5
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
call fcn.1400039e0
mov ebx, eax
call qword [sym.imp.ole32.dll_CoUninitialize]
or esi, 0xffffffff
test ebx, ebx
je 0x140003107
lea rdx, [rsp + 0x40]
call fcn.140003700
nop
mov rdx, rax
lea rcx, [rdi + 0x178]
call fcn.140004110
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400030a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi + 0x178]
movzx eax, word [rax]
cmp ax, word [0x140276c30]
je 0x1400030c0
sbb r14d, r14d
or r14d, 1
test r14d, r14d
je 0x140003107
mov ecx, VarBstrFromDisp
call fcn.140036224
test rax, rax
je 0x14000311e
mov r8d, VarBstrFromDisp
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x14000311e
mov edx, 0x3fd
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
jmp 0x14000311e
mov edx, 0x3fd
mov rcx, rdi
call fcn.1400358ec
xor edx, edx
mov rcx, rax
call fcn.1400360d8
mov ecx, 0x6d
call fcn.140036224
test rax, rax
je 0x140003151
mov r8d, VarBstrFromDisp
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140004240
test eax, eax
je 0x140003151
mov rdx, qword [rsp + 0x50]
mov rcx, rdi
call fcn.140036054
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x60]
call fcn.1401d5b10
lea rcx, [rsp + 0x60]
call fcn.1400045e0
nop
lea rcx, [rsp + 0x60]
call fcn.140004c60
mov r8, qword [rsp + 0x68]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3ef
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rsp + 0x70]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3f9
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rbp - 0x60]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3fa
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rbp - 0x70]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3f1
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rsp + 0x78]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3f2
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rbp - 0x80]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3f3
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rbp - 0x68]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3f4
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rbp - 0x78]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3f0
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rdx, qword [rsp + 0x50]
call fcn.140036054
mov r8, qword [rbp - 0x58]
lea rdx, [0x1402763d0]
lea rcx, [rsp + 0x50]
call fcn.140002940
mov edx, 0x3fb
mov rcx, rdi
call fcn.1400358ec
mov rcx, rax
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
call fcn.140036054
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x30]
call fcn.1401d5b10
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x140003363
test byte [rbp - 0x1e], 0x80
jne 0x140003363
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov cl, 0x12
call qword [sym.imp.USER32.dll_keybd_event]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x140003389
test byte [rbp - 0x1e], 0x80
jne 0x140003389
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
mov cl, 0x12
call qword [sym.imp.USER32.dll_keybd_event]
nop
lea rcx, [rsp + 0x60]
call fcn.1400048b0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400033ac
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.1401b6fe0
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret