Function at 0x1400517b0
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, 0x1f
je 0x1400519e8
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
mov edi, edx
test rcx, rcx
je 0x14005194c
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x14005194c
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r12d, edi
mov cl, 0x80
and r12d, 0x10
je 0x140051813
or byte [rsp + 0x7b], cl
mov r13d, edi
and r13d, 2
je 0x140051827
mov eax, dword [rbx + 0x78]
or byte [rsp + 0x30], cl
or byte [rsp + rax + 0x20], cl
mov r14d, edi
and r14d, 4
je 0x14005183b
or byte [rsp + 0x30], cl
or byte [rsp + 0xc1], cl
mov esi, edi
and esi, 8
je 0x140051846
or byte [rsp + 0x31], cl
mov ebp, edi
and ebp, 1
je 0x140051851
or byte [rsp + 0x32], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
mov r15d, 0x100
test r12d, r12d
je 0x140051888
movzx eax, byte [rbx + 0x75]
mov rcx, qword [rbx + 0x68]
mov r8d, 0x5b
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test r13d, r13d
je 0x1400518ac
movzx eax, byte [rbx + 0x73]
mov r8d, dword [rbx + 0x78]
mov rcx, qword [rbx + 0x68]
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test r14d, r14d
je 0x1400518d2
movzx eax, byte [rbx + 0x74]
mov rcx, qword [rbx + 0x68]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test esi, esi
je 0x1400518f7
movzx eax, byte [rbx + 0x70]
mov rcx, qword [rbx + 0x68]
mov r8d, reloc.WSOCK32.dll_recvfrom
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test ebp, ebp
je 0x1400519c0
test esi, esi
jne 0x140051921
bt edi, 0xb
jb 0x140051921
movzx eax, byte [rbx + 0x71]
mov edx, 0x104
shl eax, 0x10
movsxd r9, eax
or r9, 0x20000001
jmp 0x14005193a
test ebp, ebp
je 0x1400519c0
movzx eax, byte [rbx + 0x71]
mov edx, r15d
shl eax, 0x10
movsxd r9, eax
or r9, 1
mov rcx, qword [rbx + 0x68]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400519c0
test dil, 0x10
je 0x140051963
mov dl, byte [rbx + 0x75]
xor r9d, r9d
xor r8d, r8d
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 2
je 0x14005197b
mov dl, byte [rbx + 0x73]
mov cl, byte [rbx + 0x78]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 4
je 0x140051992
mov dl, byte [rbx + 0x74]
xor r9d, r9d
xor r8d, r8d
mov cl, RegisterTypeLib
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 8
je 0x1400519a9
mov dl, byte [rbx + 0x70]
xor r9d, r9d
xor r8d, r8d
mov cl, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 1
je 0x1400519c0
mov dl, byte [rbx + 0x71]
xor r9d, r9d
xor r8d, r8d
mov cl, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rbx
call fcn.140043720
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret