Function at 0x140042800
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x148
cmp dword [rsp + 0x160], 0x201
je 0x140042835
cmp dword [rsp + 0x160], 0x204
jne 0x140042843
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.USER32.dll_SetFocus]
mov byte [rsp + 0x40], 0
mov eax, dword [rsp + 0x160]
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 0x201
je 0x14004287e
cmp dword [rsp + 0x54], 0x202
je 0x140042959
cmp dword [rsp + 0x54], 0x204
je 0x140042975
jmp 0x140042996
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x40]
shr eax, 5
and eax, 1
test eax, eax
je 0x140042957
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x90]
sub eax, 8
cmp dword [rsp + 0x170], eax
jl 0x140042957
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x90]
add eax, 8
cmp dword [rsp + 0x170], eax
jge 0x140042957
mov byte [rsp + 0x40], 1
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x40]
or eax, 2
mov rcx, qword [rsp + 0x158]
mov dword [rcx + 0x40], eax
mov rax, qword [rsp + 0x158]
mov ecx, dword [rsp + 0x170]
mov dword [rax + 0x11c], ecx
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x158]
mov ecx, dword [rcx + 0x90]
mov dword [rax + 0x120], ecx
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.USER32.dll_SetCapture]
xor r9d, r9d
mov r8d, 0x64
mov edx, 1
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.USER32.dll_SetTimer]
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x140042996
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x40]
shr eax, 1
and eax, 1
test eax, eax
je 0x140042973
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x140042996
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x40]
shr eax, 1
and eax, 1
test eax, eax
je 0x140042996
mov rcx, qword [rsp + 0x158]
call fcn.1400454d0
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x1400429b8
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x40]
shr eax, 1
and eax, 1
test eax, eax
je 0x1400429b8
jmp 0x140043159
mov eax, dword [rsp + 0x170]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x178]
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x68], 3
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x158]
call fcn.140048360
mov eax, dword [rsp + 0x168]
and eax, 8
mov dword [rsp + 0x84], eax
mov eax, dword [rsp + 0x168]
and eax, 4
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x6c]
and eax, 0x20
test eax, eax
je 0x140042a66
cmp dword [rsp + 0x160], 0x201
jne 0x140042a66
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
shr eax, 2
and eax, 1
test eax, eax
jne 0x140042a40
mov dword [rsp + 0x80], 1
jmp 0x140042a4b
mov dword [rsp + 0x80], 0
movzx r8d, byte [rsp + 0x80]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x158]
call fcn.140047910
mov eax, dword [rsp + 0x6c]
and eax, 0x20
test eax, eax
jne 0x140042f90
cmp dword [rsp + 0x160], 0x201
je 0x140042a93
cmp dword [rsp + 0x160], 0x204
jne 0x140042f90
mov rcx, qword [rsp + 0x158]
call fcn.14004dbe0
mov dword [rsp + 0x4c], 1
mov eax, dword [rsp + 0x6c]
and eax, 0x10
test eax, eax
je 0x140042c16
mov dword [rsp + 0x4c], 0
mov rax, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x70]
mov qword [rax + 0xa0], rcx
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x4c]
and eax, 1
test eax, eax
je 0x140042bc4
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
shr eax, 1
and eax, 1
test eax, eax
jne 0x140042bc4
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140042bc4
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8, qword [rsp + 0x78]
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + 0x2c]
mov rcx, qword [rsp + 0x158]
call fcn.140047ad0
movzx eax, al
test eax, eax
je 0x140042bc4
mov dword [rsp + 0x4c], 1
mov eax, dword [rsp + 0xc0]
and eax, 4
test eax, eax
je 0x140042b80
mov eax, dword [rsp + 0xf4]
cmp dword [rsp + 0x170], eax
jl 0x140042b80
mov eax, dword [rsp + 0xfc]
cmp dword [rsp + 0x170], eax
jge 0x140042b80
mov dword [rsp + 0x4c], 0
mov eax, dword [rsp + 0xc0]
and eax, 8
test eax, eax
je 0x140042bc4
mov eax, dword [rsp + 0xc0]
and eax, 0x10
test eax, eax
je 0x140042bc4
mov eax, dword [rsp + 0x114]
cmp dword [rsp + 0x170], eax
jl 0x140042bc4
mov eax, dword [rsp + 0x11c]
cmp dword [rsp + 0x170], eax
jge 0x140042bc4
mov dword [rsp + 0x4c], 0
cmp dword [rsp + 0x160], 0x204
jne 0x140042bde
mov dword [rsp + 0x88], 1
jmp 0x140042be9
mov dword [rsp + 0x88], 0
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x8c]
mov r8d, dword [rsp + 0x84]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x158]
call fcn.140048c40
cmp dword [rsp + 0x4c], 0
je 0x140042f90
mov byte [rsp + 0x42], 0
mov dword [rsp + 0x58], 0xffffffff
mov byte [rsp + 0x41], 0
mov byte [rsp + 0x43], 0
mov eax, dword [rsp + 0x6c]
and eax, 0xf
test eax, eax
jne 0x140042e86
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140042e86
cmp qword [rsp + 0x70], 0
je 0x140042c6a
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x50], eax
jmp 0x140042c72
mov dword [rsp + 0x50], 0xffffffff
cmp qword [rsp + 0x78], 0
je 0x140042c88
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 4]
mov dword [rsp + 0x5c], eax
jmp 0x140042c90
mov dword [rsp + 0x5c], 0xffffffff
lea rax, [rsp + 0x94]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, dword [rsp + 0x178]
mov edx, dword [rsp + 0x170]
mov rcx, qword [rsp + 0x158]
call fcn.14004e380
mov byte [rsp + 0x48], al
cmp dword [rsp + 0x50], 0xffffffff
jne 0x140042cd2
mov qword [rsp + 0x70], 0
jmp 0x140042d10
mov rax, qword [rsp + 0x158]
mov rax, qword [rax + 0x128]
mov eax, dword [rax]
cmp dword [rsp + 0x50], eax
jae 0x140042d0b
mov rax, qword [rsp + 0x158]
mov rax, qword [rax + 0x128]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rax + 8]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x70], rax
jmp 0x140042d10
jmp 0x140043159
cmp dword [rsp + 0x5c], 0xffffffff
je 0x140042d3a
mov edx, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x158]
call fcn.140045c90
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x78], 0
jne 0x140042d3a
jmp 0x140043159
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x140042d76
mov byte [rsp + 0x42], 1
mov eax, dword [rsp + 0x6c]
and eax, 0x10
test eax, eax
je 0x140042d71
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x4c]
and eax, 1
test eax, eax
je 0x140042d71
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x2c]
mov dword [rsp + 0x58], eax
jmp 0x140042e86
cmp dword [rsp + 0x160], 0x201
jne 0x140042d90
cmp dword [rsp + 0x94], 0x202
je 0x140042db2
cmp dword [rsp + 0x160], 0x204
jne 0x140042e86
cmp dword [rsp + 0x94], 0x205
jne 0x140042e86
mov eax, dword [rsp + 0x6c]
and eax, 0x10
test eax, eax
je 0x140042dd4
mov rax, qword [rsp + 0x158]
mov eax, dword [rax + 0x4c]
and eax, 1
test eax, eax
je 0x140042dd4
mov byte [rsp + 0x41], 1
lea rdx, [rsp + 0xa0]
mov rax, qword [rsp + 0x158]
mov rcx, qword [rax]
call fcn.14004f770
mov eax, dword [rsp + 0x170]
cmp dword [rsp + 0xa0], eax
jne 0x140042e74
mov eax, dword [rsp + 0x178]
cmp dword [rsp + 0xa4], eax
jne 0x140042e74
cmp dword [rsp + 0x160], 0x201
jne 0x140042e26
mov dword [rsp + 0x90], 0xd
jmp 0x140042e31
mov dword [rsp + 0x90], 0xe
mov eax, dword [rsp + 0x168]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x178]
mov r8d, dword [rsp + 0x170]
mov edx, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x158]
call fcn.140045c00
cmp dword [rsp + 0x160], 0x204
jne 0x140042e86
mov byte [rsp + 0x43], 1
movzx eax, byte [rsp + 0x41]
test eax, eax
jne 0x140042f31
cmp dword [rsp + 0x84], 0
jne 0x140042f31
cmp dword [rsp + 0x8c], 0
jne 0x140042f31
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x9c]
mov qword [rsp + 0x20], rax
mov r9d, 4
mov r8d, dword [rsp + 0x58]
mov edx, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x158]
call fcn.1400487a0
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9b, 1
mov r8d, dword [rsp + 0x98]
mov edx, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x158]
call fcn.1400481c0
movzx eax, al
test eax, eax
je 0x140042f31
xor r8d, r8d
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.USER32.dll_InvalidateRect]
movzx eax, byte [rsp + 0x42]
test eax, eax
je 0x140042f56
mov r8d, dword [rsp + 0x178]
mov edx, dword [rsp + 0x170]
mov rcx, qword [rsp + 0x158]
call fcn.14004e590
movzx eax, byte [rsp + 0x43]
test eax, eax
je 0x140042f8b
call qword [sym.imp.USER32.dll_GetMessagePos]
mov eax, eax
mov r9d, eax
mov rax, qword [rsp + 0x158]
mov r8, qword [rax]
mov edx, 0x7b
mov rax, qword [rsp + 0x158]
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140043159
mov dword [rsp + 0x44], 0xffffffff
cmp dword [rsp + 0x160], 0x201
je 0x140042fb6
cmp dword [rsp + 0x160], 0x204
jne 0x140043048
mov rax, qword [rsp + 0x158]
cmp dword [rax + 0xb0], 0
je 0x140043004
mov rax, qword [rsp + 0x158]
mov ecx, dword [rsp + 0x160]
cmp dword [rax + 0xb0], ecx
je 0x140043004
mov rax, qword [rsp + 0x158]
cmp dword [rax + 0xb0], 0x201
jne 0x140042ffc
mov dword [rsp + 0x44], 0xd
jmp 0x140043004
mov dword [rsp + 0x44], 0xe
mov rax, qword [rsp + 0x158]
mov ecx, dword [rsp + 0x160]
mov dword [rax + 0xb0], ecx
mov rax, qword [rsp + 0x158]
mov ecx, dword [rsp + 0x170]
mov dword [rax + 0xb4], ecx
mov rax, qword [rsp + 0x158]
mov ecx, dword [rsp + 0x178]
mov dword [rax + 0xb8], ecx
jmp 0x140043107
cmp dword [rsp + 0x160], 0x202
je 0x140043062
cmp dword [rsp + 0x160], 0x205
jne 0x1400430db
mov rax, qword [rsp + 0x158]
cmp dword [rax + 0xb0], 0
je 0x1400430c7
mov rax, qword [rsp + 0x158]
mov ecx, dword [rsp + 0x170]
cmp dword [rax + 0xb4], ecx
jne 0x1400430c7
mov rax, qword [rsp + 0x158]
mov ecx, dword [rsp + 0x178]
cmp dword [rax + 0xb8], ecx
jne 0x1400430c7
mov rax, qword [rsp + 0x158]
cmp dword [rax + 0xb0], 0x201
jne 0x1400430bf
mov dword [rsp + 0x44], 0xd
jmp 0x1400430c7
mov dword [rsp + 0x44], 0xe
mov rax, qword [rsp + 0x158]
mov dword [rax + 0xb0], 0
jmp 0x140043107
cmp dword [rsp + 0x160], 0x203
jne 0x1400430f2
mov dword [rsp + 0x44], 0xf
jmp 0x140043107
cmp dword [rsp + 0x160], 0x206
jne 0x140043107
mov dword [rsp + 0x44], 0x10
mov eax, dword [rsp + 0x6c]
and eax, 0x20
test eax, eax
jne 0x140043159
cmp dword [rsp + 0x44], 0xffffffff
je 0x140043159
mov eax, dword [rsp + 0x168]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x178]
mov r8d, dword [rsp + 0x170]
mov edx, dword [rsp + 0x44]
mov rcx, qword [rsp + 0x158]
call fcn.140045c00
add rsp, 0x148
ret