Function at 0x140212450
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1404af540]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + 0x150]
test al, al
jne 0x14021248d
mov eax, dword [rdi]
sub eax, 0x13
cmp eax, 0x12
jbe 0x14021249d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x128]
test al, al
jne 0x1402124c4
mov rcx, qword [rbx + 0x38]
mov rdx, rdi
test rcx, rcx
je 0x1402124b7
mov rax, qword [rcx]
call qword [rax + 0x238]
jmp 0x14021292d
mov rcx, rbx
call fcn.1401be2f0
jmp 0x14021292d
mov eax, dword [rdi]
cmp eax, 0x35
jne 0x1402124db
mov rdx, rdi
mov rcx, rbx
call fcn.140212950
jmp 0x14021292d
cmp eax, 0xf
jne 0x14021258f
mov ecx, 9
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14021254f
cmp byte [rbx + 0x909], 0
jne 0x14021254f
mov rax, qword [rbx + 0x30]
test rax, rax
je 0x14021292d
xor esi, esi
mov word [rbp - 0x2c], si
mov dword [rbp - 0x18], esi
mov qword [rbp - 0x40], rbx
mov dword [rbp - 0x48], 0x3f
mov rax, qword [rax + 0x180]
mov qword [rbp - 0x34], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp - 0x38], eax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
mov rax, qword [rbx]
lea rdx, [rbp - 0x48]
mov rcx, rbx
call qword [rax + 0x238]
jmp 0x14021292d
cmp byte [rbx + 0x910], 0
je 0x14021256a
mov rax, qword [rdi + 0x20]
sub rax, 0x30
cmp rax, 9
ja 0x14021292d
mov rax, qword [rbx]
xor esi, esi
mov qword [rsp + 0x20], rsi
mov r9, qword [rdi + 0x28]
mov r8, qword [rdi + 0x20]
mov edx, 0x102
mov rcx, rbx
call qword [rax + 0x4d0]
jmp 0x14021292d
cmp eax, 0xd
jne 0x1402125a4
mov rdx, rdi
mov rcx, rbx
call fcn.140212be0
jmp 0x14021292d
cmp eax, 0x16
jne 0x1402125b3
mov edx, 0x200
jmp 0x140212922
cmp eax, 0x21
jne 0x1402125e1
mov ecx, reloc.SinoSPE.dll_Ordinal_17
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14021292d
mov rdx, rdi
mov rcx, rbx
call fcn.1401edf60
mov edx, 0x20a
jmp 0x140212922
cmp eax, 0x17
je 0x1402127fb
cmp eax, 0x2d
je 0x1402127fb
cmp eax, 0x18
je 0x1402127a2
cmp eax, 0x2f
je 0x1402127a2
cmp eax, 1
jne 0x14021262a
mov rcx, rbx
cmp byte [rbx + 0x90d], 0
je 0x140212620
call fcn.140210fe0
jmp 0x14021292d
mov edx, 0x203
jmp 0x140212925
cmp eax, 0x19
jne 0x140212639
mov edx, 0x204
jmp 0x140212922
cmp eax, 0x1a
jne 0x140212648
mov edx, 0x205
jmp 0x140212922
cmp eax, 0x41
jne 0x1402126ef
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x14021292d
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rsi, rax
test rax, rax
je 0x14021292d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x3c], xmm0
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.1401bad70
mov edx, dword [rbx + 0x91c]
sub edx, dword [rbp - 0x50]
mov r8d, dword [rbx + 0x920]
sub r8d, dword [rbp - 0x4c]
mov dword [rbp - 0x48], 2
mov eax, 1
cmp edx, eax
cmovl edx, eax
mov dword [rbp - 0x50], edx
cmp r8d, eax
cmovl r8d, eax
mov dword [rbp - 0x4c], r8d
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x44], rax
lea rdx, [rbp - 0x48]
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmSetCompositionWindow]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov byte [rbx + 0x918], 1
jmp 0x14021292d
cmp eax, 0x42
jne 0x140212700
mov byte [rbx + 0x918], 0
jmp 0x14021292d
cmp eax, 5
jne 0x140212770
mov rdi, qword [rbx + 0x900]
test rdi, rdi
je 0x140212759
or dword [rdi + 0x24], 0x20
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x48]
test eax, eax
jns 0x140212729
and dword [rdi + 0x24], 0xffffffdf
mov rax, qword [rbx + 0x900]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 7
call qword [rax + reloc.SinoSPE.dll_Ordinal_24]
mov edx, 1
mov rcx, rbx
call fcn.140214890
mov byte [rbx + 0x16a], 1
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax + 0x60]
jmp 0x14021292d
mov rdx, rdi
mov rcx, rbx
cmp eax, 6
jne 0x140212798
mov rax, qword [rbx]
call qword [rax + 0x2a8]
call fcn.14023e200
mov rcx, rax
xor edx, edx
call fcn.14023e270
jmp 0x14021292d
call fcn.1401edf60
jmp 0x14021292d
cmp byte [rbx + 0x166], 0
je 0x1402127f1
cmp byte [rbx + 0x913], 0
jne 0x1402127f1
mov byte [rbx + 0x913], 1
cmp byte [rbx + 0x915], 0
je 0x1402127f1
mov rcx, rbx
call fcn.140210fe0
mov rax, qword [rbx]
mov rcx, rbx
test byte [rbx + 0x954], 4
je 0x1402127eb
call qword [rax + 0x440]
mov edx, 0x202
jmp 0x140212922
call qword [rax + 0x460]
mov edx, 0x202
jmp 0x140212922
mov rcx, qword [rbx + 0xb10]
sub rcx, qword [rbx + 0xb08]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x140212909
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
movdqa xmm1, xmmword [0x1404530e0]
movdqu xmmword [rbp - 0x38], xmm1
xor esi, esi
mov word [rbp - 0x48], si
mov eax, dword [rdi + 0x14]
mov dword [rbp - 0x50], eax
mov eax, dword [rdi + 0x18]
mov dword [rbp - 0x4c], eax
lea r8, [rbp - 0x48]
mov rdx, qword [rbp - 0x50]
mov rcx, rbx
call fcn.140214ef0
test al, al
je 0x1402128c6
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140212884
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8d, 0x40
mov rdx, rbx
call fcn.1401b7bb0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x14021292d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402128bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1402128fd
call fcn.1403ca488
jmp 0x14021292d
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x140212909
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140212904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140212904
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1403ca488
cmp dword [rdi], 0x2d
jne 0x14021291d
call fcn.14023e200
mov rcx, rax
mov dl, 1
call fcn.14023e270
mov edx, 0x201
mov rcx, rbx
mov r8, rdi
call fcn.140212fd0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1403ca460
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret