Function at 0x7ff6cc7da100
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
cmp edx, 0x27
ja 0x7ff6cc7da127
mov eax, edi
movabs rcx, 0xa100000000
bt rcx, rax
jb 0x7ff6cc7da13e
cmp edi, 0x6b
je 0x7ff6cc7da13e
cmp edi, 0xbb
je 0x7ff6cc7da13e
xor al, al
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
cmp qword [rbx + 0xa0], 0
je 0x7ff6cc7da47e
mov ecx, 0x11
mov qword [rsp + 0x60], rsi
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, 0x10
sets sil
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, edi
sets cl
sub eax, 0x20
je 0x7ff6cc7da3e3
sub eax, 5
je 0x7ff6cc7da2d8
sub eax, 2
je 0x7ff6cc7da235
sub eax, 0x44
je 0x7ff6cc7da19f
sub eax, 0x50
jne 0x7ff6cc7da479
cmp edi, 0x6b
jne 0x7ff6cc7da1b8
test sil, sil
jne 0x7ff6cc7da1d5
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
cmp edi, 0xbb
jne 0x7ff6cc7da479
test sil, sil
je 0x7ff6cc7da479
test cl, cl
je 0x7ff6cc7da479
test byte [rbx + 0x40], 0x10
je 0x7ff6cc7da1f1
mov r8, qword [rbx + 0x100]
xor r9d, r9d
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.7ff6cc7d87c0
xor edi, edi
cmp dword [rbx + 0xf4], edi
jbe 0x7ff6cc7da479
nop
mov r8, qword [rbx + 0xe8]
xor r9d, r9d
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
mov eax, edi
mov r8, qword [r8 + rdi*8]
call fcn.7ff6cc7d87c0
inc edi
cmp edi, dword [rbx + 0xf4]
jb 0x7ff6cc7da200
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
mov rax, qword [rbx + 0xa0]
test byte [rax + 0x34], 1
jne 0x7ff6cc7da479
test byte [rax], 4
jne 0x7ff6cc7da268
mov r8b, 1
mov rdx, rax
mov rcx, rbx
call fcn.7ff6cc7d8c50
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
mov rdx, qword [rbx + 0x130]
mov eax, dword [rax + 0x2c]
inc eax
cmp eax, dword [rdx]
jae 0x7ff6cc7da479
mov ecx, eax
mov rax, qword [rdx + 8]
mov rdi, qword [rax + rcx*8]
mov rax, qword [rbx + 0xa0]
mov ecx, dword [rax + 0x30]
inc ecx
cmp dword [rdi + 0x30], ecx
jne 0x7ff6cc7da479
mov qword [rbx + 0xa0], rdi
mov rcx, rbx
mov eax, dword [rdi + 0x2c]
mov dword [rbx + 0xac], eax
mov edx, dword [rdi + 0x2c]
inc edx
call fcn.7ff6cc7d9890
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.7ff6cc7d94a0
mov rax, qword [rbx + 0xa0]
mov edx, dword [rax + 0x2c]
mov r8d, edx
jmp 0x7ff6cc7da37d
mov rax, qword [rbx + 0xa0]
test byte [rax + 0x34], 1
jne 0x7ff6cc7da307
test byte [rax], 4
je 0x7ff6cc7da307
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.7ff6cc7d8c50
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
mov ecx, dword [rax + 0x30]
test ecx, ecx
je 0x7ff6cc7da479
mov edi, dword [rax + 0x2c]
dec ecx
test edi, edi
je 0x7ff6cc7da479
mov rax, qword [rbx + 0x130]
mov rdx, qword [rax + 8]
nop word [rax + rax]
dec edi
mov eax, edi
mov rsi, qword [rdx + rdi*8]
cmp dword [rsi + 0x30], ecx
je 0x7ff6cc7da350
test edi, edi
jne 0x7ff6cc7da330
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
mov qword [rbx + 0xa0], rsi
mov edx, edi
mov eax, dword [rsi + 0x2c]
mov rcx, rbx
mov dword [rbx + 0xac], eax
call fcn.7ff6cc7d9890
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.7ff6cc7d94a0
mov r8d, edi
mov edx, edi
lea rax, [rbp + 0x28]
mov r9d, 4
mov qword [rsp + 0x28], rax
mov rcx, rbx
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.7ff6cc7d9300
mov r8d, dword [rbp + 0x28]
lea rax, [rbp - 0x10]
mov edx, dword [rbp + 0x30]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.7ff6cc7d9010
test al, al
je 0x7ff6cc7da3cc
mov rcx, qword [rbx]
lea rdx, [rbp - 0x10]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, rbx
call fcn.7ff6cc7dc4d0
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
test sil, sil
je 0x7ff6cc7da406
mov rcx, qword [rbx + 0xa0]
mov r9d, 2
mov eax, dword [rcx + 0x2c]
mov dword [rbx + 0xac], eax
mov edx, dword [rcx + 0x2c]
mov r8d, edx
jmp 0x7ff6cc7da430
test cl, cl
je 0x7ff6cc7da479
mov rax, qword [rbx + 0xa0]
mov r8d, dword [rax + 0x2c]
mov eax, dword [rbx + 0xac]
cmp r8d, eax
jbe 0x7ff6cc7da424
mov edx, eax
jmp 0x7ff6cc7da42a
mov edx, r8d
mov r8d, eax
mov r9d, 4
lea rax, [rbp + 0x28]
mov rcx, rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.7ff6cc7d9300
mov r8d, dword [rbp + 0x28]
lea rax, [rbp - 0x10]
mov edx, dword [rbp + 0x30]
mov r9b, 1
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.7ff6cc7d9010
test al, al
je 0x7ff6cc7da479
mov rcx, qword [rbx]
lea rdx, [rbp - 0x10]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rsi, qword [rsp + 0x60]
mov al, 1
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret