Function at 0x100024dc8
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov rdi, r8
mov r12d, edx
mov rsi, rcx
mov rax, qword [rsp + 0x100]
mov dword [rax], 1
mov rcx, qword [rcx + 0xc0]
xor r13d, r13d
mov qword [rsp + 0x40], r13
cmp rcx, r13
je 0x100024e2f
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
lea rdx, [0x10006b1d0]
call qword [rax]
nop
lea rdx, [rsp + 0x70]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rsp + 0x40]
mov r10, qword [rcx]
lea r9, [rsi + 0x68]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r13d
xor r8d, r8d
lea edx, [r8 - 4]
call qword [r10 + 0x58]
mov r11, qword [rsi + 0xc0]
mov rcx, r13
mov qword [rsp + 0x100], rcx
cmp r11, r13
je 0x100024ea3
mov rax, qword [r11]
lea r8, [rsp + 0x100]
lea rdx, [0x10006bdc8]
mov rcx, r11
call qword [rax]
mov rcx, qword [rsp + 0x100]
mov ebx, 1
cmp rcx, r13
je 0x100025270
mov dword [rsp + 0x90], r12d
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rbp
cmp di, 8
je 0x100024ef6
cmp di, 0xd
je 0x100024ef6
cmp di, 0x10
je 0x100024ef6
cmp di, 0x11
je 0x100024ef6
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx]
mov ebx, eax
jmp 0x100025227
mov qword [rsp + 0x50], r13
mov qword [rsp + 0xe0], r13
mov rcx, qword [rsi + 0xd8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [rax + 0x50]
movsxd rbx, eax
cmp ebx, r13d
jge 0x100024f69
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100024f3d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x100024f51
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x100024f61
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, rbx
jmp 0x100025327
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100025208
mov rax, qword [rcx]
lea rdx, [rsp + 0xe0]
call qword [rax + 0x70]
cmp eax, r13d
jge 0x100024fd9
movsxd rbx, eax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100024fad
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x100024fc1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x100024fd1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, rbx
jmp 0x100025327
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
cmp eax, r13d
jbe 0x10002500a
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov edx, eax
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.USER32.dll_CharLowerBuffW]
lea rdx, str.textarea
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, r13d
jne 0x1000251b8
mov rcx, qword [rsp + 0x100]
mov rax, qword [rcx]
lea rdx, [rsp + 0x88]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx]
mov rbx, r13
mov qword [rsp + 0x58], rbx
mov rcx, r13
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x50]
cmp rax, r13
je 0x100025157
mov qword [rsp + 0x48], r13
mov r9, qword [rax]
lea r8, [rsp + 0x48]
lea rdx, [0x100069478]
mov rcx, rax
call qword [r9]
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x100025157
mov ecx, LoadRegTypeLib
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x1000250eb
mov ecx, reloc.OLEAUT32.dll_RegisterTypeLib
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x1000250eb
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [0x10006c2e8]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, r13
jne 0x1000250d3
mov ecx, 0x8007000e
call fcn.1000242ec
int3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x268]
mov rcx, qword [rsp + 0x48]
jmp 0x100025157
mov ecx, reloc.OLEAUT32.dll_LoadRegTypeLib
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x100025152
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r13w
jge 0x100025152
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
lea rcx, [0x10006c2f0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbx, rax
mov qword [rsp + 0x58], rax
cmp rax, r13
jne 0x10002513a
mov ecx, 0x8007000e
call fcn.1000242ec
int3
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x268]
mov rcx, qword [rsp + 0x48]
jmp 0x100025157
mov rcx, qword [rsp + 0x48]
cmp rcx, r13
je 0x100025163
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x10002518d
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x1000251a1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x1000251b1
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
jmp 0x100025327
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x1000251d8
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x1000251ec
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x1000251fc
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, 1
jmp 0x100025327
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
nop
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100025227
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
cmp ebx, r13d
jne 0x100025257
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x100025240
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x100025250
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
jmp 0x100025327
cmp ebx, 1
jne 0x100025266
mov rcx, qword [rsp + 0x100]
jmp 0x100025270
mov rcx, qword [rsp + 0x100]
jmp 0x10002527d
movzx eax, di
cmp eax, 9
je 0x1000252a4
cmp eax, 0x75
je 0x1000252a4
movsxd rbx, ebx
cmp rcx, r13
je 0x10002528c
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x10002529c
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rax, rbx
jmp 0x100025327
lea rdx, [rsp + 0x60]
mov rcx, qword [0x100090140]
call fcn.100003600
nop
mov rcx, qword [rsp + 0x68]
cmp rcx, r13
je 0x1000252d6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x900
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rcx, qword [rsp + 0x60]
lock add dword [rcx], 0xffffffff
jne 0x100025301
mov rcx, qword [rsp + 0x68]
cmp rcx, r13
je 0x1000252f6
mov rax, qword [rcx]
mov edx, 1
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x60]
call sub.msvcrt.dll_free
nop
mov rcx, qword [rsp + 0x100]
cmp rcx, r13
je 0x100025315
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x100025325
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret