Function at 0x1400fa550
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x40
mov ebx, edx
mov rdi, rcx
cmp edx, 0x27
ja 0x1400fa576
movabs rcx, 0xa100000000
mov eax, ebx
bt rcx, rbx
jb 0x1400fa590
cmp ebx, 0x6b
je 0x1400fa590
cmp ebx, 0xbb
je 0x1400fa590
xor al, al
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
cmp qword [rdi + 0xa0], 0
je 0x1400fac7d
mov qword [rsp + 0x50], rbp
mov ecx, 0x11
mov qword [rsp + 0x60], rsi
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, 0x10
sets sil
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, ebx
sets cl
sub eax, 0x20
je 0x1400faa30
sub eax, 5
je 0x1400fa833
sub eax, 2
je 0x1400fa67b
sub eax, 0x44
je 0x1400fa5f6
sub eax, 0x50
jne 0x1400fac73
cmp ebx, 0x6b
jne 0x1400fa605
test sil, sil
jne 0x1400fa622
jmp 0x1400fac73
cmp ebx, 0xbb
jne 0x1400fac73
test sil, sil
je 0x1400fac73
test cl, cl
je 0x1400fac73
test byte [rdi + 0x40], 0x10
je 0x1400fa63e
mov r8, qword [rdi + 0x100]
xor r9d, r9d
mov rdx, qword [rdi + 0x10]
mov rcx, rdi
call fcn.1400f87a0
xor ebx, ebx
cmp dword [rdi + 0xf4], ebx
jbe 0x1400fac73
nop dword [rax]
mov r8, qword [rdi + 0xe8]
xor r9d, r9d
mov rdx, qword [rdi + 0x18]
mov rcx, rdi
mov eax, ebx
mov r8, qword [r8 + rax*8]
call fcn.1400f87a0
inc ebx
cmp ebx, dword [rdi + 0xf4]
jb 0x1400fa650
jmp 0x1400fac73
mov rdx, qword [rdi + 0xa0]
test byte [rdx + 0x34], 1
jne 0x1400fac73
test byte [rdx], 4
jne 0x1400fa6a1
mov r8b, 1
mov rcx, rdi
call fcn.1400f8c90
jmp 0x1400fac73
mov r8, qword [rdi + 0x130]
mov eax, dword [rdx + 0x2c]
inc eax
cmp eax, dword [r8]
jae 0x1400fac73
mov ecx, eax
mov rax, qword [r8 + 8]
mov rbx, qword [rax + rcx*8]
mov eax, dword [rdx + 0x30]
inc eax
cmp dword [rbx + 0x30], eax
jne 0x1400fac73
mov qword [rdi + 0xa0], rbx
mov rcx, rdi
mov eax, dword [rbx + 0x2c]
mov dword [rdi + 0xac], eax
mov edx, dword [rbx + 0x2c]
inc edx
call fcn.1400f9b10
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.1400f9550
mov rax, qword [rdi + 0xa0]
mov ecx, dword [rax + 0x2c]
mov rax, qword [rdi + 0x130]
mov r8d, dword [rax]
test r8d, r8d
je 0x1400fa9ec
lea ebp, [r8 - 1]
cmp ecx, ebp
mov eax, ebp
mov esi, ebp
cmovbe eax, ecx
cmp ecx, eax
cmovbe r8d, ecx
xor ebx, ebx
cmp ecx, eax
mov r11d, ebx
mov edx, ebx
cmovbe r11d, eax
test r8d, r8d
je 0x1400fa776
mov r9d, ebx
nop
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r10, qword [r9 + rcx]
mov eax, dword [r10]
test al, 2
je 0x1400fa76b
and eax, 0xfffffffd
cmp esi, edx
mov dword [r10], eax
mov eax, edx
cmovbe eax, esi
mov esi, eax
cmp ebx, edx
jae 0x1400fa76b
mov ebx, edx
inc edx
add r9, 8
cmp edx, r8d
jb 0x1400fa740
cmp r8d, r11d
ja 0x1400fa7c5
nop dword [rax + rax]
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x1400fa7bd
test cl, 2
jne 0x1400fa7bd
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp esi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, esi
mov esi, eax
cmp ebx, r8d
jae 0x1400fa7bd
mov ebx, r8d
inc r8d
cmp r8d, r11d
jbe 0x1400fa780
lea r8d, [r11 + 1]
cmp r8d, ebp
ja 0x1400fa807
nop
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov eax, dword [r9]
test al, 2
je 0x1400fa7ff
and eax, 0xfffffffd
cmp esi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, esi
mov esi, eax
cmp ebx, r8d
jae 0x1400fa7ff
mov ebx, r8d
inc r8d
cmp r8d, ebp
jbe 0x1400fa7d0
cmp esi, ebx
ja 0x1400fa9f4
mov rax, qword [rdi + 0xc8]
xor r9d, r9d
mov rcx, qword [rdi]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xb]
call qword [rdi + 0xc0]
jmp 0x1400fa9f4
mov rax, qword [rdi + 0xa0]
test byte [rax + 0x34], 1
jne 0x1400fa858
test byte [rax], 4
je 0x1400fa858
xor r8d, r8d
mov rdx, rax
mov rcx, rdi
call fcn.1400f8c90
jmp 0x1400fac73
mov ecx, dword [rax + 0x30]
test ecx, ecx
je 0x1400fac73
mov esi, dword [rax + 0x2c]
dec ecx
test esi, esi
je 0x1400fac73
mov rax, qword [rdi + 0x130]
mov rdx, qword [rax + 8]
nop dword [rax + rax]
dec esi
mov eax, esi
mov rbx, qword [rdx + rsi*8]
cmp dword [rbx + 0x30], ecx
je 0x1400fa896
test esi, esi
jne 0x1400fa880
jmp 0x1400fac73
mov qword [rdi + 0xa0], rbx
mov edx, esi
mov eax, dword [rbx + 0x2c]
mov rcx, rdi
mov dword [rdi + 0xac], eax
call fcn.1400f9b10
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call fcn.1400f9550
mov rax, qword [rdi + 0x130]
mov r8d, dword [rax]
test r8d, r8d
je 0x1400fa9ec
lea ebp, [r8 - 1]
cmp esi, ebp
mov eax, ebp
cmovbe eax, esi
cmp esi, eax
cmovbe r8d, esi
xor ebx, ebx
cmp esi, eax
mov r11d, ebx
mov esi, ebp
mov edx, ebx
cmovbe r11d, eax
test r8d, r8d
je 0x1400fa936
mov r9d, ebx
nop dword [rax]
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r10, qword [r9 + rcx]
mov eax, dword [r10]
test al, 2
je 0x1400fa92b
and eax, 0xfffffffd
cmp esi, edx
mov dword [r10], eax
mov eax, edx
cmovbe eax, esi
mov esi, eax
cmp ebx, edx
jae 0x1400fa92b
mov ebx, edx
inc edx
add r9, 8
cmp edx, r8d
jb 0x1400fa900
cmp r8d, r11d
ja 0x1400fa985
nop dword [rax + rax]
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x1400fa97d
test cl, 2
jne 0x1400fa97d
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp esi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, esi
mov esi, eax
cmp ebx, r8d
jae 0x1400fa97d
mov ebx, r8d
inc r8d
cmp r8d, r11d
jbe 0x1400fa940
lea r8d, [r11 + 1]
cmp r8d, ebp
ja 0x1400fa9c7
nop
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov eax, dword [r9]
test al, 2
je 0x1400fa9bf
and eax, 0xfffffffd
cmp esi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, esi
mov esi, eax
cmp ebx, r8d
jae 0x1400fa9bf
mov ebx, r8d
inc r8d
cmp r8d, ebp
jbe 0x1400fa990
cmp esi, ebx
ja 0x1400fa9f4
mov rax, qword [rdi + 0xc8]
xor r9d, r9d
mov rcx, qword [rdi]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xb]
call qword [rdi + 0xc0]
jmp 0x1400fa9f4
mov ebx, dword [rsp + 0x58]
mov esi, dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov r9b, 1
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call fcn.1400f9070
test al, al
je 0x1400faa23
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, rdi
call fcn.1400fc9c0
jmp 0x1400fac73
test sil, sil
je 0x1400faaec
mov rcx, qword [rdi + 0xa0]
mov eax, dword [rcx + 0x2c]
mov dword [rdi + 0xac], eax
mov rax, qword [rdi + 0x130]
mov edx, dword [rcx + 0x2c]
mov r8d, dword [rax]
test r8d, r8d
je 0x1400fac3c
lea esi, [r8 - 1]
cmp edx, esi
mov eax, esi
cmovbe eax, edx
xor ebx, ebx
cmp edx, eax
mov r10d, ebx
cmovbe r10d, eax
cmovbe r8d, edx
cmp r8d, r10d
ja 0x1400faac0
nop
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x1400faab8
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp esi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, esi
mov esi, eax
cmp ebx, r8d
jae 0x1400faab8
mov ebx, r8d
inc r8d
cmp r8d, r10d
jbe 0x1400faa80
cmp esi, ebx
ja 0x1400fac44
mov rax, qword [rdi + 0xc8]
xor r9d, r9d
mov rcx, qword [rdi]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xb]
call qword [rdi + 0xc0]
jmp 0x1400fac44
test cl, cl
je 0x1400fac73
mov edx, dword [rdi + 0xac]
mov rax, qword [rdi + 0xa0]
mov ecx, dword [rax + 0x2c]
cmp ecx, edx
mov rax, qword [rdi + 0x130]
mov r9d, ecx
cmovbe r9d, edx
cmovbe edx, ecx
mov r8d, dword [rax]
test r8d, r8d
je 0x1400fac3c
lea ebp, [r8 - 1]
cmp r9d, ebp
mov eax, ebp
mov esi, ebp
cmovbe eax, r9d
cmp edx, eax
cmovbe r8d, edx
xor ebx, ebx
cmp edx, eax
mov r11d, ebx
mov edx, ebx
cmovbe r11d, eax
test r8d, r8d
je 0x1400fab86
mov r9d, ebx
nop dword [rax]
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r10, qword [r9 + rcx]
mov eax, dword [r10]
test al, 2
je 0x1400fab7b
and eax, 0xfffffffd
cmp esi, edx
mov dword [r10], eax
mov eax, edx
cmovbe eax, esi
mov esi, eax
cmp ebx, edx
jae 0x1400fab7b
mov ebx, edx
inc edx
add r9, 8
cmp edx, r8d
jb 0x1400fab50
cmp r8d, r11d
ja 0x1400fabd5
nop dword [rax + rax]
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x1400fabcd
test cl, 2
jne 0x1400fabcd
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp esi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, esi
mov esi, eax
cmp ebx, r8d
jae 0x1400fabcd
mov ebx, r8d
inc r8d
cmp r8d, r11d
jbe 0x1400fab90
lea r8d, [r11 + 1]
cmp r8d, ebp
ja 0x1400fac17
nop
mov rax, qword [rdi + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov eax, dword [r9]
test al, 2
je 0x1400fac0f
and eax, 0xfffffffd
cmp esi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, esi
mov esi, eax
cmp ebx, r8d
jae 0x1400fac0f
mov ebx, r8d
inc r8d
cmp r8d, ebp
jbe 0x1400fabe0
cmp esi, ebx
ja 0x1400fac44
mov rax, qword [rdi + 0xc8]
xor r9d, r9d
mov rcx, qword [rdi]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0xb]
call qword [rdi + 0xc0]
jmp 0x1400fac44
mov ebx, dword [rsp + 0x58]
mov esi, dword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov r9b, 1
mov r8d, ebx
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rdi
call fcn.1400f9070
test al, al
je 0x1400fac73
mov rcx, qword [rdi]
lea rdx, [rsp + 0x30]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret