Function at 0x14009ef74
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
lea r12, [rcx + 0x1d0]
mov rdi, rcx
xor ebx, ebx
mov rcx, r12
mov r13, r9
mov r15, r8
mov esi, edx
mov r14d, ebx
call fcn.14009c3a0
test eax, eax
jle 0x14009eff7
mov edx, r14d
mov byte [rbp + 0x30], bl
mov rcx, r12
call fcn.14009c3cc
lea rcx, [rbp + 0x30]
mov r9, r13
mov qword [rsp + 0x20], rcx
mov r8, r15
mov edx, esi
mov rcx, rax
mov r10, qword [rax]
call qword [r10]
cmp byte [rbp + 0x30], bl
jne 0x14009f1a3
mov rcx, r12
inc r14d
call fcn.14009c3a0
cmp r14d, eax
jl 0x14009efb6
sub esi, 0x100
je 0x14009f0f0
sub esi, 4
je 0x14009f096
sub esi, 2
je 0x14009f044
sub esi, 0xfb
je 0x14009f01e
cmp esi, 3
jne 0x14009f024
mov byte [rdi + 0x134], bl
xor al, al
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, r15d
mov dword [rbp + 0x30], ebx
call fcn.1403a7830
mov rcx, qword [rdi + 0x98]
lea r8, [rbp + 0x30]
mov word [rbp + 0x30], ax
lea rdx, [0x1400a3eb0]
mov r9d, 0x8000000a
mov rax, qword [rcx]
call qword [rax + 0x300]
mov rsi, rax
test rax, rax
je 0x14009f024
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x288]
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x40]
jmp 0x14009f225
cmp qword [rdi + 0xa0], rbx
je 0x14009f024
mov rax, qword [rdi + 0xd8]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x2c], rbx
mov dword [rbp - 0x24], ebx
mov dword [rbp - 0x30], 6
mov word [rbp - 0x14], r15w
call fcn.14009dd08
mov word [rbp - 0x12], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0xa0]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x20], eax
mov rax, qword [rcx]
call qword [rax + 0x328]
jmp 0x14009f024
cmp r15, 9
jne 0x14009f024
lea ecx, [r15 + 8]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x14009f1aa
mov rax, qword [rdi + 0xd0]
test rax, rax
jne 0x14009f147
mov rcx, qword [rdi + 0x98]
lea rdx, [0x1400a3e90]
mov r9d, 0x8000000b
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0x300]
mov qword [rdi + 0xd0], rax
test rax, rax
je 0x14009f1a3
mov ecx, reloc.WS2_32.dll_recv
mov qword [rbp - 0x2c], rbx
mov dword [rbp - 0x24], ebx
mov word [rbp - 0x14], bx
mov qword [rbp - 8], rbx
mov dword [rbp - 0x30], 7
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rax, qword [rdi + 0xd8]
mov qword [rbp - 0x1c], rax
setns bl
mov qword [rbp - 0x10], rbx
call fcn.14009dd08
mov word [rbp - 0x12], ax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rdi + 0xd0]
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x20], eax
mov rax, qword [rcx]
call qword [rax + 0x328]
mov al, 1
jmp 0x14009f026
mov rcx, qword [rdi + 0xa0]
test rcx, rcx
je 0x14009f20c
mov rax, qword [rcx]
call qword [rax + 0x228]
test al, al
je 0x14009f20c
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x248]
test al, al
je 0x14009f20c
mov rcx, qword [rdi + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
lea rdx, str.RichEditUI
call fcn.14039aed8
test rax, rax
je 0x14009f20c
mov rcx, qword [rdi + 0xa0]
call fcn.1400b6e04
test al, al
jne 0x14009f024
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rdi
setns dl
call fcn.1400a26b8
mov byte [rdi + 0x134], 1
jmp 0x14009f1a3