Function at 0x1401de970
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x80
test dword [rcx + 4], 0x4001
mov r14d, r9d
mov esi, r8d
mov ebx, edx
mov rdi, rcx
jne 0x1401defe0
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, qword [rdi + 0x40]
jne 0x1401dea90
sub ebx, 0x1b
je 0x1401dea48
sub ebx, 0x3d
je 0x1401dea0a
cmp ebx, 1
jne 0x1401defe0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x60d
mov rcx, rdi
call fcn.1401df590
mov ecx, 2
xor esi, esi
cmp eax, ecx
mov edx, 0x60e
cmove ecx, esi
xor r8d, r8d
mov ebx, ecx
mov r9d, ecx
mov rcx, rdi
call fcn.1401df590
mov edx, ebx
mov rcx, rdi
call fcn.1401de900
jmp 0x1401defe0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x60d
mov rcx, rdi
call fcn.1401df590
xor esi, esi
mov edx, 0x60e
cmp eax, 1
mov rcx, rdi
setne sil
xor r8d, r8d
mov r9d, esi
call fcn.1401df590
mov edx, esi
mov rcx, rdi
call fcn.1401de900
jmp 0x1401defe0
test esi, esi
je 0x1401defe0
mov rax, qword [rdi + 0x88]
mov r9d, 8
mov qword [rdi + 0x180], rax
xor r8d, r8d
mov rax, qword [rdi + 0x90]
xor edx, edx
mov qword [rdi + 0x188], rax
mov rcx, rdi
mov eax, dword [rdi + 0x98]
mov dword [rdi + 0x190], eax
call fcn.1401dcdb0
jmp 0x1401defe0
mov qword [rsp + 0x90], rbp
lea eax, [rbx - 0x21]
test esi, esi
je 0x1401def0b
cmp eax, 0x48
ja case.0x1401deac7.2
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1df03c]
mov ecx, dword [rdx + rax*4 + 0x1deffc]
add rcx, rdx
xor esi, esi
jmp rcx
movabs rax, 0xbff0000000000000
jmp 0x1401deb8c
mov qword [rdi + 0x180], rsi
movabs rax, 0xbff0000000000000
jmp 0x1401deb93
movabs rax, 0x3ff0000000000000
mov qword [rdi + 0x180], rax
movabs rax, 0xbff0000000000000
jmp 0x1401deb93
movabs rax, 0xbff0000000000000
mov qword [rdi + 0x188], rsi
mov qword [rdi + 0x180], rax
jmp 0x1401deb9a
mov qword [rdi + 0x180], rsi
mov qword [rdi + 0x188], rsi
jmp 0x1401deb9a
movabs rax, 0x3ff0000000000000
mov qword [rdi + 0x188], rsi
mov qword [rdi + 0x180], rax
jmp 0x1401deb9a
movabs rax, 0xbff0000000000000
mov qword [rdi + 0x180], rax
movabs rax, 0x3ff0000000000000
jmp 0x1401deb93
mov qword [rdi + 0x180], rsi
movabs rax, 0x3ff0000000000000
jmp 0x1401deb93
movabs rax, 0x3ff0000000000000
mov qword [rdi + 0x180], rax
mov qword [rdi + 0x188], rax
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1401dec04
movsd xmm0, qword [rdi + 0x188]
xorps xmm2, xmm2
ucomisd xmm0, xmm2
jp 0x1401debcd
jne 0x1401debcd
movsd xmm1, qword [rdi + 0x180]
ucomisd xmm1, xmm2
jp 0x1401debcd
je 0x1401dec04
movsd xmm1, qword [rdi + 0x180]
movaps xmmword [rsp + 0x70], xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2
movaps xmm6, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movsd qword [rdi + 0x180], xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
movaps xmm6, xmmword [rsp + 0x70]
movsd qword [rdi + 0x188], xmm0
mov ebp, 1
mov r8d, 0x2710
mov edx, ebp
mov rcx, rdi
call fcn.1401dbfe0
mov ecx, dword [rdi + 8]
mov r9d, 5
shl ebp, cl
dec ebp
jmp 0x1401def41
mov esi, 0x10
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ebx, 0xe
cmovs ebx, esi
jmp 0x1401decbb
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0xf
mov ebp, 0x11
test ax, ax
cmovs ebx, ebp
jmp 0x1401decbb
mov ebp, 0x11
mov ecx, ebp
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [rbp - 5]
mov ebx, ebp
jmp 0x1401decb5
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0xe
lea ecx, [rbx - 3]
jmp 0x1401decb5
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x10
lea ecx, [rbx - 6]
jmp 0x1401decb5
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xd
mov ebx, 0xf
test ax, ax
cmovs ebx, ecx
movsd xmm2, qword [0x1404538b8]
mov edx, ebx
mov rcx, rdi
call fcn.1401dc4d0
mov ebp, 1
mov r8d, 0x2710
mov edx, ebp
mov rcx, rdi
call fcn.1401dbfe0
mov r9d, ebx
jmp 0x1401def38
mov eax, dword [rdi]
test al, 2
je 0x1401deeb1
mov ebp, 1
cmp ebx, 9
je 0x1401ded3d
cmp ebx, 0x20
jne 0x1401deeb1
mov ecx, dword [rdi + 0x1f4]
cmp ecx, 0xffffffff
je 0x1401ded3d
test bl, al
je 0x1401ded2e
cmp dword [rdi + 0x190], 0
je 0x1401ded2e
mov eax, ebp
shl eax, cl
xor dword [rdi + 0x1f8], eax
jmp 0x1401dee9c
mov eax, ebp
shl eax, cl
xor dword [rdi + 0xac], eax
jmp 0x1401dee9c
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cmp dword [rdi + 0xa8], 0
je 0x1401deeb1
test ax, ax
jns 0x1401dee03
sub dword [rdi + 0x1f4], ebp
jns 0x1401ded96
mov rax, qword [rdi + 0x50]
mov dword [rdi + 0x1f4], 8
test rax, rax
jne 0x1401ded83
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
mov r8, rbp
mov rcx, rax
lea edx, [r9 + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [rdi + 0x1f4]
mov eax, dword [rdi + 0xa8]
bt eax, ecx
jb 0x1401dee9c
nop dword [rax + rax]
lea eax, [rcx - 1]
mov dword [rdi + 0x1f4], eax
test eax, eax
jns 0x1401deded
mov rax, qword [rdi + 0x50]
mov dword [rdi + 0x1f4], 8
test rax, rax
jne 0x1401dedda
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
mov r8, rbp
mov rcx, rax
lea edx, [r9 + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [rdi + 0x1f4]
mov eax, dword [rdi + 0xa8]
bt eax, ecx
jae 0x1401dedb0
jmp 0x1401dee9c
inc dword [rdi + 0x1f4]
xor esi, esi
cmp dword [rdi + 0x1f4], 8
jbe 0x1401dee40
mov rax, qword [rdi + 0x50]
mov dword [rdi + 0x1f4], esi
test rax, rax
jne 0x1401dee2d
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [rdi + 0x1f4]
mov eax, dword [rdi + 0xa8]
bt eax, ecx
jb 0x1401dee9c
lea eax, [rcx + 1]
mov dword [rdi + 0x1f4], eax
cmp eax, 8
jbe 0x1401dee8b
mov rax, qword [rdi + 0x50]
mov dword [rdi + 0x1f4], esi
test rax, rax
jne 0x1401dee78
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x28]
call qword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [rdi + 0x1f4]
mov eax, dword [rdi + 0xa8]
bt eax, ecx
jae 0x1401dee51
mov r8d, 0x2710
mov edx, ebp
mov rcx, rdi
call fcn.1401dbfe0
jmp case.0x1401def2d.2
mov eax, dword [rsp + 0xb0]
mov rcx, qword [rdi + 0x40]
mov r8d, dword [rdi + 0x48]
mov dword [rsp + 0x60], eax
mov rax, qword [rdi + 0x50]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x50], 0xffffff9a
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], r14d
test rax, rax
jne 0x1401deef3
call qword [sym.imp.USER32.dll_GetParent]
mov r8, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov edx, 0x4e
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1401def2d.2
cmp eax, 0x38
ja case.0x1401def2d.2
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1df098]
mov ecx, dword [rdx + rax*4 + 0x1df088]
add rcx, rdx
jmp rcx
mov ebp, 1
lea r9d, [rbp + 7]
mov ecx, dword [rdi + 8]
shl ebp, cl
dec ebp
xor esi, esi
mov r8, qword [rdi + 0x3c8]
lea rax, [rdi + 0xc]
mov edx, dword [rdi + 0x48]
mov rcx, rdi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call qword [rdi + 0x3d0]
jmp case.0x1401def2d.2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x60d
mov rcx, rdi
call fcn.1401df590
xor esi, esi
mov edx, 0x60e
cmp eax, 1
mov rcx, rdi
setne sil
xor r8d, r8d
mov r9d, esi
call fcn.1401df590
mov edx, esi
jmp 0x1401defd0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x60d
mov rcx, rdi
call fcn.1401df590
mov ecx, 2
xor esi, esi
cmp eax, ecx
mov edx, 0x60e
cmove ecx, esi
xor r8d, r8d
mov ebx, ecx
mov r9d, ecx
mov rcx, rdi
call fcn.1401df590
mov edx, ebx
mov rcx, rdi
call fcn.1401de900
mov rbp, qword [rsp + 0x90]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret