Function at 0x100059e18
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
xor r14d, r14d
mov r12, r9
mov esi, r8d
mov rdi, rcx
cmp byte [rcx + 0x18], r14b
je 0x10005a2df
call fcn.10004e4d8
mov dl, byte [0x10019018a]
mov rbx, rax
cmp dl, r14b
je 0x100059e6a
lea rcx, [0x10019a4f8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dl, byte [0x10019018a]
mov bl, byte [rbx + 0x246]
cmp dl, r14b
je 0x100059e82
lea rcx, [0x10019a4f8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebp, 0x100
mov r10d, 0x203
cmp bl, r14b
je 0x100059ecf
cmp esi, 0x201
je 0x100059ea3
cmp esi, r10d
je 0x100059ea3
cmp esi, ebp
jne 0x100059ecf
mov rdx, qword [rdi + 0x240]
mov r8d, r14d
cmp dword [rdx + 0x18], r14d
jle 0x100059ecf
mov r9, r14
mov rax, qword [rdx + 0x10]
inc r8d
mov rcx, qword [r9 + rax]
add r9, 8
mov byte [rcx + 1], 1
cmp r8d, dword [rdx + 0x18]
jl 0x100059eb6
mov r13, qword [rsp + 0x80]
cmp byte [rdi + 0x19], r14b
je 0x100059fbb
cmp esi, 0x201
je 0x100059f63
cmp esi, r10d
je 0x100059f63
cmp esi, 0x202
jne 0x100059fbb
cmp byte [0x1001a90b5], r14b
je 0x100059fbb
mov ecx, dword [rdi + 0x21c]
mov rax, r13
movsx edx, r13w
shr rax, 0x10
cmp edx, ecx
movsx r8d, ax
jl 0x100059fbb
mov eax, dword [rdi + 0x224]
add ecx, eax
cmp edx, ecx
jge 0x100059fbb
mov edx, dword [rdi + 0x220]
cmp r8d, edx
jl 0x100059fbb
add edx, dword [rdi + 0x22c]
cmp r8d, edx
jge 0x100059fbb
call qword [sym.imp.USER32.dll_ReleaseCapture]
cmp byte [rdi + 0x1a], r14b
mov byte [0x1001a90b5], r14b
sete cl
mov byte [rdi + 0x1a], cl
jmp 0x100059fb4
mov ecx, dword [rdi + 0x21c]
mov rax, r13
movsx r8d, r13w
shr rax, 0x10
cmp r8d, ecx
movsx edx, ax
jl 0x100059fbb
mov eax, dword [rdi + 0x224]
add ecx, eax
cmp r8d, ecx
jge 0x100059fbb
mov ecx, dword [rdi + 0x220]
cmp edx, ecx
jl 0x100059fbb
mov eax, dword [rdi + 0x22c]
add ecx, eax
cmp edx, ecx
jge 0x100059fbb
mov byte [0x1001a90b5], 1
call fcn.10005691c
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCapture]
mov al, 1
jmp 0x10005a2e1
cmp byte [rdi + 0x1a], r14b
jne 0x10005a2df
mov rdx, qword [0x10019f598]
cmp rdx, r14
je 0x10005a006
cmp qword [rdx + 0x20], rdi
jne 0x10005a006
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x78]
cmp al, r14b
je 0x100059fff
mov rcx, qword [0x10019f598]
mov r9, r13
mov r8, r12
mov rax, qword [rcx]
mov edx, esi
call qword [rax + 0x20]
cmp al, r14b
jne 0x100059fb4
mov rdx, qword [0x10019f598]
cmp esi, 3
je 0x10005a29e
cmp esi, 5
je 0x10005a29e
cmp esi, 0x1c
je 0x10005a26c
cmp esi, 0xff
jbe 0x10005a2df
cmp esi, 0x101
jbe 0x10005a171
cmp esi, 0x103
jbe 0x10005a2df
cmp esi, 0x105
jbe 0x10005a171
cmp esi, 0x1ff
jbe 0x10005a2df
cmp esi, 0x20d
ja 0x10005a2df
cmp byte [rdi + 2], r14b
je 0x10005a2df
mov rax, r13
movsx ecx, r13w
sub ecx, dword [rdi + 0x21c]
shr rax, 0x10
movsx r8d, ax
mov dword [rsp + 0x60], ecx
sub r8d, dword [rdi + 0x220]
mov dword [rsp + 0x64], r8d
cmp byte [rdi + 0x19], r14b
je 0x10005a0aa
sub r8d, dword [rdi + 0x22c]
mov dword [rsp + 0x64], r8d
mov rbx, qword [rsp + 0x60]
cmp rdx, r14
je 0x10005a0eb
cmp qword [rdx + 0x20], rdi
jne 0x10005a0eb
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x78]
cmp al, r14b
je 0x10005a0eb
mov rcx, qword [0x10019f598]
mov r9, r12
mov r8, rbx
mov rax, qword [rcx]
mov edx, esi
mov qword [rsp + 0x20], r13
call qword [rax + 0x30]
cmp al, r14b
jne 0x100059fb4
mov rdx, rbx
mov rcx, rdi
call fcn.10005a300
mov rbp, rax
cmp rax, r14
je 0x10005a12e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x78]
cmp al, r14b
je 0x10005a12e
mov r10, qword [rbp]
mov r9, r12
mov r8, rbx
mov edx, esi
mov rcx, rbp
mov qword [rsp + 0x20], r13
call qword [r10 + 0x30]
cmp al, r14b
je 0x10005a15d
jmp 0x100059fb4
cmp esi, 0x201
jne 0x10005a15d
mov rcx, qword [0x10019f598]
cmp rcx, r14
je 0x10005a2df
cmp qword [rcx + 0x20], rdi
jne 0x10005a2df
mov rax, qword [rcx]
call qword [rax + 0x48]
mov qword [0x10019f598], r14
cmp esi, 0x200
jne 0x10005a2df
mov rdx, rbx
jmp 0x10005a2ae
cmp rdx, r14
je 0x10005a1af
cmp qword [rdx + 0x20], rdi
jne 0x10005a1af
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x78]
cmp al, r14b
je 0x10005a1a8
mov rcx, qword [0x10019f598]
mov r9, r13
mov r8, r12
mov rax, qword [rcx]
mov edx, esi
call qword [rax + 0x28]
cmp al, r14b
jne 0x100059fb4
mov rdx, qword [0x10019f598]
cmp esi, ebp
jne 0x10005a2df
cmp rdx, r14
je 0x10005a1c8
cmp dword [rdx + 0x44], 6
je 0x10005a1f6
cmp dword [rdx + 0x44], 7
je 0x10005a1f6
cmp dword [rdi + 0x280], r14d
mov r8d, r14d
jle 0x10005a1f6
mov r9, qword [rdi + 0x278]
mov rcx, qword [r9]
mov eax, dword [rcx + 0x48]
cmp rax, r12
je 0x10005a238
inc r8d
add r9, 8
cmp r8d, dword [rdi + 0x280]
jl 0x10005a1db
cmp byte [rdi + 1], r14b
je 0x10005a2df
cmp r12, 9
je 0x10005a250
cmp r12, 0x24
jbe 0x10005a2df
cmp r12, 0x26
jbe 0x10005a243
cmp r12, 0x28
ja 0x10005a2df
cmp rdx, r14
je 0x10005a2df
mov dl, 1
mov rcx, rdi
call fcn.10005af5c
jmp 0x10005a2e1
mov rax, qword [rcx]
call qword [rax + 0x60]
jmp 0x100059fb4
cmp rdx, r14
je 0x10005a2df
xor edx, edx
jmp 0x10005a22b
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
shr r11d, 0xf
and r11b, 1
sete dl
jmp 0x10005a22b
cmp rdx, r14
je 0x10005a2df
cmp qword [rdx + 0x20], rdi
jne 0x10005a2df
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + 0x78]
cmp al, r14b
je 0x10005a2df
mov rcx, qword [0x10019f598]
mov rax, qword [rcx]
cmp r12, r14
je 0x10005a299
call qword [rax + 0x40]
jmp 0x10005a2df
call qword [rax + 0x48]
jmp 0x10005a2df
or eax, 0xffffffff
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
mov rdx, qword [rsp + 0x60]
mov rcx, rdi
call fcn.10005a300
mov rcx, qword [rdi + 0x10]
mov rbx, rax
cmp rax, rcx
je 0x10005a2df
cmp rcx, r14
je 0x10005a2cd
mov rdx, qword [rcx]
call qword [rdx + 0x58]
mov qword [rdi + 0x10], rbx
cmp rbx, r14
je 0x10005a2df
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x50]
xor al, al
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret