Function at 0x140192db0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2b0
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
movzx ebx, r8b
mov r14, rdx
mov rsi, rcx
mov r12d, 1
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x258
movzx ebp, r12w
call sub.VCRUNTIME140.dll_memset
mov byte [rsi], bl
mov qword [rsi + 1], 0
mov byte [rsi + 9], 0
movzx edx, word [r14]
test dx, dx
je 0x1401931b1
lea r15, [0x140000000]
mov r13d, 0xa0
movzx eax, dx
mov edi, 0xa2
add eax, 0xffffffdb
cmp eax, 0x59
ja case.0x140192e51.45
cdqe
movzx eax, byte [r15 + rax + 0x19321c]
mov ecx, dword [r15 + rax*4 + 0x1931f8]
add rcx, r15
jmp rcx
mov byte [rsi + 1], r12b
jmp 0x14019319f
mov byte [rsi + 1], 0
jmp 0x140193197
mov r8d, r12d
mov byte [rsi + 5], r12b
xor r9d, r9d
mov byte [rsp + 0x20], 0
mov dl, reloc.WS2_32.dll_select
mov rcx, rsi
call fcn.140192b60
jmp 0x14019319f
mov r8d, r12d
mov byte [rsi + 2], r12b
xor r9d, r9d
mov byte [rsp + 0x20], 0
mov dl, reloc.WS2_32.dll_recv
mov rcx, rsi
call fcn.140192b60
jmp 0x14019319f
mov r8d, r12d
mov byte [rsi + 6], r12b
xor r9d, r9d
mov byte [rsp + 0x20], 0
mov dl, select
mov rcx, rsi
call fcn.140192b60
jmp 0x14019319f
mov r8d, r12d
mov byte [rsi + 9], r12b
xor r9d, r9d
mov byte [rsp + 0x20], 0
mov dl, 0x5b
mov rcx, rsi
call fcn.140192b60
jmp 0x14019319f
mov r8d, r12d
mov byte [rsp + 0x20], 0
movzx r9d, r12b
mov dl, reloc.WS2_32.dll_listen
mov rcx, rsi
call fcn.140192b60
jmp 0x140193197
movzx eax, word [r14 + 2]
lea rdx, [r14 + 2]
mov rbx, rdx
test ax, ax
je 0x140192f23
nop dword [rax]
cmp ax, 0x7d
je 0x140192f23
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140192f10
sub rbx, r14
sar rbx, 1
cmp rbx, 0x258
ja 0x1401931ec
mov r8, rbx
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rax, [rbx*2 - 2]
cmp rax, 0x258
jae 0x1401931f0
xor ecx, ecx
mov dword [rsp + 0x30], 0xffffffff
mov word [rsp + rax + 0x40], cx
lea rdx, str.VKEY
lea r14, [r14 + rbx*2]
lea r8d, [rcx + 4]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140192f97
lea rcx, [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov ebx, eax
jmp 0x140193103
mov r8d, 4
lea rdx, str.BEEP
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140192ffb
lea rdx, [0x1402c8fe0]
lea rcx, [rsp + 0x4a]
call sub.VCRUNTIME140.dll_wcsstr
mov rdi, rax
test rax, rax
je 0x14019319f
xor eax, eax
lea rcx, [rsp + 0x4a]
mov word [rdi], ax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
lea rcx, [rdi + 2]
mov ebx, eax
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov edx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Beep]
jmp 0x14019319f
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.APPACTIVATE
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140193028
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140192740
jmp 0x14019319f
mov r8d, 5
lea rdx, str.DELAY
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x140193072
cmp word [rsp + 0x4a], 0x3d
jne 0x14019305f
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov dword [rsi + 0xc], eax
jmp 0x14019319f
lea rcx, [rsp + 0x4a]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov dword [rsi + 0x10], eax
jmp 0x14019319f
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140193280
movzx ebx, ax
movsxd rax, dword [rsp + 0x30]
cmp eax, 0xffffffff
je 0x140193103
mov rdi, rax
mov ebp, r12d
add rdi, rdi
mov rcx, 0xffffffffffffffff
mov rax, qword [r15 + rdi*8 + 0x397380]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x1401930a6
lea rdx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1401930c0
cmp rax, rcx
jbe 0x1401930e1
lea rax, [rsp + 0x40]
lea rcx, [rax + rcx*2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
movzx ebp, ax
cmp byte [r15 + rdi*8 + 0x397389], 0
je 0x1401930fe
movzx ecx, byte [r15 + rdi*8 + 0x397388]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movzx ebx, ax
mov edi, 0xa2
mov eax, 0xffff
cmp bx, ax
je 0x14019319f
movzx eax, bx
mov rcx, rsi
sub ax, di
cmp ax, r12w
jbe 0x140193150
movzx eax, bx
sub ax, r13w
cmp ax, r12w
jbe 0x140193136
movzx r8d, bp
movzx edx, bx
jmp 0x14019318e
cmp bx, r13w
sete al
mov byte [rsi + 3], al
mov eax, 0xa1
cmp bx, ax
sete al
mov byte [rsi + 4], al
jmp 0x140193167
cmp bx, di
sete al
mov byte [rsi + 7], al
mov eax, 0xa3
cmp bx, ax
sete al
mov byte [rsi + 8], al
mov r8d, r12d
mov byte [rsp + 0x20], 0
xor r9d, r9d
movzx edx, bl
call fcn.140192b60
jmp 0x14019319f
movzx ecx, dx
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov r8d, r12d
mov rcx, rsi
movzx edx, ax
movzx r9d, r12b
call fcn.140192a40
mov rcx, rsi
call fcn.140192990
movzx edx, word [r14 + 2]
add r14, 2
test dx, dx
jne 0x140192e27
mov rcx, rsi
mov byte [rsi + 1], 0
call fcn.140192990
movzx eax, r12b
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1402654f0
mov rbx, qword [rsp + 0x300]
add rsp, 0x2b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor al, al
jmp 0x1401931c1
call fcn.140265f1c
int3