Function at 0x140064fb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, qword [0x140240cb8]
mov qword [rsp + 0x50], rbx
mov rcx, qword [0x140240c90]
mov rdi, rcx
mov qword [rsp + 0x58], rcx
cmp byte [rbx], 0
je 0x1400650fb
call fcn.1400e9840
test eax, eax
jne 0x1400650fb
call fcn.1400e9300
movzx ecx, byte [0x140240b0e]
call fcn.1400efd60
nop
mov rdx, rdi
mov rcx, rbx
call fcn.140065410
jmp 0x140065020
mov rcx, qword [0x140240c90]
call fcn.1400edb10
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
movzx r8d, byte [rbx + 1]
mov edx, 0x20007
mov rcx, rdi
call fcn.1400e9320
cmp byte [rbx + 1], 0
jne 0x140065068
mov edx, 0x2000d
mov r8d, 1
mov rcx, rdi
call fcn.1400e9320
cmp byte [rbx + 1], 0
je 0x1400650e7
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400650a0
cmp byte [reloc.WS2_32.dll_accept], 0
sete al
mov byte [reloc.WS2_32.dll_accept], al
test al, al
je 0x1400650a0
mov rcx, qword [0x140240c90]
call fcn.1400edb10
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rcx, [0x140240e68]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [0x140240e68]
mov rcx, qword [0x140240ba8]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [0x140240e68]
cvtdq2ps xmm0, xmm0
movd xmm1, dword [0x140240e6c]
cvtdq2ps xmm1, xmm1
movss dword [0x140240bc8], xmm0
movss dword [0x140240bcc], xmm1
mov rcx, rdi
call fcn.1400efd20
mov rcx, qword [0x140240c90]
jmp 0x140064fe1
mov byte [0x140240b0f], 0
lea rcx, [rsp + 0x50]
call fcn.140053cf0
movabs r14, 0x7ffffffffa0a1eff
mov rax, qword [rsp + 0x50]
mov esi, 0xff
cmp rax, r14
je 0x140065148
mov ecx, 1
cmovl ecx, esi
test cl, cl
jns 0x140065148
add rax, 0x5f5e100
mov qword [rsp + 0x50], rax
movabs rdi, 0x7fffffffffffffff
jmp 0x140065157
movabs rdi, 0x7fffffffffffffff
mov qword [rsp + 0x50], rdi
lea rcx, [rsp + 0x50]
call fcn.140055140
mov byte [rbx], 0
lea rcx, [rsp + 0x50]
call fcn.140053cf0
mov rax, qword [rsp + 0x50]
cmp rax, r14
je 0x140065191
mov ecx, 1
cmovl ecx, esi
test cl, cl
jns 0x140065191
add rax, 0x5f5e100
mov qword [rsp + 0x50], rax
jmp 0x140065196
mov qword [rsp + 0x50], rdi
lea rcx, [rsp + 0x50]
call fcn.140055140
mov rbx, qword [0x140240920]
xor edi, edi
test rbx, rbx
je 0x1400651b7
mov r15, qword [rbx + 0x98]
jmp 0x1400651ba
mov r15, rdi
lea r14, [rbx + 8]
test rbx, rbx
je 0x1400651cc
mov rsi, qword [rbx + 0x98]
jmp 0x1400651cf
mov rsi, rdi
cmp dword [rsi + 0x48], 0
je 0x1400651ee
lea rdx, [rsi + 0x48]
mov ecx, 1
call qword [0x1402409b0]
mov dword [rsi + 0x48], edi
mov rbx, qword [0x140240920]
cmp dword [rsi + 0x4c], 0
je 0x14006520d
lea rdx, [rsi + 0x4c]
mov ecx, 1
call qword [0x1402409b0]
mov dword [rsi + 0x4c], edi
mov rbx, qword [0x140240920]
mov ecx, dword [rsi + 0x30]
test ecx, ecx
je 0x140065224
call qword [0x1402409b8]
mov dword [rsi + 0x30], edi
mov rbx, qword [0x140240920]
test rbx, rbx
je 0x140065232
mov rsi, qword [rbx + 0x98]
jmp 0x140065235
mov rsi, rdi
cmp dword [rsi + 0x2c], 0
je 0x14006525c
lea rdx, [rsi + 0x2c]
mov ecx, 1
call qword [0x1402409c8]
mov rax, qword [rbx + 0x38]
mov qword [rax + 8], rdi
mov dword [rsi + 0x2c], edi
mov rbx, qword [0x140240920]
mov qword [r14 + 0x80], rdi
mov qword [r14 + 0x90], rdi
and dword [r14 + 4], 0xfffffff7
test r15, r15
je 0x14006528f
test rbx, rbx
je 0x14006527f
dec dword [rbx + 0xec]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x140240920]
test rbx, rbx
je 0x14006529d
mov r15, qword [rbx + 0x90]
jmp 0x1400652a0
mov r15, rdi
cmp byte [r15 + 0x70], 0
je 0x14006536a
mov r14, qword [r15]
test rbx, rbx
je 0x1400652bc
mov rsi, qword [rbx + 0x90]
jmp 0x1400652bf
mov rsi, rdi
mov rdx, qword [rsi + 0x78]
mov rcx, r14
call fcn.1400e9400
mov rdx, qword [rsi + 0x88]
mov rcx, r14
call fcn.1400e7cd0
mov rdx, qword [rsi + 0x80]
mov rcx, r14
call fcn.1400e7e10
mov rdx, qword [rsi + 0x90]
mov rcx, r14
call fcn.1400e80d0
mov rdx, qword [rsi + 0x98]
mov rcx, r14
call fcn.1400e8110
mov rdx, qword [rsi + 0xa0]
mov rcx, r14
call fcn.1400e8090
mov rdx, qword [rsi + 0xa8]
mov rcx, r14
call fcn.1400e7c50
mov rcx, qword [rsi + 0xb0]
call fcn.1400e9f80
mov byte [rsi + 0x70], 0
mov qword [rsi + 0x78], rdi
mov qword [rsi + 0x88], rdi
mov qword [rsi + 0x80], rdi
mov qword [rsi + 0x90], rdi
mov qword [rsi + 0x98], rdi
mov qword [rsi + 0xa0], rdi
mov qword [rsi + 0xa8], rdi
mov qword [rsi + 0xb0], rdi
lea rsi, [r15 + 0x20]
mov r14d, 9
mov rcx, qword [rsi]
call fcn.1400e6fa0
lea rsi, [rsi + 8]
sub r14, 1
jne 0x140065374
mov rax, qword [0x140240920]
mov rcx, qword [rax + 0x48e8]
mov rcx, qword [rcx]
mov r8, qword [r15 + 0xb8]
lea edx, [r14 - 4]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [r15 + 0xb8], rdi
mov qword [rbx + 0x80], rdi
mov qword [rbx + 0x90], rdi
and dword [rbx + 0xc], 0xfffffff8
mov rax, qword [0x140240920]
test rax, rax
je 0x1400653d7
dec dword [rax + 0xec]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140240c90]
call fcn.1400e8fa0
call fcn.1400ea930
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret