Function at 0x140026250
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rax, qword [0x140096008]
xor rax, rsp
mov qword [rbp - 9], rax
xor ebx, ebx
mov dword [rbp - 0x49], r9d
mov r14d, edx
mov dword [rbp - 0x55], ebx
mov r15d, r8d
mov dword [rbp - 0x39], ebx
mov r12, rcx
mov dword [rbp - 0x3d], ebx
lea edi, [rbx + 1]
mov dword [rbp - 0x45], ebx
lea edx, [rbx + 8]
mov dword [rbp - 0x59], edi
or r13d, 0xffffffff
mov dword [rbp - 0x41], ebx
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov qword [rbp - 0x21], rax
mov rsi, rax
test rax, rax
je 0x140026a1b
mov rcx, qword [0x1400b8a28]
call qword [sym.imp.USER32.dll_SetCursor]
lea ecx, [rbx + 0x10]
mov dword [0x140096f20], edi
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
mov edx, r14d
shr rdi, 8
mov qword [rbp - 0x31], rdi
sub edx, 0x452
je 0x140026378
sub edx, 1
je 0x14002637f
sub edx, 7
je 0x14002632d
cmp edx, 2
jne 0x1400263b8
mov rcx, rsi
mov r14d, 0x457
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rsi
movzx r15d, word [rax + 0xf6]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x1400263b8
mov r9d, 0x7fff
lea rcx, [rbp - 0x19]
xor r8d, r8d
mov dword [rsp + 0x20], r9d
xor edx, edx
call qword [sym.imp.USER32.dll_SetRect]
mov edx, 8
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x140026366
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.140034bac
test dil, dil
jne 0x140026a1b
or dword [0x140096e2c], 0xffffffff
jmp 0x1400263b8
mov dword [rbp - 0x45], 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rcx, [rbp - 0x51]
mov r9d, 1
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x29]
mov rcx, rax
xor edx, edx
call fcn.140060910
mov rcx, rsi
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test edi, edi
je 0x140026a1b
xor edx, edx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rdi, rax
test rax, rax
je 0x140026a1b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rdi
mov eax, dword [rax + 8]
mov dword [rbp - 0x51], eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rsi, rax
cmp dword [rbp - 0x49], ebx
je 0x14002646d
mov rcx, qword [rsi + 0xba]
lea rax, [0x1400226e0]
mov qword [0x140096e08], rax
lea rdi, [rsi + 0xde]
mov qword [0x140096d48], rcx
lea rax, [0x14001dfb0]
mov rcx, qword [rsi + 0x1e6]
mov edx, 0x64
mov qword [0x140096e00], rax
mov r9, rdi
lea rax, [0x14001faf0]
mov qword [0x140096d40], rcx
mov ecx, dword [rsi + 0x26]
lea r8d, [rdx + 3]
mov qword [0x140096df8], rax
call fcn.140045710
test eax, eax
jne 0x140026a1b
mov rax, qword [rdi]
mov qword [0x140096d50], rax
jmp 0x140026482
mov qword [0x140096e08], rbx
mov qword [0x140096e00], rbx
mov qword [0x140096df8], rbx
test byte [rsi + 0x22], 0x80
je 0x1400269e9
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
lea rcx, [rbp - 0x19]
xor edx, edx
call qword [sym.imp.USER32.dll_SetRect]
mov rcx, qword [rsi + 0xfe]
test rcx, rcx
je 0x1400264ee
call qword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [rax + 0x64], 2
jne 0x1400264cc
mov ecx, dword [rax + 0x5c]
movsx eax, word [rax + 0x5c]
shr rcx, 0x10
movsx r13d, cx
mov dword [rbp - 0x55], eax
mov rcx, qword [rsi + 0xfe]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, 1
mov rdx, rsi
mov r8d, edi
mov rcx, r12
call fcn.1400605c8
jmp 0x1400264f3
mov edi, 1
or dword [rsi + 0x42], 0xffffffff
cmp r14d, 0x454
je 0x14002650c
lea eax, [r14 - 0x457]
cmp eax, 2
ja 0x140026513
mov dword [0x140096e2c], r15d
mov r8d, dword [rsi + 0xf6]
lea r15, [rsi + 0xea]
mov ecx, dword [rsi + 0x26]
mov r9, r15
mov edx, 0x65
call fcn.140045710
test eax, eax
jne 0x1400269e9
lea eax, [r14 - 0x44e]
cmp eax, 0xb
ja case.0x14002655c.1104
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x26a44]
add rcx, rdx
jmp rcx
mov dword [rbp - 0x4d], ebx
lea rax, [0x140026240]
mov rdx, qword [r15]
lea r9, [rbp - 0x4d]
mov ecx, dword [rsi + 0x26]
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x20], rax
call fcn.140022200
mov ecx, dword [rbp - 0x4d]
mov r13d, 0x458
inc ecx
mov dword [rbp - 0x59], edi
mov dword [rbp - 0x4d], ecx
mov dword [rbp - 0x55], ecx
cmp r14d, r13d
jne 0x1400265e3
mov r8d, ecx
lea rdx, [rbp - 0x55]
lea rcx, [rbp - 0x59]
call fcn.14005dbe8
test eax, eax
je 0x1400269e9
mov rcx, qword [0x1400b8a28]
call qword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [rbp - 0x59]
mov edx, dword [rbp - 0x55]
sub ecx, edi
mov dword [0x140096f20], edi
cmovs ecx, ebx
sub edx, edi
cmovs edx, ebx
cmp ecx, edx
jle 0x1400265e7
mov eax, edx
mov edx, ecx
mov ecx, eax
jmp 0x1400265e7
dec ecx
mov edx, ecx
movzx ecx, cx
mov r14d, r13d
shl ecx, 0x10
movzx eax, dx
or ecx, eax
mov dword [0x140096e2c], ecx
lea rax, [0x1400234c0]
mov r13d, ebx
mov qword [0x140096dc8], rax
jmp 0x140026695
test r13d, r13d
js case.0x14002655c.1102
mov ecx, dword [rsi + 0x26]
lea r9, [rbp - 0x29]
mov r8d, r13d
mov edx, 0x65
call fcn.14004564c
test eax, eax
jne case.0x14002655c.1102
mov rdi, qword [rbp - 0x29]
mov rcx, rdi
call fcn.14004708c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, dword [rbp - 0x55]
mov rcx, rax
call fcn.140021bb8
mov rcx, rdi
or dword [rax + 0x2c], 4
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp case.0x14002655c.1102
mov ecx, dword [0x140096e2c]
mov eax, ecx
shr rax, 0x10
cwde
mov dword [rsi + 0x42], eax
movsx eax, cx
mov dword [rsi + 0x46], eax
jmp case.0x14002655c.1102
mov ecx, dword [0x140096e2c]
mov r14d, ebx
mov eax, ecx
mov dword [rbp - 0x41], edi
shr rax, 0x10
cwde
mov dword [rbp - 0x39], eax
movsx eax, cx
mov dword [rbp - 0x3d], eax
mov r13d, dword [rbp - 0x59]
mov eax, dword [rsi + 0xfa]
mov dword [0x140096df0], eax
mov qword [0x140096de8], r12
cmp qword [rsi + 0x206], rbx
je 0x1400266e5
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDC]
mov rdx, qword [rsi + 0x206]
xor r8d, r8d
mov rcx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_RealizePalette]
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
test dword [rsi + 0x22], 0x200
jne 0x1400266fc
mov eax, dword [rbp - 0x51]
test eax, eax
je 0x140026706
cmp eax, 0x1f4
jge 0x140026706
mov dword [0x140096da4], 1
test r14d, r14d
jle 0x1400267f4
cmp byte [rbp - 0x31], bl
lea rax, [0x140023aa0]
mov qword [0x140096d98], rax
mov rcx, r12
lea rax, [0x1400237b0]
mov dword [0x140096d88], r14d
mov qword [0x140096d80], rax
mov rax, rbx
setne al
mov qword [0x140096d90], rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
lea rdx, [0x1400b96e0]
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetWindowOrgEx]
lea rcx, [rsi + 0x106]
mov rdx, qword [rbp - 0x31]
mov qword [0x140096dd8], rcx
mov dword [0x140096e30], ebx
mov dword [0x140096dc0], ebx
cmp dword [rsi + 0x32], ebx
je 0x140026785
test dl, dl
jne 0x14002678c
mov dword [rcx + 4], 1
lea rax, [rsi + 0x186]
mov qword [0x140096dd0], rax
cmp dword [rsi + 0x36], ebx
je 0x1400267a3
test dl, dl
jne 0x1400267a9
mov dword [rax], 1
mov r9, qword [r15]
lea rax, [rbp - 0x19]
mov r8d, dword [rsi + 0x26]
mov rcx, rdi
mov dword [rsp + 0x40], r13d
mov r13d, dword [rbp - 0x51]
mov edx, r13d
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rax
mov rax, qword [rsi + 0x6e]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.1400229cc
mov rdx, rdi
mov qword [0x140096dc8], rbx
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
jmp 0x1400267f8
mov r13d, dword [rbp - 0x51]
cmp qword [0x140096d90], rbx
je 0x14002680a
test r14d, r14d
jne 0x1400268ab
lea rax, [0x140024790]
mov dword [0x140096d88], ebx
mov qword [0x140096d98], rax
mov rcx, r12
lea rax, [0x1400246f0]
mov qword [0x140096d90], rbx
mov qword [0x140096d80], rax
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
lea rdx, [0x1400b96e0]
mov rdi, rax
call qword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov rcx, qword [rsi + 0x6e]
mov eax, 1
mov r9, qword [r15]
mov edx, r13d
mov r8d, dword [rsi + 0x26]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x38], ebx
mov dword [0x140096dc0], eax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rcx
mov rcx, rdi
mov dword [0x140096e30], ebx
mov qword [0x140096dd8], rbx
mov qword [0x140096dd0], rbx
call fcn.1400229cc
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rax, [rsi + 0x106]
mov dword [0x140096da4], ebx
mov ecx, dword [rax + 4]
lea r15, [rsi + 0x186]
mov qword [0x140096dd8], rax
mov eax, ecx
or eax, dword [r15]
bt eax, 0xe
mov qword [0x140096dd0], r15
jb 0x1400268f0
cmp ecx, 1
jne 0x1400268e5
cmp dword [rsi + 0x32], ebx
jne 0x1400268f0
cmp dword [r15], 1
jne 0x140026917
cmp dword [rsi + 0x36], ebx
je 0x140026917
mov rcx, r12
call qword [sym.imp.USER32.dll_GetDC]
lea r8, [rbp - 0x19]
mov rdx, rsi
mov rcx, rax
mov rdi, rax
call fcn.1400257ec
mov rdx, rdi
mov rcx, r12
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rdi, [rsi + 0xea]
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [rax + 0x44]
mov dword [rsi + 0x32], ecx
mov eax, dword [rax + 0x48]
mov dword [rsi + 0x36], eax
cmp r14d, 0x45a
je 0x14002694d
cmp byte [rbp - 0x31], bl
jne 0x14002694d
mov rcx, qword [rsi + 0x1fa]
call fcn.140034750
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
test r14d, r14d
je 0x1400269a4
sub r14d, 0x457
je 0x14002698a
cmp r14d, 2
je 0x14002698a
cmp dword [rbp - 0x45], ebx
jne 0x140026977
mov r9d, ebx
cmp dword [rbp + 0x6f], ebx
je 0x14002697d
mov r9d, 1
mov edx, dword [rbp - 0x49]
mov rcx, r12
call fcn.140025444
jmp 0x1400269a4
mov eax, dword [rbp + 0x6f]
mov rdx, rsi
mov r9d, dword [rbp - 0x49]
mov rcx, r12
mov r8d, dword [rbp + 0x67]
mov dword [rsp + 0x20], eax
call fcn.140024ef0
cmp dword [rbp - 0x41], ebx
je 0x1400269cd
mov r9d, dword [rbp - 0x3d]
mov rdx, rsi
mov r8d, dword [rbp - 0x39]
mov rcx, r12
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
call fcn.1400255fc
cmp qword [rsi + 0xfe], rbx
jne 0x1400269e1
cmp dword [rsi + 0x32], ebx
jne 0x1400269e1
mov dword [rsi + 0x10a], ebx
cmp dword [rsi + 0x36], ebx
jne 0x1400269e9
mov dword [r15], ebx
mov rcx, qword [rbp - 0x21]
mov qword [0x140096e08], rbx
mov qword [0x140096e00], rbx
mov qword [0x140096df8], rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, qword [0x1400b8a20]
call qword [sym.imp.USER32.dll_SetCursor]
mov dword [0x140096f20], ebx
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14008a940
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret