Function at 0x1400b0680
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14036e3c8]
xor rax, rsp
mov qword [rsp + 0x70], rax
xor ebp, ebp
mov r14, r9
mov rbx, r8
mov esi, edx
mov rdi, rcx
cmp edx, 1
jne 0x1400b0719
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov r8, qword [rdi + 8]
mov rcx, rax
mov rdx, qword [rdi + 0x28]
call fcn.14006f330
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, rax
call fcn.140070de0
test al, al
je 0x1400b06fe
call qword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov rcx, qword [rdi + 8]
lea edx, [rsi + 0x13]
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.USER32.dll_SetTimer]
mov r9, r14
mov r8, rbx
mov edx, esi
mov rcx, rdi
call fcn.140077660
mov rbp, rax
mov rax, rbp
jmp 0x1400b0bdb
cmp esi, 8
jne 0x1400b07c3
mov rcx, qword [rcx + 8]
mov edx, esi
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rdi + 0x28]
mov rsi, rax
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, rax
call fcn.140070870
cmp rbx, rax
je 0x1400b0774
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, rax
call fcn.140070870
mov rcx, rax
mov r9, r14
mov r8, rbx
mov edx, 8
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
xor r8d, r8d
mov rcx, rdi
lea edx, [r9 + 0x10]
call fcn.140077700
mov rcx, qword [rdi + 0x28]
test rcx, rcx
je 0x1400b07b8
call fcn.14007ef30
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rdx, qword [rdi + 8]
mov rcx, rax
call fcn.140074e90
mov rax, qword [rdi + 0x28]
mov qword [rax + 0xd70], rbp
mov rbp, rsi
mov rax, rsi
jmp 0x1400b0bdb
cmp esi, 0x2111
jne 0x1400b082f
mov rax, rbx
mov ecx, 0x300
shr rax, 0x10
cmp ax, cx
jne 0x1400b07f8
lea rax, [rsp + 0x40]
mov edx, esi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400b0f80
mov rbp, rax
jmp 0x1400b0bdb
mov ecx, 0x400
cmp ax, cx
jne 0x1400b0711
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x60]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rax, rbp
jmp 0x1400b0bdb
cmp esi, 0x100
jne 0x1400b0946
cmp bx, 0xd
jne 0x1400b087b
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rdx, qword [rdi + 0x28]
lea r8, str.return
mov byte [rsp + 0x30], 1
mov rcx, rax
mov byte [rsp + 0x28], bpl
xor r9d, r9d
mov qword [rsp + 0x20], rbp
call fcn.1400754f0
mov rax, rbp
jmp 0x1400b0bdb
cmp bx, 9
jne 0x1400b0905
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
call fcn.140070d10
mov rcx, qword [rdi + 0x28]
mov rdx, qword [rcx]
test al, al
jne 0x1400b08d5
call qword [rdx + 0x110]
mov rdx, qword [rdi + 0x28]
lea r8, [0x14029d3c0]
mov byte [rsp + 0x30], 1
mov rcx, rax
mov byte [rsp + 0x28], bpl
xor r9d, r9d
mov qword [rsp + 0x20], rbp
call fcn.1400754f0
mov rax, rbp
jmp 0x1400b0bdb
call qword [rdx + 0x110]
mov ecx, reloc.WS2_32.dll_recv
mov rbx, rax
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, rbx
setns dl
xor r9d, r9d
xor r8d, r8d
call fcn.140075cd0
mov rax, rbp
jmp 0x1400b0bdb
cmp bx, 0x14
jne 0x1400b06fe
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rdx, qword [rdi + 0x28]
lea r8, str.capital
mov byte [rsp + 0x30], 1
mov rcx, rax
mov byte [rsp + 0x28], bpl
xor r9d, r9d
mov qword [rsp + 0x20], rbp
call fcn.1400754f0
jmp 0x1400b06fe
cmp esi, 0x2133
je 0x1400b0a87
cmp esi, 0x2138
je 0x1400b0a87
cmp esi, 0xf
jne 0x1400b09a2
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, rax
call fcn.140070de0
test al, al
je 0x1400b06fe
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov r8, qword [rdi + 8]
mov rcx, rax
mov rdx, qword [rdi + 0x28]
call fcn.14006f330
jmp 0x1400b06fe
cmp esi, 0x317
jne 0x1400b0a57
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, rax
call fcn.140070de0
test al, al
je 0x1400b06fe
mov r9, r14
mov r8, rbx
mov edx, esi
mov rcx, rdi
call fcn.140077660
mov rcx, qword [rdi + 0x28]
mov rsi, rax
mov rdx, qword [rcx]
call qword [rdx + 0x2b8]
test al, al
je 0x1400b0a4f
cmp byte [rdi + 0x39], bpl
je 0x1400b0a4f
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCaretPos]
mov rax, qword [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov ecx, dword [rsp + 0x44]
mov r9d, 0xff000000
mov dword [rsp + 0x50], eax
mov r8d, 1
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x6c]
sub eax, dword [rsp + 0x64]
add eax, ecx
mov dword [rsp + 0x54], ecx
mov rcx, rbx
mov dword [rsp + 0x5c], eax
mov dword [rsp + 0x20], ebp
call fcn.14008a080
mov rax, rsi
jmp 0x1400b0bdb
cmp esi, 0x113
jne 0x1400b06fe
cmp rbx, 0x14
jne 0x1400b06fe
cmp byte [rcx + 0x39], bpl
sete al
mov byte [rcx + 0x39], al
mov rcx, qword [rcx + 0x28]
call fcn.14007ef30
xor eax, eax
jmp 0x1400b0bdb
mov rcx, qword [rcx + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, rax
call fcn.140070de0
test al, al
je 0x1400b0ad6
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov rcx, rax
call fcn.140070e00
test al, al
jne 0x1400b0ad6
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov r8, qword [rdi + 8]
mov rcx, rax
mov rdx, qword [rdi + 0x28]
call fcn.14006f330
mov rax, qword [rdi + 0x28]
mov esi, dword [rax + 0xe10]
cmp esi, 0xffffffff
je 0x1400b0a80
mov edx, 1
mov rcx, rbx
call qword [sym.imp.GDI32.dll_SetBkMode]
mov rcx, qword [rdi + 0x28]
call fcn.14007b790
mov ecx, eax
movzx edx, ax
shr ecx, 0x10
and edx, 0xffffff00
movzx r8d, cl
mov rcx, rbx
movzx eax, al
or edx, r8d
shl eax, 0x10
or edx, eax
call qword [sym.imp.GDI32.dll_SetTextColor]
mov rax, qword [rdi + 0x30]
cmp esi, 0xff000000
jae 0x1400b0bac
test rax, rax
je 0x1400b0b3c
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x110]
mov r8, qword [rdi + 8]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.1400707e0
mov rbx, qword [rdi + 0x28]
movups xmm0, xmmword [rsp + 0x60]
mov rcx, rbx
mov rax, qword [rbx]
movups xmmword [rsp + 0x50], xmm0
call qword [rax + 0x110]
movups xmm0, xmmword [rsp + 0x50]
mov r9d, esi
lea rdx, [rsp + 0x50]
mov r8, rbx
mov rcx, rax
movaps xmmword [rsp + 0x50], xmm0
call fcn.14008ad30
mov rcx, rax
mov rbx, rax
call qword [sym.imp.GDI32.dll_CreatePatternBrush]
mov rcx, rbx
mov qword [rdi + 0x30], rax
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x1400b0bd7
test rax, rax
jne 0x1400b0bd7
mov eax, esi
movzx ecx, si
shr eax, 0x10
and ecx, 0xffffff00
movzx edx, al
movzx eax, sil
or ecx, edx
shl eax, 0x10
or ecx, eax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [rdi + 0x30], rax
mov rax, qword [rdi + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1402435c0
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret