Function at 0x140049ae0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r15, rdx
mov r13, rcx
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r12d, ax
shr r12d, 0xf
and r12b, 1
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140049b3a
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jb 0x140049b3a
xor sil, sil
jmp 0x140049b3d
mov sil, 1
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx r14d, ax
shr r14d, 0xf
and r14b, 1
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movzx edi, ax
shr edi, 0xf
and dil, 1
test sil, sil
je 0x140049ced
test r12b, r12b
jne 0x140049b7c
test dil, dil
je 0x140049b8e
test dil, dil
je 0x140049ced
test r14b, r14b
je 0x140049ced
mov ebp, dword [r15]
lea eax, [rbp - 0x25]
cmp eax, 3
ja 0x140049ced
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbx, rax
mov rcx, rax
call fcn.140062640
test al, al
je 0x140049cba
call fcn.14005e8a0
cmp byte [rax + 6], 0
je 0x140049cba
call fcn.14005e8a0
cmp byte [rax + 0x10], 0
je 0x140049bd4
xor eax, eax
jmp 0x140049be0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.USER32.dll_MonitorFromWindow]
nop
mov qword [rsp + 0xb0], rax
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xb8]
lea rcx, [r13 + 0xa0]
call fcn.140073f10
mov rax, qword [rsp + 0xb8]
cmp rax, qword [r13 + 0xa8]
je 0x140049c82
mov rax, qword [rax + 0x18]
test rax, rax
je 0x140049c82
mov rax, qword [rax + 0x98]
test rax, rax
jne 0x140049c62
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140119a58]
call fcn.140050ad0
jmp 0x140049cba
cmp qword [rax + 0x30], 0
jbe 0x140049cba
lea eax, [rbp - 0x26]
test eax, 0xfffffffd
je 0x140049c77
mov al, 1
jmp 0x140049cbc
call fcn.14005e8a0
movzx eax, byte [rax + 8]
jmp 0x140049cbc
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], rax
movups xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rsp + 0x50], xmm1
lea rdx, [rsp + 0x40]
mov rcx, qword [0x140119a58]
call fcn.140050880
xor al, al
test al, al
je 0x140049ced
movzx r8d, dil
movzx edx, sil
mov ecx, dword [r15]
call fcn.140051380
mov r9d, dword [r15]
xor r8d, r8d
mov edx, dword [0x140119484]
mov rcx, qword [r13 + 0x68]
call qword [sym.imp.USER32.dll_PostMessageW]
mov al, 1
jmp 0x140049dc5
call fcn.14005e8a0
cmp byte [rax + 0xc], 0
je 0x140049db1
mov ebx, 0xffffffff
mov ecx, dword [r15]
lea eax, [rcx - 0x30]
cmp eax, 9
ja 0x140049d11
lea ebx, [rcx - 0x30]
jmp 0x140049d1c
lea eax, [rcx - 0x60]
cmp eax, 9
ja 0x140049d1c
lea ebx, [rcx - 0x60]
movzx eax, byte [r13 + 0x200]
test al, al
jne 0x140049d46
test r12b, r12b
jne 0x140049d46
test sil, sil
je 0x140049d46
test dil, dil
je 0x140049d46
test r14b, r14b
je 0x140049d46
cmp ebx, 0xffffffff
je 0x140049d46
mov dil, 1
jmp 0x140049d52
xor dil, dil
test al, al
je 0x140049db1
cmp ebx, 0xffffffff
je 0x140049db1
call fcn.140085430
mov rdx, qword [rax]
mov rax, qword [rdx + 8]
mov rcx, rdx
cmp byte [rax + 0x19], 0
jne 0x140049d7e
cmp dword [rax + 0x1c], ebx
jge 0x140049d72
mov rax, qword [rax + 0x10]
jmp 0x140049d78
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140049d67
cmp byte [rcx + 0x19], 0
jne 0x140049db1
cmp ebx, dword [rcx + 0x1c]
jl 0x140049db1
cmp rcx, rdx
je 0x140049db1
movsxd r9, ebx
xor r8d, r8d
mov edx, dword [0x14011946c]
mov rcx, qword [r13 + 0x68]
call qword [sym.imp.USER32.dll_PostMessageW]
movzx ecx, dil
call fcn.1400517e0
mov al, 1
jmp 0x140049dc5
cmp byte [r13 + 0x200], 0
je 0x140049dc3
test r12b, r12b
setne al
jmp 0x140049dc5
xor al, al
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret