Function at 0x7ff6c5d03c20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, r9
mov rbx, r8
mov ebp, edx
mov r15, rcx
call fcn.7ff6c5ce2ce0
test rax, rax
je case.0x7ff6c5d03e96.527
call fcn.7ff6c5ce2ef0
mov rsi, rax
call fcn.7ff6c5ce2ce0
test rax, rax
je 0x7ff6c5d03c71
call fcn.7ff6c5ce2ef0
mov r14, qword [rax + 0xe0]
jmp 0x7ff6c5d03c74
xor r14d, r14d
cmp ebp, 0x200
ja 0x7ff6c5d03e6c
je 0x7ff6c5d03e2a
lea eax, [rbp - 7]
cmp eax, 0xfe
ja case.0x7ff6c5d03e96.527
lea rdx, [0x7ff6c5cd0000]
movzx eax, byte [rdx + rax + 0x3400c]
mov ecx, dword [rdx + rax*4 + 0x33ff8]
add rcx, rdx
jmp rcx
lea eax, [rbp - 0x100]
test eax, 0xfffffffb
sete al
cmp rbx, 0x100
jae 0x7ff6c5d03ccd
mov byte [rsi + rbx + 0x13c], al
cmp rbx, 0x11
jne 0x7ff6c5d03d24
mov ecx, 0xa2
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0xa3
and al, 1
mov byte [rsi + 0x1de], al
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rsi + 0x1de], 0
mov byte [rsi + 0x1df], al
jne 0x7ff6c5d03d17
test al, al
jne 0x7ff6c5d03d17
mov byte [rsi + 0x138], al
jmp case.0x7ff6c5d03e96.527
mov al, 1
mov byte [rsi + 0x138], al
jmp case.0x7ff6c5d03e96.527
cmp rbx, 0x10
jne 0x7ff6c5d03d7b
mov ecx, 0xa0
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0xa1
and al, 1
mov byte [rsi + 0x1dc], al
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rsi + 0x1dc], 0
mov byte [rsi + 0x1dd], al
jne 0x7ff6c5d03d6e
test al, al
jne 0x7ff6c5d03d6e
mov byte [rsi + 0x139], al
jmp case.0x7ff6c5d03e96.527
mov al, 1
mov byte [rsi + 0x139], al
jmp case.0x7ff6c5d03e96.527
cmp rbx, 0x12
jne case.0x7ff6c5d03e96.527
mov ecx, 0xa4
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0xa5
and al, 1
mov byte [rsi + 0x1e0], al
call qword [sym.imp.user32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rsi + 0x1e0], 0
mov byte [rsi + 0x1e1], al
jne 0x7ff6c5d03dc9
test al, al
jne 0x7ff6c5d03dc9
mov byte [rsi + 0x13a], al
jmp case.0x7ff6c5d03e96.527
mov al, 1
mov byte [rsi + 0x13a], al
jmp case.0x7ff6c5d03e96.527
cmp ebp, 7
mov rcx, rsi
sete dl
call fcn.7ff6c5cdc680
jmp case.0x7ff6c5d03e96.527
lea rax, [rbx - 1]
cmp rax, 0xfffe
ja case.0x7ff6c5d03e96.527
movzx edx, bx
mov rcx, rsi
call fcn.7ff6c5cdc690
jmp case.0x7ff6c5d03e96.527
cmp di, 1
jne case.0x7ff6c5d03e96.527
call fcn.7ff6c5d03aa0
test al, al
je case.0x7ff6c5d03e96.527
mov eax, 1
jmp 0x7ff6c5d03fdd
cmp byte [r14 + 0x10], 0
mov qword [r14 + 8], r15
jne case.0x7ff6c5d03e96.527
mov edi, 2
mov dword [rsp + 0x20], 0x18
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], edi
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 0
call qword [sym.imp.user32.dll_TrackMouseEvent]
mov byte [r14 + 0x10], 1
jmp case.0x7ff6c5d03e96.527
lea eax, [rbp - 0x201]
cmp eax, 0xa2
ja case.0x7ff6c5d03e96.527
lea rdx, [0x7ff6c5cd0000]
movzx eax, byte [rdx + rax + 0x34128]
mov ecx, dword [rdx + rax*4 + 0x3410c]
add rcx, rdx
jmp rcx
cmp qword [r14 + 8], r15
jne 0x7ff6c5d03ea6
mov qword [r14 + 8], 0
mov byte [r14 + 0x10], 0
jmp case.0x7ff6c5d03e96.527
cmp ebp, 0x204
je 0x7ff6c5d03ec2
xor edi, edi
cmp ebp, 0x206
jne 0x7ff6c5d03ec7
mov edi, 1
cmp ebp, 0x207
je 0x7ff6c5d03ed7
cmp ebp, 0x209
jne 0x7ff6c5d03edc
mov edi, 2
cmp ebp, 0x20b
je 0x7ff6c5d03eec
cmp ebp, 0x20d
jne 0x7ff6c5d03efe
xor edi, edi
shr rbx, 0x10
cmp bx, 1
setne dil
add rdi, 3
call fcn.7ff6c5ce46a0
test al, al
jne 0x7ff6c5d03f1b
call qword [sym.imp.user32.dll_GetCapture]
test rax, rax
jne 0x7ff6c5d03f1b
mov rcx, r15
call qword [sym.imp.user32.dll_SetCapture]
mov byte [rdi + rsi + 0x128], 1
jmp case.0x7ff6c5d03e96.527
xor edi, edi
cmp ebp, 0x205
sete dil
cmp ebp, 0x208
jne 0x7ff6c5d03f43
mov edi, 2
jmp 0x7ff6c5d03f5d
cmp ebp, 0x20c
jne 0x7ff6c5d03f5d
xor edi, edi
shr rbx, 0x10
cmp bx, 1
setne dil
add rdi, 3
mov byte [rdi + rsi + 0x128], 0
call fcn.7ff6c5ce46a0
test al, al
jne case.0x7ff6c5d03e96.527
call qword [sym.imp.user32.dll_GetCapture]
cmp rax, r15
jne case.0x7ff6c5d03e96.527
call qword [sym.imp.user32.dll_ReleaseCapture]
jmp case.0x7ff6c5d03e96.527
shr rbx, 0x10
movsx eax, bx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x7ff6c5da2f4c]
addss xmm0, dword [rsi + 0x130]
movss dword [rsi + 0x130], xmm0
jmp case.0x7ff6c5d03e96.527
shr rbx, 0x10
movsx eax, bx
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x7ff6c5da2f4c]
addss xmm0, dword [rsi + 0x134]
movss dword [rsi + 0x134], xmm0
jmp case.0x7ff6c5d03e96.527
cmp ebx, 7
jne case.0x7ff6c5d03e96.527
mov byte [r14 + 0x2d], 1
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret