Function at 0x6d0baec0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rbp, qword [rsp + 0x1d0]
mov r12, rdx
lea r14, [rsp + 0x4c]
mov r15, r9
mov edi, r8d
mov qword [rsp + 0x4c], 0
mov rbx, rcx
mov rcx, r14
mov r13d, r15d
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdx, qword [r12 + 0x10]
mov eax, dword [rsp + 0x50]
mov esi, dword [rsp + 0x4c]
mov rcx, qword [rdx + 0x30]
mov dword [rsp + 0x38], eax
mov rdx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, rbp
mov r14, qword [sym.imp.USER32.dll_MapVirtualKeyA]
sar rcx, 0x10
movzx r12d, cl
cmp r15, 0x10
je 0x6d0bb0c0
xor edx, edx
mov ecx, r13d
and ebp, 0x1000000
call r14
mov edx, 2
mov ecx, r13d
mov dword [rsp + 0x3c], eax
call r14
xor r8d, r8d
test dil, dil
sete r8b
mov r14d, eax
add r8d, 9
mov dword [rbx], r8d
call qword [sym.imp.USER32.dll_GetMessageTime]
pxor xmm0, xmm0
mov ecx, 0x10
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x6d447e30]
movsd qword [rbx + 8], xmm0
call rdi
mov ecx, 0x11
movsx r15d, ax
call rdi
shr r15d, 0x1f
mov ecx, 0x12
mov r9d, r15d
or r9d, 2
test ax, ax
cmovs r15d, r9d
call rdi
mov ecx, 0x5b
mov r10d, r15d
or r10d, 4
test ax, ax
cmovs r15d, r10d
call rdi
mov ecx, 0x5c
mov r11d, r15d
or r11d, 8
test ax, ax
cmovs r15d, r11d
call rdi
pxor xmm2, xmm2
pxor xmm1, xmm1
mov dword [rbx + 0x34], r12d
pxor xmm3, xmm3
cvtsi2sd xmm2, dword [rsp + 0x4c]
pxor xmm4, xmm4
mov edx, eax
cvtsi2sd xmm3, esi
mov eax, r15d
lea esi, [r13 - 0x70]
mov dword [rbx + 0x38], 0
cvtsi2sd xmm1, dword [rsp + 0x50]
or eax, 8
test dx, dx
cvtsi2sd xmm4, dword [rsp + 0x38]
cmovs r15d, eax
mov dword [rbx + 0x30], r15d
unpcklpd xmm2, xmm1
unpcklpd xmm3, xmm4
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm3
cmp esi, 0xb
ja 0x6d0bb060
add r13d, 0xdf90
mov dword [rbx + 0x38], r13d
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp rbp, 1
lea r12d, [r13 - 0x21]
sbb ecx, ecx
and ecx, 0x40
add ecx, 0xe031
cmp r12d, 7
jbe 0x6d0bb090
lea r8d, [r13 - 0x60]
cmp r8d, 9
ja 0x6d0bb0a0
add r13d, 0xe000
jmp case.0x6d0bb114.8
lea r13d, [rcx + r12]
jmp case.0x6d0bb114.8
lea edi, [r13 - 0x6a]
cmp edi, 5
jbe 0x6d0bb0d8
lea r9d, [r13 - 0xa0]
cmp r9d, 5
ja 0x6d0bb0e8
add r13d, 0xdfb1
jmp case.0x6d0bb114.8
mov edx, 3
mov ecx, r12d
call r14
mov r13d, eax
jmp 0x6d0baf3b
add r13d, 0xe040
jmp case.0x6d0bb114.8
cmp r13d, 0x2c
ja 0x6d0bb128
cmp r13d, 7
jbe case.0x6d0bb114.9
lea r11d, [r13 - 8]
cmp r11d, 0x24
ja case.0x6d0bb114.9
lea rdx, [0x6d44782c]
movsxd rax, dword [rdx + r11*4]
add rax, rdx
jmp rax
mov r13d, 0xe09d
jmp case.0x6d0bb114.8
cmp r13d, 0x90
je 0x6d0bb3a8
jbe 0x6d0bb150
cmp r13d, 0x91
jne 0x6d0bb3b8
mov r13d, 0xe046
jmp case.0x6d0bb114.8
cmp r13d, 0x5b
je 0x6d0bb398
cmp r13d, 0x5c
jne case.0x6d0bb114.9
mov r13d, 0xe058
jmp case.0x6d0bb114.8
mov r13d, 0xe041
jmp case.0x6d0bb114.8
mov r13d, 0xe047
jmp case.0x6d0bb114.8
mov r13d, 0xe043
jmp case.0x6d0bb114.8
mov r10d, r13d
test rbp, rbp
je 0x6d0bb3c4
sub r10, 0xd
cmp r10, 0x21
ja 0x6d0bb1b7
lea rsi, [0x6d458a40]
movzx r15d, word [rsi + r10*2]
test r15d, r15d
jne 0x6d0bb3e3
test r14d, r14d
js 0x6d0bb04b
xor r14d, r14d
lea r8, [rsp + 0x60]
lea r9, [rsp + 0x56]
mov ecx, r13d
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x56], 0
mov edx, dword [rsp + 0x3c]
mov word [rsp + 0x5e], r14w
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_ToUnicode]
movzx ecx, word [rsp + 0x56]
mov r8d, 0xfffd
lea r12d, [rcx - 0xd800]
cmp r12d, 0x3ff
cmovbe ecx, r8d
mov dword [rbx + 0x38], ecx
jmp 0x6d0bb04b
mov r13d, 0xe057
jmp case.0x6d0bb114.8
mov r13d, 0xe045
jmp case.0x6d0bb114.8
mov r10d, r13d
test rbp, rbp
jne 0x6d0bb1b7
sub r10, 0x10
cmp r10, 0x1e
ja 0x6d0bb1b7
lea rbp, [0x6d458aa0]
mov r15d, dword [rbp + r10*4]
jmp 0x6d0bb1ae
mov r13d, r15d
jmp case.0x6d0bb114.8