Function at 0x140121b4c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov eax, 0x104
mov edx, dword [rdx + 8]
mov r12d, 1
mov dword [rsp + 0x58], r12d
mov rdi, rcx
cmp edx, eax
ja 0x140121d8a
je 0x140121ca2
mov eax, edx
sub eax, 0x7b
je 0x140121cc6
sub eax, 0x26
je 0x140121c79
sub eax, r12d
je 0x140121c79
sub eax, 2
je 0x140121c79
sub eax, r12d
je 0x140121c79
sub eax, 2
je 0x140121c79
sub eax, r12d
je 0x140121c79
cmp eax, 0x58
jne 0x140121e49
mov rcx, rbx
call fcn.14011d394
test eax, eax
jne 0x140121bfb
mov edx, dword [rbx + 0x10]
lea rcx, [rdi + 0x1f0]
lea r8, [rsp + 0x58]
call fcn.14011ee1c
test eax, eax
jne 0x140121d6b
cmp qword [rbx + 0x10], 0x1b
jne 0x140121c67
cmp dword [rdi + 0x338], 0
je 0x140121c1a
lea rcx, [rdi + 0x318]
mov rdx, rdi
call fcn.1401c2fe8
mov rcx, qword [rdi + 0x688]
test rcx, rcx
je 0x140121c37
cmp dword [rcx + 0xc], 0
je 0x140121c37
cmp dword [rcx + 8], 0
je 0x140121c37
call fcn.14019e2d4
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, rax
call fcn.14009f2a4
mov rdx, rax
lea rcx, str.06__
call fcn.1400acae4
test rax, rax
je 0x140121c67
mov rcx, qword [rax + 0x40]
mov edx, 0x1f
jmp 0x140121d5f
cmp dword [rsp + 0x58], 0
jne 0x140121e49
xor eax, eax
jmp 0x140121e54
movsx eax, word [rbx + 0x18]
add rcx, 0x1f0
mov r9, qword [rbx]
mov dword [rsp + 0x60], eax
movsx eax, word [rbx + 0x1a]
mov dword [rsp + 0x64], eax
mov r8, qword [rsp + 0x60]
call fcn.14011f12c
jmp 0x140121ea8
mov rcx, qword [rcx + 0x370]
test rcx, rcx
je 0x140121cc6
mov r9, qword [rbx + 0x18]
mov rdx, rdi
mov r8, qword [rbx + 0x10]
call fcn.1401ac3e0
test eax, eax
jne 0x140121d6b
mov eax, dword [0x140326ca0]
lea rsi, [0x140326ca0]
test eax, eax
jne 0x140121ce8
mov rcx, rsi
call fcn.1400c2754
mov eax, r12d
mov dword [0x140326ca0], eax
cmp dword [0x140326f20], 0
jne 0x140121d2e
test eax, eax
jne 0x140121d06
mov rcx, rsi
call fcn.1400c2754
mov eax, r12d
mov dword [0x140326ca0], eax
cmp dword [0x140326f1c], 0
jne 0x140121d2e
test eax, eax
jne 0x140121d22
mov rcx, rsi
call fcn.1400c2754
mov dword [0x140326ca0], r12d
mov dword [0x140326f1c], r12d
call fcn.1400d67cc
mov rcx, qword [0x140328ef0]
test rcx, rcx
je 0x140121d73
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140121d73
cmp qword [rbx + 0x10], 0x12
jne 0x140121d73
mov rcx, qword [0x140328ef0]
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, r12d
jmp 0x140121e54
mov edx, dword [rbx + 0x10]
lea rcx, [rdi + 0x1f0]
xor r8d, r8d
call fcn.14011ee1c
jmp 0x140121ea8
sub edx, 0x105
je 0x140121eb2
sub edx, 0xfb
je 0x140121e6b
sub edx, r12d
je 0x140121ddd
sub edx, 3
je 0x140121ddd
sub edx, r12d
je 0x140121ddd
sub edx, 2
je 0x140121ddd
sub edx, r12d
je 0x140121ddd
cmp edx, 2
jne 0x140121e49
mov r8, qword [rbx + 0x18]
add rcx, 0x1f0
mov rdx, qword [rbx + 0x10]
call fcn.14011f8ec
jmp 0x140121ea8
movsx eax, word [rbx + 0x18]
mov rcx, qword [rbx]
mov dword [rsp + 0x60], eax
movsx eax, word [rbx + 0x1a]
mov dword [rsp + 0x64], eax
call fcn.14009f2a4
mov rsi, rax
test rax, rax
je 0x140121e19
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140121e19
mov rcx, qword [rsi + 0x40]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov r9, qword [rbx]
lea rcx, [rdi + 0x1f0]
mov r8, qword [rsp + 0x60]
mov edx, dword [rbx + 8]
call fcn.14011f12c
test eax, eax
jne 0x140121d6b
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140121d6b
mov rdx, rbx
mov rcx, rdi
call fcn.1401931c4
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movsx eax, word [rbx + 0x18]
mov rcx, qword [rbx]
mov dword [rsp + 0x60], eax
movsx eax, word [rbx + 0x1a]
mov dword [rsp + 0x64], eax
call fcn.14009f2a4
test rax, rax
je 0x140121e97
mov rcx, qword [rax + 0x40]
lea rdx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rdx, qword [rsp + 0x60]
lea rcx, [rdi + 0x1f0]
call fcn.14011f7f0
test eax, eax
jne 0x140121d6b
jmp 0x140121e49
mov rcx, qword [rcx + 0x370]
test rcx, rcx
je 0x140121ed6
mov r9, qword [rbx + 0x18]
mov rdx, rdi
mov r8, qword [rbx + 0x10]
call fcn.1401ac564
test eax, eax
jne 0x140121d6b
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
movsx r14d, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rdi + 0x40]
movsx r15d, ax
call sub.IMM32.dll_ImmGetContext
mov rsi, rax
test rax, rax
je 0x140121f16
mov rcx, rax
call sub.IMM32.dll_ImmGetOpenStatus
test eax, eax
je 0x140121f16
mov ebp, r12d
jmp 0x140121f1d
xor ebp, ebp
test rsi, rsi
je 0x140121f29
mov rcx, qword [rdi + 0x40]
mov rdx, rsi
call sub.IMM32.dll_ImmReleaseContext
cmp qword [rdi + 0x300], 0
je 0x140121f91
cmp qword [rbx + 0x10], 0x12
je 0x140121f53
cmp qword [rbx + 0x10], 0x79
jne 0x140121f91
bt r14d, 0xf
jb 0x140121f91
bt r15d, 0xf
jb 0x140121f91
test ebp, ebp
jne 0x140121f91
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.14009f2a4
mov rcx, qword [rdi + 0x300]
cmp rcx, rax
jne 0x140121f72
mov rcx, rdi
jmp 0x140121f87
cmp qword [rbx + 0x10], 0x12
je 0x140121f87
mov eax, dword [rbx + 0x18]
bt rax, 0x1d
jb 0x140121d6b
call fcn.1400a6184
jmp 0x140121d6b
mov rcx, qword [0x140328ef0]
test rcx, rcx
je 0x140121e49
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
jmp 0x140121ea8