Function at 0x1400514f0
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, 0x1f
je 0x14005171e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rdi, rcx
mov rcx, qword [rcx + 0x68]
mov ebx, edx
test rcx, rcx
je 0x140051682
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x140051682
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r12d, ebx
mov r15d, 0xc0000001
and r12d, 1
mov r14d, 0x101
je 0x14005157c
test bl, 8
jne 0x14005157c
bt ebx, 0xb
jb 0x14005157c
movzx eax, byte [rdi + 0x71]
lea edx, [r14 + 4]
shl eax, 0x10
movsxd r9, eax
mov eax, 0xe0000001
or r9, rax
jmp 0x140051591
test r12d, r12d
je 0x1400515a1
movzx eax, byte [rdi + 0x71]
mov edx, r14d
shl eax, 0x10
movsxd r9, eax
or r9, r15
mov rcx, qword [rdi + 0x68]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
mov r13d, ebx
and r13d, 8
je 0x1400515ca
movzx eax, byte [rdi + 0x70]
mov rcx, qword [rdi + 0x68]
mov r8d, reloc.WSOCK32.dll_recvfrom
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ebp, ebx
and ebp, 2
je 0x1400515ef
movzx eax, byte [rdi + 0x73]
mov r8d, dword [rdi + 0x78]
mov rcx, qword [rdi + 0x68]
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov esi, ebx
and esi, 4
je 0x140051616
movzx eax, byte [rdi + 0x74]
mov rcx, qword [rdi + 0x68]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
and ebx, 0x10
je 0x14005163b
movzx eax, byte [rdi + 0x75]
mov rcx, qword [rdi + 0x68]
mov r8d, 0x5b
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov cl, 0x80
test ebx, ebx
je 0x140051645
xor byte [rsp + 0x7b], cl
test ebp, ebp
je 0x140051654
mov eax, dword [rdi + 0x78]
xor byte [rsp + 0x30], cl
xor byte [rsp + rax + 0x20], cl
test esi, esi
je 0x140051663
xor byte [rsp + 0x30], cl
xor byte [rsp + 0xc1], cl
test r13d, r13d
je 0x14005166c
xor byte [rsp + 0x31], cl
test r12d, r12d
je 0x140051675
xor byte [rsp + 0x32], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x1400516f6
mov esi, 2
test bl, 1
je 0x14005169d
mov dl, byte [rdi + 0x71]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 8
je 0x1400516b3
mov dl, byte [rdi + 0x70]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_keybd_event]
test sil, bl
je 0x1400516ca
mov dl, byte [rdi + 0x73]
mov cl, byte [rdi + 0x78]
xor r9d, r9d
mov r8d, esi
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 4
je 0x1400516e0
mov dl, byte [rdi + 0x74]
xor r9d, r9d
mov r8d, esi
mov cl, RegisterTypeLib
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 0x10
je 0x1400516f6
mov dl, byte [rdi + 0x75]
xor r9d, r9d
mov r8d, esi
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
call fcn.140043890
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret