Function at 0x140145d40
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14020a008]
xor rax, rsp
mov qword [rbp - 8], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0x27
ja 0x140145d75
movabs rcx, 0xa100000000
bt rcx, rdi
jb 0x140145d8f
cmp edi, 0x6b
je 0x140145d8f
nop word [rax + rax]
cmp edi, 0xbb
je 0x140145d8f
xor al, al
jmp 0x1401465c9
cmp qword [rbx + 0xa0], 0
je 0x1401465c7
mov qword [rsp + 0x78], rsi
mov ecx, 0x11
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r15
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, 0x10
sets sil
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, edi
sets cl
sub eax, 0x20
je 0x1401462f5
sub eax, 5
je 0x14014606b
sub eax, 2
je 0x140145e9e
nop dword [rax + rax]
sub eax, 0x44
je 0x140145e0e
cmp eax, 0x50
jne 0x1401465b2
cmp edi, 0x6b
jne 0x140145e18
test sil, sil
jmp 0x140145e37
nop dword [rax + rax]
cmp edi, 0xbb
jne 0x1401465b2
test sil, sil
je 0x1401465b2
test cl, cl
je 0x1401465b2
test byte [rbx + 0x40], 0x10
je 0x140145e59
mov r8, qword [rbx + 0x100]
xor r9d, r9d
mov rdx, qword [rbx + 0x10]
mov rcx, rbx
call fcn.140143d30
xor r14d, r14d
cmp dword [rbx + 0xf4], r14d
jbe 0x1401465b2
nop dword [rax]
mov r8, qword [rbx + 0xe8]
xor r9d, r9d
mov rdx, qword [rbx + 0x18]
mov rcx, rbx
mov eax, r14d
mov r8, qword [r8 + rax*8]
call fcn.140143d30
inc r14d
cmp r14d, dword [rbx + 0xf4]
jb 0x140145e70
jmp 0x1401465b2
mov rdx, qword [rbx + 0xa0]
test byte [rdx + 0x34], 1
jne 0x1401465b2
test byte [rdx], 4
jne 0x140145ec5
mov r8b, 1
mov rcx, rbx
call fcn.140144270
nop
jmp 0x1401465b2
mov r8, qword [rbx + 0x130]
mov eax, dword [rdx + 0x2c]
inc eax
cmp eax, dword [r8]
jae 0x1401465b2
mov ecx, eax
mov rax, qword [r8 + 8]
mov rdi, qword [rax + rcx*8]
mov eax, dword [rdx + 0x30]
inc eax
cmp dword [rdi + 0x30], eax
jne 0x1401465b2
mov qword [rbx + 0xa0], rdi
mov rcx, rbx
mov eax, dword [rdi + 0x2c]
mov dword [rbx + 0xac], eax
mov edx, dword [rdi + 0x2c]
inc edx
call fcn.140145240
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call fcn.140144a60
mov rax, qword [rbx + 0xa0]
xor r14d, r14d
mov ecx, dword [rax + 0x2c]
mov rax, qword [rbx + 0x130]
mov r8d, dword [rax]
test r8d, r8d
je 0x140146233
lea r15d, [r8 - 1]
mov r11d, r14d
cmp ecx, r15d
mov eax, r15d
mov edi, r15d
mov esi, r14d
cmovbe eax, ecx
mov edx, r14d
cmp ecx, eax
cmovbe r8d, ecx
cmovbe r11d, eax
test r8d, r8d
je 0x140145fa6
mov r9d, r14d
nop dword [rax + rax]
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r10, qword [r9 + rcx]
mov eax, dword [r10]
test al, 2
je 0x140145f9b
and eax, 0xfffffffd
cmp edi, edx
mov dword [r10], eax
mov eax, edx
cmovbe eax, edi
mov edi, eax
cmp esi, edx
jae 0x140145f9b
mov esi, edx
inc edx
add r9, 8
cmp edx, r8d
jb 0x140145f70
cmp r8d, r11d
ja 0x140145ff5
nop dword [rax + rax]
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x140145fed
test cl, 2
jne 0x140145fed
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp edi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, edi
mov edi, eax
cmp esi, r8d
jae 0x140145fed
mov esi, r8d
inc r8d
cmp r8d, r11d
jbe 0x140145fb0
lea r8d, [r11 + 1]
cmp r8d, r15d
ja 0x140146037
nop
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov eax, dword [r9]
test al, 2
je 0x14014602f
and eax, 0xfffffffd
cmp edi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, edi
mov edi, eax
cmp esi, r8d
jae 0x14014602f
mov esi, r8d
inc r8d
cmp r8d, r15d
jbe 0x140146000
cmp edi, esi
ja 0x140146239
mov rcx, qword ds:[rbx + 0xc8]
xor r9d, r9d
mov rax, qword [rbx + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx]
lea edx, [r9 + 0xb]
call qword [case.0x140101f48.0]
jmp 0x140146239
mov rax, qword [rbx + 0xa0]
test byte [rax + 0x34], 1
jne 0x140146090
test byte [rax], 4
je 0x140146090
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call fcn.140144270
jmp 0x1401465b2
mov ecx, dword [rax + 0x30]
test ecx, ecx
je 0x1401465b2
mov edi, dword [rax + 0x2c]
dec ecx
test edi, edi
je 0x1401465b2
mov rax, qword [rbx + 0x130]
mov rdx, qword [rax + 8]
dec edi
mov rsi, qword [rdx + rdi*8]
cmp dword [rsi + 0x30], ecx
je 0x1401460c9
nop
test edi, edi
jne 0x1401460b3
jmp 0x1401465b2
mov qword ds:[rbx + 0xa0], rsi
mov edx, edi
mov eax, dword [rsi + 0x2c]
mov rcx, rbx
mov dword [rbx + 0xac], eax
call fcn.140145240
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call fcn.140144a60
mov rax, qword [rbx + 0x130]
xor r14d, r14d
mov r8d, dword [rax]
test r8d, r8d
je 0x140146233
lea r15d, [r8 - 1]
mov r11d, r14d
cmp edi, r15d
mov eax, r15d
mov esi, r14d
mov edx, r14d
cmovbe eax, edi
cmp edi, eax
cmovbe r8d, edi
cmovbe r11d, eax
mov edi, r15d
test r8d, r8d
je 0x140146176
mov r9d, r14d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r10, qword [r9 + rcx]
mov eax, dword [r10]
test al, 2
je 0x14014616b
and eax, 0xfffffffd
cmp edi, edx
mov dword [r10], eax
mov eax, edx
cmovbe eax, edi
mov edi, eax
cmp esi, edx
jae 0x14014616b
mov esi, edx
inc edx
add r9, 8
cmp edx, r8d
jb 0x140146140
cmp r8d, r11d
ja 0x1401461c5
nop dword [rax + rax]
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x1401461bd
test cl, 2
jne 0x1401461bd
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp edi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, edi
mov edi, eax
cmp esi, r8d
jae 0x1401461bd
mov esi, r8d
inc r8d
cmp r8d, r11d
jbe 0x140146180
lea r8d, [r11 + 1]
cmp r8d, r15d
ja 0x140146207
nop
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov eax, dword [r9]
test al, 2
je 0x1401461ff
and eax, 0xfffffffd
cmp edi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, edi
mov edi, eax
cmp esi, r8d
jae 0x1401461ff
mov esi, r8d
inc r8d
cmp r8d, r15d
jbe 0x1401461d0
cmp edi, esi
ja 0x140146239
mov rcx, qword [rbx + 0xc8]
xor r9d, r9d
mov rax, qword [rbx + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx]
lea edx, [r9 + 0xb]
call qword [case.0x140101f48.0]
jmp 0x140146239
mov esi, dword [rbp - 0x20]
mov edi, dword [rbp - 0x20]
mov rax, qword [rbx + 0x130]
cmp esi, dword [rax]
jae 0x1401462bd
cmp edi, esi
ja 0x1401462bd
mov eax, dword [rbx + 0x88]
sub esi, eax
mov r9d, dword [rbx + 0x78]
inc esi
imul esi, dword [rbx + 0x7c]
sub edi, eax
imul edi, dword [rbx + 0x7c]
mov edx, dword [rbx + 0xf8]
sub edx, dword [rbx + 0x8c]
add edx, dword [rbx + 0x98]
add esi, r9d
mov dword [rbp - 0x18], r14d
test byte [rbx + 0x40], 4
lea r8d, [rdi + r9]
je 0x14014628a
mov r14d, dword [rbx + 0x80]
mov eax, dword [rbx + 0x70]
mov rcx, qword [rbx]
sub eax, r14d
cmp edx, eax
cmovg edx, eax
cmp r8d, r9d
mov dword [rbp - 0x10], edx
lea rdx, [rbp - 0x18]
cmovl r8d, r9d
cmp esi, dword [rbx + 0x74]
mov dword [rbp - 0x14], r8d
cmovg esi, dword [rbx + 0x74]
xor r8d, r8d
mov dword [rbp - 0xc], esi
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401465b2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41c
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rbx + 0x160], 0xffffffffffffffff
mov dword [rbx + 0x190], 0xffffffff
jmp 0x1401465b2
test sil, sil
je 0x1401463c5
mov rcx, qword ds:[rbx + 0xa0]
xor r14d, r14d
mov eax, dword [rcx + 0x2c]
mov dword [rbx + 0xac], eax
mov rax, qword [rbx + 0x130]
mov edx, dword [rcx + 0x2c]
mov r8d, dword [rax]
test r8d, r8d
je 0x140146528
lea edi, [r8 - 1]
mov r10d, r14d
cmp edx, edi
mov eax, edi
mov esi, r14d
cmovbe eax, edx
cmp edx, eax
cmovbe r10d, eax
cmovbe r8d, edx
cmp r8d, r10d
ja 0x140146390
nop dword [rax]
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x140146388
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp edi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, edi
mov edi, eax
cmp esi, r8d
jae 0x140146388
mov esi, r8d
inc r8d
cmp r8d, r10d
jbe 0x140146350
cmp edi, esi
ja 0x14014652e
mov rcx, qword [rbx + 0xc8]
xor r9d, r9d
mov rax, qword [rbx + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx]
lea edx, [r9 + 0xb]
call qword [case.0x140101f48.0]
nop
jmp 0x14014652e
test cl, cl
je 0x1401465b2
mov edx, dword [rbx + 0xac]
mov rax, qword [rbx + 0xa0]
mov ecx, dword [rax + 0x2c]
cmp ecx, edx
mov rax, qword [rbx + 0x130]
mov r9d, ecx
cmovbe r9d, edx
cmovbe edx, ecx
xor r14d, r14d
mov r8d, dword [rax]
test r8d, r8d
je 0x140146528
lea r15d, [r8 - 1]
mov r11d, r14d
cmp r9d, r15d
mov eax, r15d
mov edi, r15d
mov esi, r14d
cmovbe eax, r9d
cmp edx, eax
cmovbe r8d, edx
cmovbe r11d, eax
mov edx, r14d
test r8d, r8d
je 0x140146466
mov r9d, r14d
nop dword [rax + rax]
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r10, qword [r9 + rcx]
mov eax, dword [r10]
test al, 2
je 0x14014645b
and eax, 0xfffffffd
cmp edi, edx
mov dword [r10], eax
mov eax, edx
cmovbe eax, edi
mov edi, eax
cmp esi, edx
jae 0x14014645b
mov esi, edx
inc edx
add r9, 8
cmp edx, r8d
jb 0x140146430
cmp r8d, r11d
ja 0x1401464b5
nop dword [rax + rax]
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov ecx, dword [r9]
test cl, 0x20
jne 0x1401464ad
test cl, 2
jne 0x1401464ad
mov eax, ecx
not eax
xor eax, ecx
and eax, 2
xor eax, ecx
cmp edi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, edi
mov edi, eax
cmp esi, r8d
jae 0x1401464ad
mov esi, r8d
inc r8d
cmp r8d, r11d
jbe 0x140146470
lea r8d, [r11 + 1]
cmp r8d, r15d
ja 0x1401464f7
nop
mov rax, qword [rbx + 0x130]
mov rcx, qword [rax + 8]
mov r9, qword [rcx + r8*8]
mov eax, dword [r9]
test al, 2
je 0x1401464ef
and eax, 0xfffffffd
cmp edi, r8d
mov dword [r9], eax
mov eax, r8d
cmovbe eax, edi
mov edi, eax
cmp esi, r8d
jae 0x1401464ef
mov esi, r8d
inc r8d
cmp r8d, r15d
jbe 0x1401464c0
cmp edi, esi
ja 0x14014652e
mov rcx, qword ds:[rbx + 0xc8]
xor r9d, r9d
mov rax, qword [rbx + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx]
lea edx, [r9 + 0xb]
call qword [case.0x140101f48.0]
jmp 0x14014652e
mov esi, dword [rbp - 0x20]
mov edi, dword [rbp - 0x20]
mov rax, qword [rbx + 0x130]
cmp esi, dword [rax]
jae 0x1401465b2
cmp edi, esi
ja 0x1401465b2
mov eax, dword [rbx + 0x88]
sub esi, eax
mov r9d, dword [rbx + 0x78]
inc esi
imul esi, dword [rbx + 0x7c]
sub edi, eax
imul edi, dword [rbx + 0x7c]
mov edx, dword [rbx + 0xf8]
sub edx, dword [rbx + 0x8c]
add edx, dword [rbx + 0x98]
add esi, r9d
mov dword [rbp - 0x18], r14d
test byte [rbx + 0x40], 4
lea r8d, [rdi + r9]
je 0x14014657f
mov r14d, dword [rbx + 0x80]
mov eax, dword [rbx + 0x70]
mov rcx, qword [rbx]
sub eax, r14d
cmp edx, eax
cmovg edx, eax
cmp r8d, r9d
mov dword [rbp - 0x10], edx
lea rdx, [rbp - 0x18]
cmovl r8d, r9d
cmp esi, dword [rbx + 0x74]
mov dword [rbp - 0x14], r8d
cmovg esi, dword [rbx + 0x74]
xor r8d, r8d
mov dword [rbp - 0xc], esi
call qword [sym.imp.USER32.dll_InvalidateRect]
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140161390
add rsp, 0x50
pop rdi
pop rbx
pop rbp
ret