Function at 0x1401609a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x14047b0a0]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax + 0x120]
test al, al
jne 0x1401609ef
mov eax, dword [rdi]
sub eax, 0xe
cmp eax, 0xa
jbe 0x1401609ff
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + VarUI4FromDisp]
test al, al
jne 0x140160a26
mov rcx, qword [rbx + 0x38]
mov rdx, rdi
test rcx, rcx
je 0x140160a19
mov rax, qword [rcx]
call qword [rax + 0x1a0]
jmp 0x140161064
mov rcx, rbx
call fcn.1401530a0
jmp 0x140161064
mov r8d, dword [rdi]
cmp r8d, 0x28
jne 0x140160b35
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp - 0x28], xmm0
xor esi, esi
mov word [rbp - 0x38], si
mov eax, dword [rdi + 0x14]
mov dword [rsp + 0x50], eax
mov eax, dword [rdi + 0x18]
mov dword [rsp + 0x54], eax
lea r8, [rbp - 0x38]
mov rdx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140162b80
test al, al
je 0x140160a73
mov edx, 0x7f89
jmp 0x140160b15
mov r14, qword [rbx + 0x5c0]
test r14, r14
je 0x140160b10
movups xmm0, xmmword [r14 + 0x3c]
movups xmmword [rbp - 0x48], xmm0
mov ebx, dword [rdi + 0x14]
mov edi, dword [rdi + 0x18]
lea rdx, [rbp - 0x68]
mov rcx, qword [r14 + 8]
call fcn.14015a340
mov r15, qword [rax]
add ebx, r15d
mov dword [rsp + 0x50], ebx
shr r15, 0x20
add r15d, edi
mov dword [rsp + 0x54], r15d
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x48]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140160b10
mov rcx, qword [r14 + 8]
mov rax, qword [rcx]
call qword [rax]
mov rdx, qword [rax + 0xa8]
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], ebx
lea r8, [rbp - 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea edx, [r9 + 1]
lea r8d, [r9 - 1]
call qword [rax + gethostname]
jmp 0x140160b27
mov edx, 0x7f01
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
nop
lea rcx, [rbp - 0x38]
call fcn.14007ec70
jmp 0x140161064
cmp r8d, 0xa
jne 0x140160bbf
lea ecx, [r8 - 1]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140160b7f
cmp byte [rbx + 0x5c9], 0
jne 0x140160b7f
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140161064
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8d, [rsi + 0x2e]
mov rdx, rbx
call fcn.14014f2e0
jmp 0x140161064
cmp byte [rbx + 0x5d0], 0
je 0x140160b9a
mov rax, qword [rdi + 0x20]
sub rax, 0x30
cmp rax, 9
ja 0x140161064
mov rax, qword [rbx]
xor esi, esi
mov qword [rsp + 0x20], rsi
mov r9, qword [rdi + 0x28]
mov r8, qword [rdi + 0x20]
mov edx, 0x102
mov rcx, rbx
call qword [rax + 0x3c0]
jmp 0x140161064
cmp r8d, 8
jne 0x140160bd5
mov rdx, rdi
mov rcx, rbx
call fcn.140161090
jmp 0x140161064
cmp r8d, 0xe
jne 0x140160be5
mov edx, 0x200
jmp 0x140161059
cmp r8d, 0x18
jne 0x140160c0e
lea ecx, [r8 - 7]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x140161064
mov rdx, rdi
mov rcx, rbx
call fcn.1401663c0
jmp 0x140161064
cmp r8d, 0x12
je 0x140160fac
cmp r8d, 0x20
je 0x140160fac
cmp r8d, 0x13
je 0x140160f2b
cmp r8d, 0x22
je 0x140160f2b
test r8d, r8d
jne 0x140160c83
cmp byte [rbx + 0x5cd], r8b
je 0x140160c79
xor esi, esi
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], 0xffffffff
mov rax, qword [rbx]
lea rcx, [rbp - 0x60]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x60]
xor r8d, r8d
mov edx, 0x437
mov rcx, rbx
call qword [rax + 0x3c0]
jmp 0x140161064
mov edx, 0x203
jmp 0x140161059
cmp r8d, 0x14
jne 0x140160c93
mov edx, 0x204
jmp 0x140161059
cmp r8d, 0x15
jne 0x140160ca3
mov edx, 0x205
jmp 0x140161059
cmp r8d, 0x30
jne 0x140160d4c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x140161064
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmGetContext]
mov rsi, rax
test rax, rax
je 0x140161064
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14015a340
mov edx, dword [rbx + 0x5dc]
sub edx, dword [rsp + 0x58]
mov r8d, dword [rbx + 0x5e0]
sub r8d, dword [rsp + 0x5c]
mov dword [rbp + 8], 2
mov r10d, 1
cmp edx, r10d
cmovl edx, r10d
mov dword [rsp + 0x58], edx
cmp r8d, r10d
cmovl r8d, r10d
mov dword [rsp + 0x5c], r8d
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0xc], rax
lea rdx, [rbp + 8]
mov rcx, rsi
call qword [sym.imp.IMM32.dll_ImmSetCompositionWindow]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.IMM32.dll_ImmReleaseContext]
mov byte [rbx + 0x5d8], 1
jmp 0x140161064
cmp r8d, 0x31
jne 0x140160d5e
mov byte [rbx + 0x5d8], 0
jmp 0x140161064
cmp r8d, 2
jne 0x140160dc9
mov rdi, qword [rbx + 0x5c0]
test rdi, rdi
je 0x140160db4
or dword [rdi + 0x24], 0x20
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x48]
test eax, eax
jns 0x140160d88
and dword [rdi + 0x24], 0xffffffdf
mov rax, qword [rbx + 0x5c0]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [rsi + 7]
call qword [rax + ILCombine]
lea edx, [rsi + 1]
mov rcx, rbx
call fcn.140162520
mov byte [rbx + 0xbc], 1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SHELL32.dll_SHDoDragDrop]
jmp 0x140161064
cmp r8d, 3
jne 0x140160bfe
mov rdi, qword [rbx + 0x5c0]
xor esi, esi
test rdi, rdi
je 0x140160e77
or dword [rdi + 0x24], 0x20
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x48]
test eax, eax
jns 0x140160dfd
and dword [rdi + 0x24], 0xffffffdf
mov rax, qword [rbx + 0x5c0]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 8]
call qword [rax + ILCombine]
mov byte [rbx + 0x5d7], sil
mov qword [rbx + 0x728], rsi
mov rdi, qword [rbx + 0x730]
mov qword [rbx + 0x730], rsi
test rdi, rdi
je 0x140160e6e
mov eax, 0xffffffff
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140160e6e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140160e6e
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SHELL32.dll_SHDoDragDrop]
mov byte [rbx + 0xbc], 0
mov byte [rbx + 0x5d3], 0
cmp byte [rbx + 0x5d4], 0
je 0x140160ece
cmp byte [rbx + 0x5cd], 0
je 0x140160ece
cmp byte [rbx + 0xb9], 0
je 0x140160ece
mov dword [rsp + 0x68], 0xffffffff
mov dword [rsp + 0x6c], esi
mov rax, qword [rbx]
lea rcx, [rbp - 0x58]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x68]
xor r8d, r8d
mov edx, 0x437
mov rcx, rbx
call qword [rax + 0x3c0]
cmp byte [rbx + 0x5d5], 0
je 0x140160f0e
cmp byte [rbx + 0xb9], 0
je 0x140160f0e
mov dword [rsp + 0x70], 0xffffffff
mov dword [rsp + 0x74], esi
mov rax, qword [rbx]
lea rcx, [rbp - 0x50]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
xor r8d, r8d
mov edx, 0x437
mov rcx, rbx
call qword [rax + 0x3c0]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.SHELL32.dll_SHDoDragDrop]
call fcn.1401833d0
mov rcx, rax
xor edx, edx
call fcn.140183460
jmp 0x140161064
cmp byte [rbx + 0xb9], 0
je 0x140160fa2
cmp byte [rbx + 0x5d3], 0
jne 0x140160fa2
mov byte [rbx + 0x5d3], 1
cmp byte [rbx + 0x5d5], 0
je 0x140160fa2
xor esi, esi
mov dword [rsp + 0x78], esi
mov dword [rsp + 0x7c], 0xffffffff
mov rax, qword [rbx]
lea rcx, [rbp - 0x78]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x78]
xor r8d, r8d
mov edx, 0x437
mov rcx, rbx
call qword [rax + 0x3c0]
mov rax, qword [rbx]
mov rcx, rbx
test byte [rbx + 0x614], 4
je 0x140160f9c
call qword [rax + 0x338]
mov edx, 0x202
jmp 0x140161059
call qword [rax + 0x358]
mov edx, 0x202
jmp 0x140161059
mov rcx, qword [rbx + 0x7a0]
sub rcx, qword [rbx + 0x798]
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x14016103f
movdqa xmm0, xmmword [0x140415690]
movdqu xmmword [rbp - 8], xmm0
xor esi, esi
mov word [rbp - 0x18], si
mov eax, dword [rdi + 0x14]
mov dword [rbp - 0x80], eax
mov eax, dword [rdi + 0x18]
mov dword [rbp - 0x7c], eax
lea r8, [rbp - 0x18]
mov rdx, qword [rbp - 0x80]
mov rcx, rbx
call fcn.140162b80
test al, al
je 0x140161033
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140161028
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8d, [rsi + 0x2f]
mov rdx, rbx
call fcn.14014f2e0
nop
lea rcx, [rbp - 0x18]
call fcn.14007ec70
jmp 0x140161064
lea rcx, [rbp - 0x18]
call fcn.14007ec70
mov r8d, dword [rdi]
cmp r8d, 0x20
jne 0x140161054
call fcn.1401833d0
mov rcx, rax
mov dl, 1
call fcn.140183460
mov edx, 0x201
mov r8, rdi
mov rcx, rbx
call fcn.140161410
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.1401aed20
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret