Function at 0x140020440
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
push r12
push r13
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movzx ebx, dl
mov r13, r9
movzx edi, r8w
movzx eax, bx
mov r12d, ecx
or ax, r8w
je 0x140020a98
mov qword [r11 + 8], rsi
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x38], r15
mov r15d, dword [rbp + 0xb8]
mov eax, 0xffc3d44d
test r15d, r15d
cmove r15d, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x14013e470]
sete sil
cmp dword [0x1401405f0], 0
je 0x1400204b2
test sil, sil
jne 0x1400204b2
mov r14b, 1
jmp 0x1400204b5
xor r14b, r14b
cmp dword [0x1401405f0], 1
mov byte [rbp + 0xa0], r14b
je 0x1400204ca
test sil, sil
je 0x1400204d1
mov byte [rbp + 0xb0], 0
test bl, bl
jne 0x1400204e2
movzx ecx, di
call fcn.140024860
movzx ebx, al
jmp 0x1400204f4
test di, di
jne 0x1400204f4
xor edx, edx
movzx ecx, bl
call fcn.1400244f0
movzx edi, ax
xor ecx, ecx
movzx eax, di
lea rdx, [0x140000000]
shr ax, 8
test al, al
setne cl
cmp dword [0x1401405f0], 2
mov dword [rsp + 0x38], ecx
jne case.default.0x14002052f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x14002052f
cdqe
mov ecx, dword [rdx + rax*4 + 0x20aa8]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x14002052f
mov bl, reloc.WSOCK32.dll_recv
jmp case.default.0x14002052f
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r13, r13
je 0x14002066f
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.1400233b0
test al, al
je 0x1400205fb
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test r12d, r12d
jne 0x140020574
movzx eax, bl
or byte [rsp + rax + 0x50], 0x80
jmp 0x140020582
cmp r12d, 1
jne 0x140020582
movzx eax, bl
and byte [rsp + rax + 0x50], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x1400205a2
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x20ac0]
add rcx, rdx
jmp rcx
test byte [rbp - 0xe], 0x80
jne 0x1400205b7
test byte [rbp - 0xd], 0x80
jne 0x1400205b7
and byte [rsp + 0x61], 0x7f
jmp case.default.0x1400205a2
or byte [rsp + 0x61], 0x80
jmp case.default.0x1400205a2
test byte [rbp - 0x10], 0x80
jne 0x1400205d1
test byte [rbp - 0xf], 0x80
jne 0x1400205d1
and byte [rsp + 0x60], 0x7f
jmp case.default.0x1400205a2
or byte [rsp + 0x60], 0x80
jmp case.default.0x1400205a2
test byte [rbp - 0xc], 0x80
jne 0x1400205eb
test byte [rbp - 0xb], 0x80
jne 0x1400205eb
and byte [rsp + 0x62], 0x7f
jmp case.default.0x1400205a2
or byte [rsp + 0x62], 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp r12d, 1
je 0x140020623
mov r9, rdi
movzx r8d, bl
mov edx, 0x100
or r9, 1
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xb0], 0
je 0x140020646
cmp r12d, 2
jne 0x140020646
mov rax, qword [0x14013b0f8]
mov ecx, dword [rax + 0x84]
call fcn.140022450
jmp 0x14002064f
test r12d, r12d
je 0x140020a57
mov r9d, 0xc0000001
movzx r8d, bl
mov edx, 0x101
or r9, rdi
mov rcx, r13
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140020a57
cmp byte [0x140140264], 0
mov dword [0x14013e4cc], r12d
mov byte [0x140140482], bl
je 0x1400206ec
cmp bl, 0x12
je 0x140020694
cmp bl, 0xa4
je 0x140020694
cmp bl, 0xa5
jne 0x1400206ec
test sil, sil
jne 0x1400206ec
mov eax, dword [0x140144130]
mov byte [rsp + 0x33], 1
test al, 1
jne 0x1400206d3
or dword [0x140144130], 1
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.BlockInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140144128], rax
mov rax, qword [0x140144128]
test rax, rax
je 0x1400206e3
xor ecx, ecx
call rax
mov byte [0x140140264], 0
jmp 0x1400206f1
mov byte [rsp + 0x33], 0
test sil, sil
lea rax, [0x14013e4c8]
lea r13, [rsp + 0x48]
cmove r13, rax
cmp bl, 0xa5
jne 0x14002071c
test r14b, r14b
jne 0x14002071c
cmp qword [0x14013f848], 0
je 0x14002071c
mov al, 1
jmp 0x14002071e
xor al, al
mov byte [rbp + 0x98], al
mov byte [rsp + 0x31], al
test al, al
je 0x140020796
test sil, sil
jne 0x14002073f
mov rax, qword [0x14013e4d0]
mov qword [rsp + 0x40], rax
jmp 0x140020763
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call fcn.140023710
xor edx, edx
mov rcx, rax
mov r14, rax
mov qword [rsp + 0x40], rax
call fcn.1400238e0
mov dword [r13], eax
cmp dword [r13], 0
je 0x140020771
mov byte [rsp + 0x31], 0
jmp 0x1400207a0
mov ecx, 0xa2
mov byte [rsp + 0x30], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [0x14013f73c], r15d
movzx r14d, ax
shr r14d, 0xf
and r14b, 1
jmp 0x1400207b3
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], rax
movzx eax, byte [rbp + 0x98]
movzx r14d, byte [rbp + 0x98]
mov byte [rsp + 0x30], al
movzx edx, byte [rbp + 0xa0]
test dl, dl
je 0x1400207dc
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.1400233b0
movzx edx, byte [rbp + 0xa0]
movzx ecx, al
mov byte [rsp + 0x34], al
jmp 0x1400207e2
xor cl, cl
mov byte [rsp + 0x34], cl
test sil, sil
jne 0x140020808
mov eax, dword [0x1401405f0]
cmp eax, 2
je 0x140020808
cmp qword [0x14013f848], 0
je 0x140020801
cmp eax, 1
jne 0x140020808
mov byte [rsp + 0x32], 1
jmp 0x14002080d
mov byte [rsp + 0x32], 0
cmp r12d, 1
je 0x1400208e4
test dl, dl
je 0x14002083d
mov r9d, dword [rsp + 0x38]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], r15d
call fcn.140021dd0
movzx esi, byte [rbp + 0x98]
jmp 0x1400208cd
movzx esi, byte [rbp + 0x98]
test sil, sil
je 0x14002085e
mov eax, dword [0x14013f840]
cmp dword [r13], 3
cmove eax, r15d
mov dword [0x14013f840], eax
mov r8d, dword [rsp + 0x38]
mov r9d, r15d
movzx edx, dil
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor r11d, r11d
mov dword [0x14013f840], r11d
cmp byte [rsp + 0x31], r11b
je 0x1400208cd
cmp dword [0x14013f73c], r11d
mov byte [rsp + 0x31], r11b
je 0x14002089f
mov dword [0x14013f73c], r11d
lea edx, [r11 + 4]
jmp 0x1400208bf
test r14b, r14b
jne 0x1400208cd
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
and ax, cx
neg ax
sbb edx, edx
add edx, 4
mov rcx, qword [rsp + 0x40]
call fcn.1400238e0
mov dword [r13], eax
cmp byte [rsp + 0x32], 0
je 0x1400208eb
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.1400226a0
jmp 0x1400208eb
movzx esi, byte [rbp + 0x98]
cmp byte [rbp + 0xb0], 0
je 0x140020924
cmp r12d, 2
jne 0x140020924
cmp dword [0x1401405f0], r12d
mov rax, qword [0x14013b0f8]
jne 0x140020917
mov ecx, dword [rax + 0x88]
call fcn.140022450
jmp 0x14002092d
mov ecx, dword [rax + 0x84]
call fcn.140022450
jmp 0x14002092d
test r12d, r12d
je 0x140020a01
mov ecx, dword [rsp + 0x38]
or ecx, 2
cmp byte [rbp + 0xa0], 0
je 0x140020958
mov r9d, ecx
movzx ecx, byte [rsp + 0x34]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], r15d
call fcn.140021dd0
jmp 0x1400209d4
test sil, sil
je 0x140020972
mov eax, dword [0x14013f844]
cmp dword [r13], 3
cmove eax, r15d
mov dword [0x14013f844], eax
mov r8d, ecx
mov r9d, r15d
movzx edx, dil
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor esi, esi
mov dword [0x14013f844], esi
cmp byte [rsp + 0x31], sil
je 0x1400209d4
cmp dword [0x14013f73c], esi
je 0x1400209a7
mov dword [0x14013f73c], esi
lea edx, [rsi + 4]
jmp 0x1400209c6
test r14b, r14b
je 0x1400209d4
movzx ecx, byte [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
setne sil
lea edx, [rsi + 3]
mov rcx, qword [rsp + 0x40]
call fcn.1400238e0
mov dword [r13], eax
cmp dword [r13], 0
je 0x1400209ec
mov eax, 0x138
cmp di, ax
jne 0x1400209ec
and byte [0x14013e4ab], 0xfe
cmp byte [rsp + 0x32], 0
je 0x140020a01
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.1400226a0
cmp byte [rsp + 0x33], 0
je 0x140020a57
mov eax, dword [0x140144130]
test al, 1
jne 0x140020a3d
or dword [0x140144130], 1
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.BlockInput
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140144128], rax
mov rax, qword [0x140144128]
test rax, rax
je 0x140020a50
mov ecx, 1
call rax
mov byte [0x140140264], 1
cmp byte [rbp + 0xb0], 0
mov r15, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x190]
je 0x140020a98
cmp dword [0x1401405f0], 2
mov rax, qword [0x14013b0f8]
jne 0x140020a90
mov ecx, dword [rax + 0x80]
jmp 0x140020a93
mov ecx, dword [rax + 0x7c]
call fcn.140022450
add rsp, 0x160
pop r13
pop r12
pop rdi
pop rbx
pop rbp
ret