Function at 0x180148dc0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rsi, rdx
mov rbx, rcx
call fcn.180092860
xor r14d, r14d
lea rdx, [rbp + 0x30]
mov rdi, rax
mov dword [rbp + 0x30], r14d
mov rcx, qword [rax + 8]
call qword [sym.imp.gdiplus.dll_GdipGetFontCollectionFamilyCount]
mov dword [rdi + 0x10], eax
cmp dword [rbp + 0x30], r14d
jg 0x180148e02
call fcn.1800928f0
mov rdi, rax
mov qword [rbp - 0x10], r14
test rdi, rdi
je 0x180148e11
mov rdx, qword [rdi + 8]
jmp 0x180148e14
mov rdx, r14
lea r8, [rbp - 0x10]
lea rcx, [0x1802b1338]
call qword [sym.imp.gdiplus.dll_GdipCreateFontFamilyFromName]
movss xmm1, dword [0x1802bf80c]
mov r9d, 2
mov rcx, qword [rbp - 0x10]
xor r8d, r8d
mov dword [rbp - 8], eax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x30], r14
call qword [sym.imp.gdiplus.dll_GdipCreateFont]
lea rdx, [rbp + 0x40]
mov qword [rbp + 0x40], r14
mov ecx, 0xfe000000
call qword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
lea rdx, [rbp + 0x48]
mov qword [rbp + 0x48], r14
mov ecx, 0xfeffffff
call qword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
mov ecx, dword [rbx]
lea r8, [rbp - 0x30]
mov edx, dword [rbx + 4]
mov eax, dword [rbx + 8]
sub eax, ecx
mov qword [rbp - 0x30], r14
movd xmm0, ecx
xor ecx, ecx
cvtdq2ps xmm0, xmm0
movd xmm1, edx
movss dword [rbp - 0x20], xmm0
movd xmm0, eax
mov eax, dword [rbx + 0xc]
cvtdq2ps xmm0, xmm0
sub eax, edx
xor edx, edx
cvtdq2ps xmm1, xmm1
movss dword [rbp - 0x18], xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x1c], xmm1
movss dword [rbp - 0x14], xmm0
call qword [sym.imp.gdiplus.dll_GdipCreateStringFormat]
mov rcx, qword [rbp - 0x30]
mov edx, 1
mov dword [rbp - 0x28], eax
call qword [sym.imp.gdiplus.dll_GdipSetStringFormatAlign]
mov ecx, dword [rbp - 0x28]
mov edx, 1
test eax, eax
cmovne ecx, eax
mov dword [rbp - 0x28], ecx
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.gdiplus.dll_GdipSetStringFormatLineAlign]
mov ecx, dword [rbp - 0x28]
test eax, eax
mov rdi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x48]
cmovne ecx, eax
cmp byte [rbx + 0x29], 0
mov dword [rbp - 0x28], ecx
jne 0x180148f41
cmp byte [rbx + 0x28], 0
jne 0x180148f41
cmp word [rbx + 0x60], 0x14
jne 0x180148f28
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cmp al, 1
je 0x180148f41
cmp qword [rbx + 0x58], 8
lea rdx, [rbx + 0x40]
mov rcx, qword [rbx + 0x50]
jb 0x180148f3a
mov rdx, qword [rdx]
mov qword [rsp + 0x30], rdi
jmp 0x180148f58
cmp qword [rbx + 0x58], 8
lea rdx, [rbx + 0x40]
mov rcx, qword [rbx + 0x50]
jb 0x180148f53
mov rdx, qword [rdx]
mov qword [rsp + 0x30], r14
mov rax, qword [rbp - 0x30]
mov r8d, ecx
mov rbx, qword [rbp + 0x30]
mov rcx, qword [rsi]
mov r9, rbx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
call qword [sym.imp.gdiplus.dll_GdipDrawString]
test eax, eax
je 0x180148f84
mov dword [rsi + 8], eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.gdiplus.dll_GdipDeleteStringFormat]
mov rcx, r14
call qword [sym.imp.gdiplus.dll_GdipDeleteBrush]
mov rcx, rdi
call qword [sym.imp.gdiplus.dll_GdipDeleteBrush]
mov rcx, rbx
call qword [sym.imp.gdiplus.dll_GdipDeleteFont]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.gdiplus.dll_GdipDeleteFontFamily]
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret