Function at 0x1000011d4
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov r14, r9
mov rbx, rcx
xor esi, esi
mov bpl, sil
cmp dword [r9 + 8], 0x100
je 0x1000029e7
mov al, bpl
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r13, rsi
movsxd r15, r8d
cmp r15, rsi
jle 0x100001215
lea r12, [rdx + 4]
cmp bpl, sil
jne 0x100001215
movzx eax, word [r12 - 2]
cmp rax, qword [r14 + 0x10]
je 0x100002b3d
inc r13
add r12, 6
cmp r13, r15
jge 0x100001215
jmp 0x1000029fa
movzx eax, word [r12]
cmp eax, 0x352
je 0x10001475a
cmp eax, 0x353
jne 0x100002b6d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jge 0x100002a13
jmp 0x1000146a5
cmp eax, 0x353
jle 0x100002a13
cmp eax, 0x355
jle 0x10001445a
cmp eax, 0x356
jne 0x100002a13
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jge 0x100002a13
jmp 0x100014382
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x100002a13
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x100002a13
lea rcx, [0x100040120]
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rbx + 0x70]
call fcn.100004270
mov rdi, qword [rbx + 0x68]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x60]
call fcn.1000031f0
mov rdx, rax
mov rcx, rdi
call fcn.1000036a0
cmp eax, 0xffffffff
je 0x100014417
cdqe
cmp rax, qword [rdi + 0x20]
jae 0x10001476b
shl rax, 4
add rax, qword [rdi + 0x18]
mov rcx, qword [rax]
jmp 0x10001441a
mov rcx, rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x421
call qword [sym.imp.USER32.dll_SendMessageW]
mov bpl, 1
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x100002a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x100002a13
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jge 0x100002a13
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x100002a13
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jge 0x100014631
mov bpl, 1
lea rcx, [0x100040120]
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
lea rcx, [0x100040120]
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rcx, [0x100040120]
mov rax, qword [0x100040120]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
lea rdx, [rsp + 0x38]
mov rcx, qword [rbx + 0x70]
call fcn.100004270
mov rsi, qword [rbx + 0x70]
lea rcx, [rsi + 0xa0]
call fcn.100018110
cmp eax, 0xffffffff
je 0x10001455f
cdqe
cmp rax, qword [rsi + 0xa8]
jae 0x10001477b
imul rax, rax, 0xb8
add rax, qword [rsi + 0xa0]
lea rdx, [rax + 0x8e]
xor esi, esi
cmp rdx, rsi
jne 0x100014539
mov ecx, esi
jmp 0x10001454b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
lea rcx, [rsp + 0x28]
call fcn.100003020
mov rdi, qword [rsp + 0x28]
jmp 0x100014561
xor esi, esi
lea rdx, [rsp + 0x20]
mov rcx, qword [rbx + 0x70]
call fcn.10001bdc8
cmp eax, esi
jl 0x1000145cb
lea rax, [rsp + 0x48]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x48]
call fcn.1000031f0
mov rsi, rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1000031f0
nop
mov r8, rsi
mov rdx, rax
mov rcx, qword [rbx + 0x68]
call fcn.10001ce50
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.1000031f0
mov rdx, rax
mov rcx, qword [rbx + 0x68]
call fcn.100004380
xor esi, esi
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x1000145e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x100014608
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x100002a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x100002a13
mov bpl, 1
lea rcx, [0x100040120]
mov rax, qword [0x100040120]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rbx + 0x70]
call fcn.10001bfd0
cmp eax, esi
jl 0x10001467c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.1000031f0
mov rdx, rax
mov rcx, qword [rbx + 0x68]
call fcn.100004380
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x100002a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x100002a13
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x100002a13
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x100002a13
mov bpl, 1
mov edx, 2
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_GetAncestor]
mov r8, rax
lea rdx, [rsp + 0x40]
mov rcx, qword [rbx + 0x68]
call fcn.10001cffc
nop
xor eax, eax
lea rdi, str.CORK_BOARD_ID
mov r8, qword [rsp + 0x40]
mov rsi, r8
lea ecx, [rax + 0xe]
repe cmpsw word [rsi], word [rdi]
je 0x10001470e
sbb eax, eax
sbb eax, 0xffffffff
xor esi, esi
cmp eax, esi
setne al
cmp al, sil
je 0x100014726
mov dl, 1
mov rcx, rbx
call fcn.100009630
jmp 0x100014731
xor edx, edx
mov rcx, rbx
call fcn.100009630
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, esi
jg 0x100002a13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x100002a13
mov bpl, 1
mov rcx, rbx
call fcn.10001de90
nop
jmp 0x100002a13
mov ecx, 0x80070057
call fcn.100018078
nop
jmp 0x100018007
mov ecx, 0x80070057
call fcn.100018078
int3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop