Function at 0x14000dacc
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, 0x1f
je 0x14000dd00
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rdi, rcx
mov rcx, qword [rcx + 0x20]
mov ebx, edx
test rcx, rcx
je 0x14000dc5e
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x14000dc5e
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r12d, ebx
mov r15d, 0xc0000001
and r12d, 1
mov r14d, 0x101
je 0x14000db58
test bl, 8
jne 0x14000db58
bt ebx, 0xb
jb 0x14000db58
movzx eax, byte [rdi + 0x29]
lea edx, [r14 + 4]
shl eax, 0x10
movsxd r9, eax
mov eax, 0xe0000001
or r9, rax
jmp 0x14000db6d
test r12d, r12d
je 0x14000db7d
movzx eax, byte [rdi + 0x29]
mov edx, r14d
shl eax, 0x10
movsxd r9, eax
or r9, r15
mov rcx, qword [rdi + 0x20]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
mov r13d, ebx
and r13d, 8
je 0x14000dba6
movzx eax, byte [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
mov r8d, reloc.WSOCK32.dll_recvfrom
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ebp, ebx
and ebp, 2
je 0x14000dbcb
movzx eax, byte [rdi + 0x2b]
mov r8d, dword [rdi + 0x30]
mov rcx, qword [rdi + 0x20]
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov esi, ebx
and esi, 4
je 0x14000dbf2
movzx eax, byte [rdi + 0x2c]
mov rcx, qword [rdi + 0x20]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
and ebx, 0x10
je 0x14000dc17
movzx eax, byte [rdi + 0x2d]
mov rcx, qword [rdi + 0x20]
mov r8d, 0x5b
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov cl, 0x80
test ebx, ebx
je 0x14000dc21
xor byte [rsp + 0x7b], cl
test ebp, ebp
je 0x14000dc30
mov eax, dword [rdi + 0x30]
xor byte [rsp + 0x30], cl
xor byte [rsp + rax + 0x20], cl
test esi, esi
je 0x14000dc3f
xor byte [rsp + 0x30], cl
xor byte [rsp + 0xc1], cl
test r13d, r13d
je 0x14000dc48
xor byte [rsp + 0x31], cl
test r12d, r12d
je 0x14000dc51
xor byte [rsp + 0x32], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x14000dcd2
mov esi, 2
test bl, 1
je 0x14000dc79
mov dl, byte [rdi + 0x29]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 8
je 0x14000dc8f
mov dl, byte [rdi + 0x28]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_keybd_event]
test sil, bl
je 0x14000dca6
mov dl, byte [rdi + 0x2b]
mov cl, byte [rdi + 0x30]
xor r9d, r9d
mov r8d, esi
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 4
je 0x14000dcbc
mov dl, byte [rdi + 0x2c]
xor r9d, r9d
mov r8d, esi
mov cl, RegisterTypeLib
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 0x10
je 0x14000dcd2
mov dl, byte [rdi + 0x2d]
xor r9d, r9d
mov r8d, esi
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [rdi]
test edx, edx
je 0x14000dce0
mov rcx, rdi
call fcn.14000e654
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret