Function at 0x14011b7ac
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
mov r13b, r8b
movsxd rdi, edx
mov rbx, rcx
call qword [rax + reloc.WS2_32.dll_WSASetLastError]
test al, al
jne 0x14011b7e6
mov rax, qword [rbx]
mov r8b, r13b
mov edx, edi
mov rcx, rbx
call qword [rax + Ordinal_26]
jmp 0x14011ba75
test edi, edi
jns 0x14011b7fd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_133]
mov al, 1
jmp 0x14011ba75
cmp dword [rbx + 0x10], 0xffffffff
jne 0x14011b810
cmp dword [rbx + 0xc], 0xffffffff
mov eax, edi
cmovne eax, dword [rbx + 0xc]
mov dword [rbx + 0x10], eax
lea r12, [rbx - 0x188]
mov edx, edi
mov rax, qword [r12]
mov rcx, r12
call qword [rax]
mov qword [rsp + 0x88], rax
mov rsi, rax
test rax, rax
je 0x14011ba73
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x218]
test al, al
je 0x14011ba73
mov r8, qword [rsi]
lea rdx, str.ListItem
mov rcx, rsi
call qword [r8 + 0x20]
mov r14, rax
test rax, rax
je 0x14011ba73
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x8000
test bp, ax
je 0x14011b91b
lea rbp, [rbx + 0x18]
mov rdx, rdi
mov rcx, rbp
call fcn.1400e9280
mov rcx, qword [r14]
mov r12d, eax
mov rax, qword [rcx + 0x30]
mov rcx, r14
cmp r12d, 0xffffffff
je 0x14011b8c7
xor edx, edx
call rax
test al, al
je 0x14011ba73
cmp dword [rbx + 0xc], edi
jne 0x14011b8b7
or dword [rbx + 0xc], 0xffffffff
mov edx, r12d
mov rcx, rbp
call fcn.1400e9804
jmp 0x14011b7f6
mov dl, 1
call rax
test al, al
je 0x14011ba73
mov rdx, rdi
mov dword [rbx + 0xc], edi
mov rcx, rbp
call fcn.1400e8f80
lea rbp, [rbx - 0x730]
mov edx, edi
mov rcx, rbp
call fcn.140119e24
test r13b, r13b
je 0x14011b903
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x250]
mov rcx, qword [rbx - 0x6d8]
test rcx, rcx
je 0x14011b7f6
mov rdx, rbp
jmp 0x14011ba54
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
je 0x14011ba01
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_133]
mov eax, dword [rbx + 0x10]
mov ecx, edi
cmp eax, edi
mov ebp, edi
cmovg ecx, eax
cmovle ebp, eax
cmp ebp, ecx
jg 0x14011b9b9
movsxd r15, ebp
mov esi, ecx
mov rax, qword [r12]
mov edx, ebp
mov rcx, r12
call qword [rax]
mov r14, rax
test rax, rax
je 0x14011b9a8
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x218]
test al, al
je 0x14011b9a8
mov r8, qword [r14]
lea rdx, str.ListItem
mov rcx, r14
call qword [r8 + 0x20]
test rax, rax
je 0x14011b9a8
mov r8, qword [rax]
mov dl, 1
mov rcx, rax
call qword [r8 + 0x30]
test al, al
je 0x14011b9a8
lea rcx, [rbx + 0x18]
mov rdx, r15
call fcn.1400e8f80
inc ebp
inc r15
cmp ebp, esi
jle 0x14011b953
mov rsi, qword [rsp + 0x88]
lea rbp, [rbx - 0x730]
mov dword [rbx + 0xc], edi
mov rcx, rbp
mov edx, edi
call fcn.140119e24
test r13b, r13b
je 0x14011b9de
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x250]
mov rcx, qword [rbx - 0x6d8]
test rcx, rcx
je 0x14011b7f6
movsxd rax, dword [rbx + 0x10]
mov rdx, rbp
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
jmp 0x14011ba5f
mov rax, qword [r14]
mov dl, 1
mov rcx, r14
call qword [rax + 0x30]
test al, al
je 0x14011ba73
lea rcx, [rbx + 0x18]
mov dword [rbx + 0xc], edi
mov rdx, rdi
call fcn.1400e8f80
lea r14, [rbx - 0x730]
mov edx, edi
mov rcx, r14
call fcn.140119e24
test r13b, r13b
je 0x14011ba41
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x250]
mov rcx, qword [rbx - 0x6d8]
test rcx, rcx
je 0x14011b7f6
mov rdx, r14
mov byte [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, rdi
lea r8, str.itemselect
call fcn.1400e6608
jmp 0x14011b7f6
xor al, al
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret