Function at 0x14005cab0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
cmp byte [0x14020fd15], 0
mov ecx, dword [0x14020fdd8]
je 0x14005ce2f
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005caff
cmp byte [0x14020fdce], 0
sete byte [0x14020fdce]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov qword [0x1401da090], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp byte [0x14020fdce], 0
mov qword [0x1401da0b8], rax
je 0x14005d119
cmp rax, qword [0x1401da000]
jne 0x14005d119
mov r8d, dword [0x1401da06c]
mov edx, dword [0x1401da07c]
mov rcx, qword [0x1401da090]
call qword [sym.imp.GDI32.dll_GetPixel]
cmp eax, dword [0x1401d8dbc]
jne 0x14005d119
mov eax, dword [0x14020fe48]
inc eax
cmp byte [0x14020b38d], 0
mov ecx, eax
mov dword [0x14020fe48], eax
jne 0x14005cb77
cmp eax, 1
jne 0x14005cb77
mov eax, 2
mov dword [0x14020fe48], eax
mov ecx, eax
cmp byte [reloc.WS2_32.dll_accept], 0
mov edx, ecx
jne 0x14005cb94
cmp ecx, 2
jne 0x14005cb94
mov eax, 3
mov dword [0x14020fe48], eax
mov edx, eax
movzx ebp, byte [reloc.WS2_32.dll_accept]
mov ecx, edx
test bpl, bpl
jne 0x14005cbb4
cmp edx, 3
jne 0x14005cbb4
mov eax, 4
mov dword [0x14020fe48], eax
mov ecx, eax
movzx esi, byte [reloc.WS2_32.dll_accept]
mov edx, ecx
test sil, sil
jne 0x14005cbd4
cmp ecx, 4
jne 0x14005cbd4
mov eax, 5
mov dword [0x14020fe48], eax
mov edx, eax
movzx edi, byte [reloc.WS2_32.dll_accept]
mov ecx, edx
test dil, dil
jne 0x14005cbf4
cmp edx, 5
jne 0x14005cbf4
mov eax, 6
mov dword [0x14020fe48], eax
mov ecx, eax
movzx r11d, byte [reloc.WS2_32.dll_accept]
mov edx, ecx
test r11b, r11b
jne 0x14005cc15
cmp ecx, 6
jne 0x14005cc15
mov eax, 7
mov dword [0x14020fe48], eax
mov edx, eax
movzx r10d, byte [reloc.WS2_32.dll_accept]
test r10b, r10b
jne 0x14005cc32
cmp edx, 7
jne 0x14005cc32
mov eax, 8
mov dword [0x14020fe48], eax
movzx r8d, byte [reloc.WS2_32.dll_accept]
test r8b, r8b
jne 0x14005cc4f
cmp eax, 8
jne 0x14005cc4f
mov eax, 9
mov dword [0x14020fe48], eax
movzx ecx, byte [reloc.WS2_32.dll_accept]
test cl, cl
jne 0x14005cc6a
cmp eax, 9
jne 0x14005cc6a
mov eax, 0xa
mov dword [0x14020fe48], eax
lea r14d, [rax + 0x30]
mov r9d, eax
cmp eax, 9
jl 0x14005cc81
xor eax, eax
mov dword [0x14020fe48], eax
xor r9d, r9d
mov edx, r9d
test cl, cl
jne 0x14005cc98
cmp r9d, 8
jl 0x14005cc98
xor eax, eax
mov dword [0x14020fe48], eax
xor edx, edx
mov r9d, edx
test r8b, r8b
jne 0x14005ccb4
test cl, cl
jne 0x14005ccb4
cmp edx, 7
jl 0x14005ccb4
xor eax, eax
mov dword [0x14020fe48], eax
xor r9d, r9d
test r10b, r10b
jne 0x14005ccd0
test r8b, r8b
jne 0x14005ccd0
test cl, cl
jne 0x14005ccd0
cmp r9d, 6
jl 0x14005ccd0
xor eax, eax
mov dword [0x14020fe48], eax
test r11b, r11b
jne 0x14005ccf0
test r10b, r10b
jne 0x14005ccf0
test r8b, r8b
jne 0x14005ccf0
test cl, cl
jne 0x14005ccf0
cmp eax, 5
jl 0x14005ccf0
xor eax, eax
mov dword [0x14020fe48], eax
test dil, dil
jne 0x14005cd15
test r11b, r11b
jne 0x14005cd15
test r10b, r10b
jne 0x14005cd15
test r8b, r8b
jne 0x14005cd15
test cl, cl
jne 0x14005cd15
cmp eax, 4
jl 0x14005cd15
xor eax, eax
mov dword [0x14020fe48], eax
test sil, sil
jne 0x14005cd3f
test dil, dil
jne 0x14005cd3f
test r11b, r11b
jne 0x14005cd3f
test r10b, r10b
jne 0x14005cd3f
test r8b, r8b
jne 0x14005cd3f
test cl, cl
jne 0x14005cd3f
cmp eax, 3
jl 0x14005cd3f
xor eax, eax
mov dword [0x14020fe48], eax
test bpl, bpl
jne 0x14005cd6e
test sil, sil
jne 0x14005cd6e
test dil, dil
jne 0x14005cd6e
test r11b, r11b
jne 0x14005cd6e
test r10b, r10b
jne 0x14005cd6e
test r8b, r8b
jne 0x14005cd6e
test cl, cl
jne 0x14005cd6e
cmp eax, 2
jl 0x14005cd6e
xor eax, eax
mov dword [0x14020fe48], eax
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x14005cda8
test bpl, bpl
jne 0x14005cda8
test sil, sil
jne 0x14005cda8
test dil, dil
jne 0x14005cda8
test r11b, r11b
jne 0x14005cda8
test r10b, r10b
jne 0x14005cda8
test r8b, r8b
jne 0x14005cda8
test cl, cl
jne 0x14005cda8
cmp eax, 1
jl 0x14005cda8
mov dword [0x14020fe48], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movzx ecx, r14b
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
movzx ecx, r14b
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [0x1401d8d78]
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [0x1401d8f44]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8f44]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x1401d8d78]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005d119
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14005d119
mov ecx, dword [0x14020fe48]
inc ecx
cmp byte [0x14020b38d], 0
mov edx, ecx
mov dword [0x14020fe48], ecx
jne 0x14005ce68
cmp ecx, 1
jne 0x14005ce68
mov ecx, 2
mov dword [0x14020fe48], ecx
mov edx, ecx
cmp byte [reloc.WS2_32.dll_accept], 0
mov eax, edx
jne 0x14005ce85
cmp edx, 2
jne 0x14005ce85
mov eax, 3
mov ecx, eax
mov dword [0x14020fe48], eax
movzx ebp, byte [reloc.WS2_32.dll_accept]
mov edx, eax
test bpl, bpl
jne 0x14005cea7
cmp eax, 3
jne 0x14005cea7
mov eax, 4
mov ecx, eax
mov dword [0x14020fe48], eax
mov edx, eax
movzx esi, byte [reloc.WS2_32.dll_accept]
mov eax, edx
test sil, sil
jne 0x14005cec7
cmp edx, 4
jne 0x14005cec7
mov eax, 5
mov ecx, eax
mov dword [0x14020fe48], eax
movzx edi, byte [reloc.WS2_32.dll_accept]
mov edx, eax
test dil, dil
jne 0x14005cee9
cmp eax, 5
jne 0x14005cee9
mov eax, 6
mov ecx, eax
mov dword [0x14020fe48], eax
mov edx, eax
movzx r11d, byte [reloc.WS2_32.dll_accept]
mov eax, edx
test r11b, r11b
jne 0x14005cf0a
cmp edx, 6
jne 0x14005cf0a
mov eax, 7
mov ecx, eax
mov dword [0x14020fe48], eax
movzx r10d, byte [reloc.WS2_32.dll_accept]
test r10b, r10b
jne 0x14005cf29
cmp eax, 7
jne 0x14005cf29
mov eax, 8
mov ecx, eax
mov dword [0x14020fe48], eax
movzx r8d, byte [reloc.WS2_32.dll_accept]
test r8b, r8b
jne 0x14005cf48
cmp ecx, 8
jne 0x14005cf48
mov eax, 9
mov ecx, eax
mov dword [0x14020fe48], eax
movzx edx, byte [reloc.WS2_32.dll_accept]
test dl, dl
jne 0x14005cf65
cmp ecx, 9
jne 0x14005cf65
mov eax, 0xa
mov ecx, eax
mov dword [0x14020fe48], eax
lea r14d, [rcx + 0x30]
mov r9d, ecx
cmp ecx, 9
jl 0x14005cf7c
xor ecx, ecx
mov dword [0x14020fe48], ecx
xor r9d, r9d
mov eax, r9d
test dl, dl
jne 0x14005cf93
cmp r9d, 8
jl 0x14005cf93
xor ecx, ecx
mov dword [0x14020fe48], ecx
xor eax, eax
mov r9d, eax
test r8b, r8b
jne 0x14005cfaf
test dl, dl
jne 0x14005cfaf
cmp eax, 7
jl 0x14005cfaf
xor ecx, ecx
mov dword [0x14020fe48], ecx
xor r9d, r9d
test r10b, r10b
jne 0x14005cfcb
test r8b, r8b
jne 0x14005cfcb
test dl, dl
jne 0x14005cfcb
cmp r9d, 6
jl 0x14005cfcb
xor ecx, ecx
mov dword [0x14020fe48], ecx
test r11b, r11b
jne 0x14005cfeb
test r10b, r10b
jne 0x14005cfeb
test r8b, r8b
jne 0x14005cfeb
test dl, dl
jne 0x14005cfeb
cmp ecx, 5
jl 0x14005cfeb
xor ecx, ecx
mov dword [0x14020fe48], ecx
test dil, dil
jne 0x14005d010
test r11b, r11b
jne 0x14005d010
test r10b, r10b
jne 0x14005d010
test r8b, r8b
jne 0x14005d010
test dl, dl
jne 0x14005d010
cmp ecx, 4
jl 0x14005d010
xor ecx, ecx
mov dword [0x14020fe48], ecx
test sil, sil
jne 0x14005d03a
test dil, dil
jne 0x14005d03a
test r11b, r11b
jne 0x14005d03a
test r10b, r10b
jne 0x14005d03a
test r8b, r8b
jne 0x14005d03a
test dl, dl
jne 0x14005d03a
cmp ecx, 3
jl 0x14005d03a
xor ecx, ecx
mov dword [0x14020fe48], ecx
test bpl, bpl
jne 0x14005d069
test sil, sil
jne 0x14005d069
test dil, dil
jne 0x14005d069
test r11b, r11b
jne 0x14005d069
test r10b, r10b
jne 0x14005d069
test r8b, r8b
jne 0x14005d069
test dl, dl
jne 0x14005d069
cmp ecx, 2
jl 0x14005d069
xor ecx, ecx
mov dword [0x14020fe48], ecx
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x14005d0a3
test bpl, bpl
jne 0x14005d0a3
test sil, sil
jne 0x14005d0a3
test dil, dil
jne 0x14005d0a3
test r11b, r11b
jne 0x14005d0a3
test r10b, r10b
jne 0x14005d0a3
test r8b, r8b
jne 0x14005d0a3
test dl, dl
jne 0x14005d0a3
cmp ecx, 1
jl 0x14005d0a3
mov dword [0x14020fe48], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
movzx ecx, r14b
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
movzx ecx, r14b
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [0x1401d8d78]
call qword [sym.imp.KERNEL32.dll_Sleep]
movzx ecx, byte [0x1401d8f44]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_keybd_event]
movzx ecx, byte [0x1401d8f44]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret