Function at 0x1401edd20
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbx, rcx
mov r14, r8
mov ecx, 0x10
mov rbp, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
movzx r15d, ax
call qword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [rbx + 0x50]
movzx r12d, ax
mov r8d, dword [rbx + 0x54]
mov edi, edx
mov r10, qword [rbx]
and r12d, 0x8000
mov esi, r8d
and r15d, 0x8000
je 0x1401edda8
test dword [rbx + 0x1bc], 0x300
je 0x1401edda8
test byte [rbx + 0x1c8], 4
jne 0x1401edda8
mov rax, qword [rbx + 0x68]
test rax, rax
je 0x1401edda2
mov edi, dword [rax + 8]
mov esi, dword [rax + 0xc]
jmp 0x1401edda8
mov edi, dword [rbx + 0x60]
mov esi, dword [rbx + 0x64]
lea rax, [rbp - 8]
mov r9d, esi
mov r11d, edi
cmp rax, 0x88
ja case.0x1401edde3.25
mov qword [rsp + 0x60], r13
lea r13, [0x140000000]
movzx eax, byte [rax + r13 + 0x1ee4b4]
mov ecx, dword [r13 + rax*4 + 0x1ee46c]
add rcx, r13
mov r13, qword [rsp + 0x60]
jmp rcx
mov rcx, rbx
call fcn.140237100
lea rcx, [rbx + 0x240]
mov qword [rsp + 0x20], r14
mov r9d, ebp
mov r8d, 0x100
mov rdx, rax
call qword [rbx + 0x2d0]
test eax, eax
jne case.0x1401edde3.24
mov eax, dword [rbx + 0x54]
mov edx, 0x1000
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x230]
test word [rax + rcx*8 + 4], dx
jne case.0x1401edde3.24
mov edx, 1
mov rcx, rbx
call fcn.140236370
jmp case.0x1401edde3.24
mov ecx, dword [rbx + 0x224]
mov eax, ecx
and eax, 0x18
cmp al, 0x18
jne 0x1401ede7e
test cl, 0x20
jne 0x1401ede7e
mov rdx, qword [rbx + 0x68]
lea rcx, [rbx + 0x240]
mov r9d, ebp
mov qword [rsp + 0x20], r14
mov r8d, 0x100
call qword [rbx + 0x2d0]
test eax, eax
jne case.0x1401edde3.24
mov r9, r14
mov r8, rbp
mov edx, 0x100
mov rcx, rbx
call qword [rbx + 0x1e0]
jmp case.0x1401edde3.24
mov eax, dword [rbx + 0x1bc]
xor ecx, ecx
test al, 0x40
jne 0x1401edeb6
test eax, 0x300
je 0x1401edeb2
cmp esi, 0xffff
je 0x1401edeb6
mov eax, ecx
jmp 0x1401edebb
mov eax, 1
lea edx, [rdi - 1]
cmp edx, 0xfeff
ja 0x1401eded2
test edx, edx
mov edi, ecx
cmovne edi, edx
jmp case.0x1401edde3.24
neg eax
sbb edi, edi
movzx edi, di
jmp case.0x1401edde3.24
mov edx, dword [rbx + 0x78]
test edx, edx
je 0x1401edef3
test dword [rbx + 0x1b8], 0x800
jne 0x1401edef3
dec edx
xor ecx, ecx
cmp r11d, 0xff00
mov eax, ecx
cmovb eax, r11d
cmp edi, 0xff00
setb cl
cmp eax, edx
jae 0x1401edf21
cmp ecx, edx
jae 0x1401edf21
add eax, ecx
mov edi, edx
cmp eax, edx
cmovb edi, eax
jmp case.0x1401edde3.24
mov edi, edx
jmp case.0x1401edde3.24
mov eax, dword [rbx + 0x1bc]
xor ecx, ecx
test al, 0x40
jne 0x1401edf48
test eax, 0x300
je 0x1401edf43
cmp esi, 0xffff
je 0x1401edf48
mov r8d, ecx
jmp 0x1401edf4e
mov r8d, 1
mov eax, dword [rbx + 0xe8]
mov edx, 1
cmp eax, edx
cmova edx, eax
cmp edx, edi
jbe 0x1401edf6d
test edi, edi
je 0x1401edf6d
mov edi, ecx
jmp case.0x1401edde3.24
cmp edi, 0xff00
ja 0x1401edf87
cmp edx, edi
ja 0x1401edf87
sub edi, edx
mov eax, edi
mov edi, ecx
cmovne edi, eax
jmp case.0x1401edde3.24
neg r8d
sbb edi, edi
movzx edi, di
jmp case.0x1401edde3.24
mov eax, dword [rbx + 0xe8]
mov edx, 1
mov r9d, dword [rbx + 0x1b8]
cmp eax, edx
mov r8d, dword [rbx + 0x78]
mov ecx, edi
cmova edx, eax
and r9d, 0x800
call fcn.1401ed9d0
mov edi, eax
jmp case.0x1401edde3.24
mov eax, dword [rbx + 0x78]
test eax, eax
mov ecx, dword [rbx + 0x7c]
lea edi, [rax - 1]
cmove edi, r11d
lea esi, [rcx - 1]
test ecx, ecx
cmove esi, r9d
jmp case.0x1401edde3.24
xor ecx, ecx
mov esi, ecx
mov edi, ecx
jmp case.0x1401edde3.24
mov eax, dword [rbx + 0x1bc]
xor ecx, ecx
test al, 0x20
jne 0x1401ee00b
test eax, 0x300
je 0x1401ee007
cmp edi, 0xffff
je 0x1401ee00b
mov eax, ecx
jmp 0x1401ee010
mov eax, 1
lea edx, [rsi - 1]
cmp edx, 0xfeff
ja 0x1401ee027
test edx, edx
mov esi, ecx
cmovne esi, edx
jmp case.0x1401edde3.24
neg eax
sbb esi, esi
movzx esi, si
jmp case.0x1401edde3.24
mov edx, dword [rbx + 0x7c]
test edx, edx
je 0x1401ee048
test dword [rbx + 0x1b8], 0x400
jne 0x1401ee048
dec edx
xor ecx, ecx
cmp r9d, 0xff00
mov eax, ecx
cmovb eax, r9d
cmp esi, 0xff00
setb cl
cmp eax, edx
jae 0x1401ee076
cmp ecx, edx
jae 0x1401ee076
add eax, ecx
mov esi, edx
cmp eax, edx
cmovb esi, eax
jmp case.0x1401edde3.24
mov esi, edx
jmp case.0x1401edde3.24
xor ecx, ecx
test r15d, r15d
je 0x1401ee0c1
test esi, esi
jne 0x1401ee0a7
test edi, edi
je 0x1401ee0a7
lea eax, [rdi - 1]
cmp eax, 0xfeff
ja 0x1401ee09f
test eax, eax
mov edi, ecx
cmovne edi, eax
jmp 0x1401ee0a4
mov edi, 0xffff
mov esi, dword [rbx + 0x7c]
lea eax, [rsi - 1]
mov esi, ecx
cmp eax, 0xfeff
ja case.0x1401edde3.24
test eax, eax
cmovne esi, eax
jmp case.0x1401edde3.24
mov edx, dword [rbx + 0x7c]
cmp r9d, 0xff00
mov eax, ecx
mov r8d, ecx
cmovb eax, r9d
cmp esi, 0xff00
setb r8b
cmp eax, edx
jae 0x1401ee0f3
cmp r8d, edx
jae 0x1401ee0f3
add eax, r8d
mov esi, edx
cmp eax, edx
cmovb esi, eax
jmp 0x1401ee0f5
mov esi, edx
cmp esi, edx
jb 0x1401ee1d6
mov eax, dword [rbx + 0x78]
mov esi, ecx
test eax, eax
lea edx, [rax - 1]
cmove edx, eax
cmp edi, 0xff00
mov eax, ecx
cmovb eax, edi
setb cl
cmp eax, edx
jae 0x1401ee12e
cmp ecx, edx
jae 0x1401ee12e
add eax, ecx
mov edi, edx
cmp eax, edx
cmovb edi, eax
jmp 0x1401ee1d6
mov edi, edx
jmp 0x1401ee1d6
test r15d, r15d
je 0x1401ee14d
xor r9d, r9d
mov edx, 0x300
xor r8d, r8d
mov rcx, r10
jmp 0x1401ee378
test r12d, r12d
jne 0x1401ee1db
xor r9d, r9d
xor r8d, r8d
mov edx, 0x303
mov rcx, r10
call qword [sym.imp.USER32.dll_SendMessageW]
cmp edi, dword [rbx + 0x50]
jne 0x1401ee431
cmp esi, dword [rbx + 0x54]
jne 0x1401ee431
cmp rbp, 9
jne 0x1401ee451
test r15d, r15d
jne 0x1401ee451
test r12d, r12d
jne 0x1401ee451
mov rcx, rbx
call fcn.140236270
jmp 0x1401ee451
test r15d, r15d
je 0x1401ee1bd
xor r9d, r9d
mov edx, 0x302
xor r8d, r8d
mov rcx, r10
jmp 0x1401ee378
test r12d, r12d
je 0x1401ee16a
mov edx, 0x301
xor r9d, r9d
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.USER32.dll_SendMessageW]
test r12d, r12d
je 0x1401ee16a
test byte [rbx + 0x1c8], 8
je 0x1401ee16a
cmp edi, dword [rbx + 0x50]
jne 0x1401ee1f2
cmp esi, dword [rbx + 0x54]
je 0x1401ee451
xor r9d, r9d
jmp 0x1401ee437
bt r14, 0x19
jae case.0x1401edde3.24
xor r9d, r9d
mov edx, 0x304
xor r8d, r8d
mov rcx, r10
jmp 0x1401ee378
test r15d, r15d
je 0x1401ee1d6
xor r9d, r9d
mov rcx, r10
xor r8d, r8d
lea edx, [r9 + 0x7b]
jmp 0x1401ee378
test r12d, r12d
je 0x1401ee2f6
test r15d, r15d
jne 0x1401ee2b2
cmp rbp, 0x43
je 0x1401ee1c2
cmp rbp, 0x58
jne 0x1401ee257
mov edx, 0x300
jmp 0x1401ee1c7
cmp rbp, 0x56
jne 0x1401ee267
mov edx, 0x302
jmp 0x1401ee1c7
cmp rbp, 0x5a
jne 0x1401ee277
mov edx, 0x304
jmp 0x1401ee1c7
cmp rbp, 0x41
jne 0x1401ee287
mov edx, 0x7f09
jmp 0x1401ee1c7
mov rcx, rbx
call fcn.140237100
lea rcx, [rbx + 0x240]
mov qword [rsp + 0x20], r14
mov r9d, ebp
mov r8d, 0x100
mov rdx, rax
call qword [rbx + 0x2d0]
jmp 0x1401ee1d6
cmp rbp, 0x5a
jne 0x1401ee2cb
xor r9d, r9d
mov edx, 0x7e9
xor r8d, r8d
mov rcx, r10
jmp 0x1401ee378
mov rcx, rbx
call fcn.140237100
lea rcx, [rbx + 0x240]
mov qword [rsp + 0x20], r14
mov r9d, ebp
mov r8d, 0x100
mov rdx, rax
call qword [rbx + 0x2d0]
jmp case.0x1401edde3.24
mov rcx, rbx
call fcn.140237100
test rax, rax
je case.0x1401edde3.24
lea rcx, [rbx + 0x240]
mov qword [rsp + 0x20], r14
mov r9d, ebp
mov r8d, 0x100
mov rdx, rax
call qword [rbx + 0x2d0]
test eax, eax
jne case.0x1401edde3.24
lea rax, [rbp - 0x30]
cmp rax, 0x3f
jbe 0x1401ee339
lea rax, [rbp - 0x80]
cmp rax, 0x6f
ja case.0x1401edde3.24
mov eax, dword [rbx + 0x54]
mov edx, 0x1000
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x230]
test word [rax + rcx*8 + 4], dx
jne case.0x1401edde3.24
test byte [rbx + 0x1bc], 4
je case.0x1401edde3.24
mov edx, 1
mov rcx, rbx
call fcn.140236370
mov rcx, qword [rbx + 0x10]
mov r9, r14
mov r8, rbp
mov edx, 0x100
call qword [sym.imp.USER32.dll_SendMessageW]
test r15d, r15d
je 0x1401ee1d6
test dword [rbx + 0x1bc], 0x300
je 0x1401ee1d6
cmp rbp, 9
je 0x1401ee1d6
test byte [rbx + 0x1c8], 4
je 0x1401ee3b4
cmp edi, dword [rbx + 0x50]
jne 0x1401ee3cf
cmp esi, dword [rbx + 0x54]
jmp 0x1401ee3c9
mov rax, qword [rbx + 0x68]
test rax, rax
je 0x1401ee451
cmp edi, dword [rax + 8]
jne 0x1401ee3cf
cmp esi, dword [rax + 0xc]
je 0x1401ee451
mov rcx, rbx
call fcn.14023ab00
test byte [rbx + 0x1c8], 4
je 0x1401ee3f0
xor r9d, r9d
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.1402359d0
mov rdx, qword [rbx + 0x68]
test rdx, rdx
je 0x1401ee410
mov rcx, rbx
call fcn.1402373b0
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.140235df0
jmp 0x1401ee444
mov rcx, qword [rbx + 0x58]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 - 1]
call sym.ErrorReportClient.exe_SfList_DeleteList
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.140235df0
jmp 0x1401ee444
mov r9d, 1
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.1402359d0
mov r8d, esi
mov edx, edi
mov rcx, rbx
call fcn.140236b00
mov rbx, qword [rsp + 0x68]
xor eax, eax
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret