Function at 0x140025f78
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, rdx
xor esi, esi
xor edx, edx
mov r14d, esi
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov rbx, rax
test rax, rax
je 0x140026214
lea ecx, [rsi + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
lea edx, [rsi + 8]
mov rcx, rdi
movzx ebp, ax
shr rbp, 8
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
mov r15, rax
test rax, rax
je 0x140026214
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, rbx
mov r12d, dword [rax + 8]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea rdx, [0x1400b96e0]
mov dword [0x140096d88], esi
mov rbx, rax
mov qword [0x140096d90], rsi
lea rax, [0x140023e30]
mov qword [rsp + 0x90], rsi
mov qword [0x140096d98], rax
mov rcx, r13
lea rax, [0x140023c10]
mov qword [0x140096d80], rax
call qword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov eax, dword [rbx + 0xfa]
lea edx, [rsi + 0x64]
mov ecx, dword [rbx + 0x26]
lea r8d, [rsi + 0x67]
mov dword [0x140096df0], eax
lea rax, [0x1400226e0]
mov qword [0x140096e08], rax
lea rax, [0x14001dfb0]
mov qword [0x140096e00], rax
lea rax, [0x14001faf0]
mov qword [0x140096df8], rax
mov rax, qword [rbx + 0xba]
mov qword [0x140096de8], rdi
lea rdi, [rbx + 0xde]
mov qword [0x140096d48], rax
mov r9, rdi
mov rax, qword [rbx + 0x1e6]
mov qword [0x140096d40], rax
call fcn.140045710
test eax, eax
je 0x1400260c0
lea eax, [rsi + 1]
jmp 0x140026216
mov rax, qword [rdi]
lea rsi, [rbx + 0xea]
mov r8d, dword [rbx + 0xf6]
mov r9, rsi
mov ecx, dword [rbx + 0x26]
mov edx, 0x65
mov qword [0x140096d50], rax
call fcn.140045710
or r8d, 0xffffffff
xor edx, edx
mov edi, 1
test eax, eax
jne 0x1400261ea
lea rax, [rbx + 0x106]
mov dword [0x140096dc0], edx
mov qword [0x140096dd8], rax
mov dword [0x140096e30], edx
mov dword [0x140096de0], r8d
cmp dword [rbx + 0x32], edx
jne 0x140026124
mov dword [rax + 4], edi
lea rax, [rbx + 0x186]
mov qword [0x140096dd0], rax
cmp dword [rbx + 0x36], edx
jne 0x140026139
mov dword [rax], edi
test dword [rbx + 0x22], 0x200
jne 0x140026150
test r12d, r12d
je 0x140026156
cmp r12d, 0x1f4
jge 0x140026156
mov dword [0x140096da4], edi
mov rax, qword [rsp + 0x90]
lea r14, [0x1400b8b00]
mov r9, qword [rsi]
mov rcx, r13
mov r8d, dword [rbx + 0x26]
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x38], edx
mov edx, r12d
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
mov rax, qword [rbx + 0x6e]
mov qword [rsp + 0x20], rax
call fcn.1400229cc
mov rax, qword [0x140096dd0]
mov edx, dword [rax]
mov rax, qword [0x140096dd8]
mov ecx, dword [rax + 4]
or ecx, edx
bt ecx, 0xe
jae 0x1400261bb
mov r8, r14
mov rdx, rbx
mov rcx, r13
call fcn.1400257ec
mov rcx, qword [rsi]
and dword [0x140096da4], 0
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rcx, qword [rsi]
mov edx, dword [rax + 0x44]
mov dword [rbx + 0x32], edx
mov eax, dword [rax + 0x48]
mov dword [rbx + 0x36], eax
lea r14d, [rax + rdx]
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
or r8d, 0xffffffff
test bpl, bpl
jne 0x1400261ff
cmp dword [rbx + 0x32], edi
mov ecx, dword [0x140096de0]
cmovne ecx, r8d
mov dword [rbx + 0x42], ecx
mov rcx, r15
mov qword [0x140096e08], rdx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, r14d
jmp 0x140026216
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret