Function at 0x140066a9c
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, qword [0x1401c2450]
cmp dword [rdx], 0
je 0x140066b42
mov rbp, qword [sym.imp.USER32.dll_PeekMessageW]
lea ebx, [rax + 1]
xor edi, edi
lea rsi, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
mov rcx, rsi
call rbp
test eax, eax
je 0x140066b42
mov rax, qword [0x1401eab30]
test rax, rax
je 0x140066b15
mov rdx, qword [rsp + 0x68]
mov r9, qword [rsp + 0x60]
mov r8d, dword [rsp + 0x58]
mov rcx, qword [0x1401eab28]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x50]
call rax
cmp dword [rsp + 0x58], 0x200
je 0x140066b57
mov rcx, rsi
call qword [sym.imp.USER32.dll_TranslateMessage]
mov rcx, rsi
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, ebx
sub eax, dword [rsp + 0x70]
test eax, eax
jg 0x140066ac9
inc edi
cmp edi, 3
jle 0x140066ac9
xor ecx, ecx
call fcn.140011b25
cmp byte [rax + 0xe1], 1
mov rbx, rax
jne 0x140066b94
jmp 0x140066b78
mov rax, qword [0x1401c1880]
mov edx, dword [rax]
test edx, edx
je 0x140066b1f
inc edx
sub edx, dword [rsp + 0x70]
test edx, edx
jg 0x140066ac9
xor edx, edx
mov dword [rax], edx
jmp 0x140066b1f
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140066b94
mov edx, 0xe1
xor ecx, ecx
call fcn.1400117af
cmp byte [rbx + 0xe5], 1
jne 0x140066bb9
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140066bb9
mov edx, 0xe5
xor ecx, ecx
call fcn.1400117af
call fcn.140011709
test rax, rax
je 0x140066bc9
test byte [rax + 0x42], 0x10
jne 0x140066c13
cmp byte [rbx + 0xe3], 1
jne 0x140066bee
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140066bee
mov edx, 0xe3
xor ecx, ecx
call fcn.1400117af
cmp byte [rbx + 0xe7], 1
jne 0x140066c13
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140066c13
mov edx, 0xe7
xor ecx, ecx
call fcn.1400117af
call fcn.14004a71b
mov rbx, rax
call fcn.1400426f5
mov esi, eax
test rbx, rbx
jne 0x140066c36
call fcn.140011709
test rax, rax
jne 0x140066c78
jmp 0x140066dd2
mov rbx, qword [rbx + 0x310]
test rbx, rbx
je 0x140066c27
mov rdx, qword [rbx + 0xd8]
test rdx, rdx
je 0x140066c6f
cmp dword [rdx + 0x78], 0
je 0x140066c5b
xor eax, eax
mov dword [rdx + 0x78], eax
jmp 0x140066c67
mov eax, esi
sub eax, dword [rdx + 0x7c]
cmp eax, 0xbb7
jbe 0x140066c6f
mov rcx, rbx
call fcn.14006d3de
mov rbx, qword [rbx + 0xe8]
jmp 0x140066c3d
test byte [rax + 0x41], 0x40
je 0x140066dd2
mov rbx, qword [rax + 0xd8]
cmp dword [rbx + 0xa4], 0
jne 0x140066dd2
lea rsi, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140066dd2
mov rcx, qword [rbx + 8]
mov rdx, rsi
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x140066dd2
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, eax
call fcn.1400126a2
lea rdx, [rsp + 0x48]
lea r8, [rsp + 0x4c]
mov esi, dword [rax + 0x50]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
call fcn.14006d32c
mov eax, dword [rsp + 0x4c]
mov r9d, dword [rsp + 0x48]
mov edx, esi
xor r8d, r8d
mov dword [rsp + 0x20], eax
mov rcx, qword [rbx]
call fcn.14001347b
cmp ebp, 1
mov ecx, 1
mov rdi, qword [sym.imp.USER32.dll_GetAsyncKeyState]
sbb r9d, r9d
and r9d, 0xfffffffe
add r9d, 3
mov dword [rsp + 0x3c], r9d
call rdi
mov r9d, dword [rsp + 0x3c]
mov rcx, qword [rbx]
mov edx, esi
movsx r8d, ax
shr r8d, 0x1f
call fcn.14001345d
cmp ebp, 1
mov ecx, 2
sbb r9d, r9d
and r9d, 2
inc r9d
mov dword [rsp + 0x3c], r9d
call rdi
mov r9d, dword [rsp + 0x3c]
mov rcx, qword [rbx]
mov edx, esi
movsx r8d, ax
shr r8d, 0x1f
call fcn.14001345d
mov ecx, 4
call rdi
mov rcx, qword [rbx]
mov r9d, 2
mov edx, esi
movsx r8d, ax
shr r8d, 0x1f
call fcn.14001345d
mov ecx, 5
call rdi
mov rcx, qword [rbx]
mov r9d, 4
mov edx, esi
movsx r8d, ax
shr r8d, 0x1f
call fcn.14001345d
mov ecx, 6
call rdi
mov rcx, qword [rbx]
mov r9d, 5
mov edx, esi
movsx r8d, ax
shr r8d, 0x1f
call fcn.14001345d
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
ret