Function at 0x140012ea0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
movzx ebx, dl
mov r15, r9
movzx eax, bx
movzx edi, r8w
or ax, r8w
mov esi, ecx
je 0x1400134ae
mov eax, dword [rbp + 0xb8]
test eax, eax
mov qword [r11 + 8], r12
mov qword [r11 - 0x30], r13
mov r13d, 0xffc3d44d
cmovne r13d, eax
mov qword [r11 - 0x38], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x140105b5c]
sete r14b
cmp dword [0x140105d10], 0
je 0x140012f0f
test r14b, r14b
jne 0x140012f0f
mov r12b, 1
jmp 0x140012f12
xor r12b, r12b
cmp dword [0x140105d10], 1
mov byte [rsp + 0x30], r12b
je 0x140012f25
test r14b, r14b
je 0x140012f2c
mov byte [rbp + 0xb0], 0
test bl, bl
jne 0x140012f3d
movzx ecx, di
call fcn.140017070
movzx ebx, al
jmp 0x140012f4f
test di, di
jne 0x140012f4f
xor edx, edx
movzx ecx, bl
call fcn.140016d00
movzx edi, ax
xor ecx, ecx
lea rdx, sym.MZ____D3_.0Rb__hqjOe_e5e_JE_S3G_n____Y1_H
movzx eax, di
shr ax, 8
test al, al
setne cl
cmp dword [0x140105d10], 2
mov dword [rsp + 0x40], ecx
jne case.default.0x140012f8a
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140012f8a
cdqe
mov ecx, dword [rdx + rax*4 + 0x134bc]
add rcx, rdx
jmp rcx
mov bl, reloc.OLEAUT32.dll_SafeArrayGetElemsize
jmp case.default.0x140012f8a
mov bl, reloc.OLEAUT32.dll_SafeArrayGetDim
jmp case.default.0x140012f8a
mov bl, reloc.OLEAUT32.dll_SafeArrayGetUBound
test r15, r15
je 0x1400130c5
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140015b80
test al, al
je 0x140013054
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test esi, esi
jne 0x140012fce
movzx eax, bl
or byte [rsp + rax + 0x50], 0x80
jmp 0x140012fdb
cmp esi, 1
jne 0x140012fdb
movzx eax, bl
and byte [rsp + rax + 0x50], 0x7f
movzx eax, bl
add eax, 0xffffff60
cmp eax, 5
ja case.default.0x140012ffb
lea rdx, sym.MZ____D3_.0Rb__hqjOe_e5e_JE_S3G_n____Y1_H
cdqe
mov ecx, dword [rdx + rax*4 + 0x134d4]
add rcx, rdx
jmp rcx
test byte [rbp - 0xe], 0x80
jne 0x140013010
test byte [rbp - 0xd], 0x80
jne 0x140013010
and byte [rsp + 0x61], 0x7f
jmp case.default.0x140012ffb
or byte [rsp + 0x61], 0x80
jmp case.default.0x140012ffb
test byte [rbp - 0x10], 0x80
jne 0x14001302a
test byte [rbp - 0xf], 0x80
jne 0x14001302a
and byte [rsp + 0x60], 0x7f
jmp case.default.0x140012ffb
or byte [rsp + 0x60], 0x80
jmp case.default.0x140012ffb
test byte [rbp - 0xc], 0x80
jne 0x140013044
test byte [rbp - 0xb], 0x80
jne 0x140013044
and byte [rsp + 0x62], 0x7f
jmp case.default.0x140012ffb
or byte [rsp + 0x62], 0x80
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetKeyboardState]
movzx eax, di
shl eax, 0x10
movsxd rdi, eax
cmp esi, 1
je 0x14001307b
mov r9, rdi
movzx r8d, bl
or r9, 1
mov edx, 0x100
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
cmp byte [rbp + 0xb0], 0
je 0x14001309d
cmp esi, 2
jne 0x14001309d
mov rax, qword [0x140100a58]
mov ecx, dword [rax + 0x84]
call fcn.140014c40
jmp 0x1400130a5
test esi, esi
je 0x14001346d
mov r9d, 0xc0000001
movzx r8d, bl
or r9, rdi
mov edx, 0x101
mov rcx, r15
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14001346d
cmp byte [0x140104de8], 0
mov dword [0x140108100], esi
mov byte [0x140105d16], bl
je 0x140013101
cmp bl, 0x12
je 0x1400130e6
lea eax, [rbx + 0x5c]
cmp al, 1
ja 0x140013101
test r14b, r14b
jne 0x140013101
xor ecx, ecx
mov byte [rsp + 0x34], 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140104de8], r14b
jmp 0x140013106
mov byte [rsp + 0x34], 0
test r14b, r14b
lea rax, [0x140108104]
lea r15, [rsp + 0x44]
cmove r15, rax
cmp bl, 0xa5
jne 0x1400131b3
test r12b, r12b
jne 0x1400131b3
cmp qword [0x140104d98], 0
je 0x1400131b3
mov al, 1
mov byte [rsp + 0x33], al
mov byte [rbp + 0x98], al
test r14b, r14b
jne 0x140013154
mov rax, qword [0x140108108]
mov qword [rsp + 0x38], rax
jmp 0x140013177
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
call fcn.140015f10
xor edx, edx
mov qword [rsp + 0x38], rax
mov rcx, rax
mov r12, rax
call fcn.140016120
mov dword [r15], eax
cmp dword [r15], 0
je 0x140013189
mov byte [rbp + 0x98], 0
mov r10b, 1
jmp 0x140013207
mov ecx, 0xa2
mov byte [rbp + 0xa0], 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov dword [0x140105b50], r13d
mov r10b, 1
movzx r12d, ax
shr r12d, 0xf
and r12b, 1
jmp 0x14001321c
xor r10b, r10b
mov byte [rsp + 0x33], r10b
mov byte [rbp + 0x98], r10b
test r12b, r12b
je 0x1400131fd
xor r8d, r8d
movzx edx, di
movzx ecx, bl
call fcn.140015b80
movzx r12d, byte [rbp + 0x98]
movzx ecx, al
mov byte [rsp + 0x32], al
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
mov byte [rbp + 0xa0], al
jmp 0x140013222
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x38], rax
movzx eax, byte [rbp + 0x98]
movzx r12d, byte [rbp + 0x98]
mov byte [rbp + 0xa0], al
xor cl, cl
mov byte [rsp + 0x32], cl
test r14b, r14b
jne 0x140013248
mov eax, dword [0x140105d10]
cmp eax, 2
je 0x140013248
cmp qword [0x140104d98], 0
je 0x140013241
cmp eax, 1
jne 0x140013248
mov byte [rsp + 0x31], 1
jmp 0x14001324d
mov byte [rsp + 0x31], 0
mov r14d, 0x8000
cmp esi, 1
je 0x14001333d
cmp byte [rsp + 0x30], 0
je 0x14001329c
mov r9d, dword [rsp + 0x40]
movzx r8d, di
movzx edx, bl
mov dword [rsp + 0x20], r13d
call fcn.1400146b0
mov r14, qword [rsp + 0x38]
cmp byte [rsp + 0x31], 0
je 0x140013342
movzx r8d, di
movzx edx, bl
xor ecx, ecx
call fcn.140014e50
jmp 0x140013342
test r10b, r10b
je 0x1400132b5
mov eax, dword [0x140105b4c]
cmp dword [r15], 3
cmove eax, r13d
mov dword [0x140105b4c], eax
mov r8d, dword [rsp + 0x40]
movzx edx, dil
mov r9d, r13d
movzx ecx, bl
call qword [sym.imp.USER32.dll_keybd_event]
xor eax, eax
mov dword [0x140105b4c], eax
cmp byte [rbp + 0x98], al
je 0x140013279
cmp dword [0x140105b50], eax
mov byte [rbp + 0x98], al
je 0x140013306
mov r14, qword [rsp + 0x38]
lea edx, [rax + 4]
mov rcx, r14
mov dword [0x140105b50], eax
call fcn.140016120
mov dword [r15], eax
jmp 0x14001327e
test r12b, r12b
jne 0x140013279
movzx ecx, byte [rbp + 0xa0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and ax, r14w
mov r14, qword [rsp + 0x38]
neg ax
mov rcx, r14
sbb edx, edx
add edx, 4
call fcn.140016120
mov dword [r15], eax
jmp 0x14001327e
mov r14, qword [rsp + 0x38]
cmp byte [rbp + 0xb0], 0
je 0x140013379
cmp esi, 2
jne 0x140013379
cmp dword [0x140105d10], esi
mov rax, qword [0x140100a58]
jne 0x14001336c
mov ecx, dword [rax + 0x88]
call fcn.140014c40
jmp 0x140013381
mov ecx, dword [rax + 0x84]
call fcn.140014c40
jmp 0x140013381
test esi, esi
je 0x140013454
mov ecx, dword [rsp + 0x40]
or ecx, 2
cmp byte [rsp + 0x30], 0
je 0x1400133aa
mov r9d, ecx
mov dword [rsp + 0x20], r13d
movzx ecx, byte [rsp + 0x32]
movzx r8d, di
movzx edx, bl
call fcn.1400146b0
jmp 0x140013428
cmp byte [rsp + 0x33], 0
je 0x1400133c5
mov eax, dword [0x140105b48]
cmp dword [r15], 3
cmove eax, r13d
mov dword [0x140105b48], eax
mov r8d, ecx
mov r9d, r13d
movzx ecx, bl
movzx edx, dil
call qword [sym.imp.USER32.dll_keybd_event]
xor esi, esi
mov dword [0x140105b48], esi
cmp byte [rbp + 0x98], sil
je 0x140013428
cmp dword [0x140105b50], esi
je 0x1400133fc
mov dword [0x140105b50], esi
lea edx, [rsi + 4]
jmp 0x14001341d
test r12b, r12b
je 0x140013428
movzx ecx, byte [rbp + 0xa0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
setne sil
lea edx, [rsi + 3]
mov rcx, r14
call fcn.140016120
mov dword [r15], eax
cmp dword [r15], 0
je 0x14001343f
mov eax, 0x138
cmp di, ax
jne 0x14001343f
and byte [0x14010811c], 0xfe
cmp byte [rsp + 0x31], 0
je 0x140013454
movzx r8d, di
movzx edx, bl
mov cl, 1
call fcn.140014e50
cmp byte [rsp + 0x34], 0
je 0x14001346d
mov ecx, 1
call qword [sym.imp.USER32.dll_BlockInput]
mov byte [0x140104de8], 1
cmp byte [rbp + 0xb0], 0
mov r14, qword [rsp + 0x150]
mov r13, qword [rsp + 0x158]
mov r12, qword [rsp + 0x190]
je 0x1400134ae
cmp dword [0x140105d10], 2
mov rax, qword [0x140100a58]
jne 0x1400134a6
mov ecx, dword [rax + 0x80]
jmp 0x1400134a9
mov ecx, dword [rax + 0x7c]
call fcn.140014c40
add rsp, 0x160
pop r15
pop rdi
pop rsi
pop rbx
pop rbp
ret