Function at 0x14000eef0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push r13
sub rsp, 0x90
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rdi, r9
mov r13, rcx
xor ebx, ebx
mov dword [rax - 0x68], ebx
lea ecx, [rbx + 8]
call sub.MSVCR90.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__
test rax, rax
je 0x14000ef37
lea rcx, [rsp + 0x60]
mov qword [rax], rcx
jmp 0x14000ef3a
mov rax, rbx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x20], 0x18
lea r9, [rsp + 0x30]
xor r8d, r8d
mov edx, 0x10000003
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetRawInputData]
test eax, eax
je 0x14000efb0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000ef85
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov rcx, qword [rsp + 0x60]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, 0xffffffff80004005
jmp 0x14000f1e4
mov edx, dword [rsp + 0x30]
xor r8d, r8d
lea rcx, [rsp + 0x60]
call fcn.140010bf0
nop
mov rax, qword [rsp + 0x80]
mov r8, qword [rsp + 0x78]
cmp rax, r8
jne 0x14000efdf
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov r8, qword [rsp + 0x78]
mov dword [rsp + 0x20], 0x18
lea r9, [rsp + 0x30]
mov edx, 0x10000003
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetRawInputData]
cmp eax, dword [rsp + 0x30]
je 0x14000f03a
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000f00f
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov rcx, qword [rsp + 0x60]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov rax, 0xffffffff80004005
jmp 0x14000f1e4
mov rax, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x78]
cmp rax, rdi
jne 0x14000f057
call qword [sym.imp.MSVCR90.dll__invalid_parameter_noinfo]
mov rdi, qword [rsp + 0x78]
mov eax, dword [rdi]
sub eax, 1
je 0x14000f0c9
cmp eax, 1
jne 0x14000f13c
mov dword [rsp + 0x34], 0x20
mov dword [rsp + 0x40], 0x20
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x40]
mov edx, 0x2000000b
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetRawInputDeviceInfoW]
test eax, eax
jle 0x14000f137
cmp byte [rdi + 0x20], 3
jne 0x14000f137
cmp byte [rdi + 0x21], 5
jne 0x14000f137
xor r9d, r9d
mov edx, 0x40a
lea r8d, [r9 + 1]
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x78]
jmp 0x14000f13c
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r12d, ax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0xbc
cmp word [rdi + 0x1e], cx
jne 0x14000f137
cmp dword [rdi + 0x20], 0x100
jne 0x14000f137
mov ecx, 0x8000
test cx, si
je 0x14000f137
test cx, r12w
je 0x14000f137
test cx, ax
je 0x14000f137
xor r9d, r9d
mov edx, 0x40a
lea r8d, [r9 + 1]
mov rcx, qword [r13 + 8]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdi, qword [rsp + 0x78]
jmp 0x14000f13c
mov rdi, qword [rsp + 0x78]
test rdi, rdi
je 0x14000f149
mov rcx, rdi
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov rcx, qword [rsp + 0x60]
call sub.MSVCR90.dll_void___cdecl_operator_delete_void____ptr64_
movabs rax, 1
jmp 0x14000f1e4
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret