Function at 0x140049d90
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rbp, qword [rcx + 0xd8]
mov ebx, edx
mov rdi, qword [0x140184af0]
mov rsi, rcx
mov r15, qword [rbp + 8]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor r14d, r14d
cmp rax, r15
mov ecx, r14d
mov eax, r14d
sete cl
cmp rdi, rsi
sete al
cmp eax, ecx
je 0x14004a07e
cmp ecx, ebx
jne 0x14004a07e
test ecx, ecx
je 0x140049fb8
lea ecx, [r14 + 0x17]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov ebx, 1
mov ecx, ebx
setne r14b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea edi, [rbx + 3]
test ax, ax
je 0x140049e25
test r14d, r14d
mov eax, edi
cmove eax, ebx
or byte [rbp + 0x74], al
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140049e40
test r14d, r14d
mov eax, ebx
cmove eax, edi
or byte [rbp + 0x74], al
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140049e51
or byte [rbp + 0x74], 2
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140049e65
or byte [rbp + 0x74], 8
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140049e79
or byte [rbp + 0x74], 0x10
mov rcx, rsi
call fcn.1400548f0
cmp dword [0x140183bc4], 0
jne 0x140049ee3
lea rcx, [rsp + 0xa0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0xa0]
mov rcx, r15
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdi, qword [rsp + 0xa0]
mov rcx, rsi
mov r14d, dword [rsp + 0xa4]
mov edx, edi
mov r8d, r14d
mov dword [rsp + 0x20], ebx
call fcn.140016bc0
test eax, eax
je 0x140049ee3
mov r9d, edi
mov dword [rsp + 0x20], r14d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.140016d50
mov rcx, rbp
call fcn.140049b30
mov rcx, rsi
call fcn.1400a0f50
mov rdi, qword [rbp + 0xa8]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov ecx, dword [rdi + 4]
mov ebx, eax
cmp eax, ecx
je 0x140049f35
test ecx, ecx
je 0x140049f32
mov edx, 0xffffffff
mov ecx, 0x900
call fcn.140040090
cmp al, 1
jne 0x140049f32
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x900
call fcn.14003fa70
mov dword [rdi + 4], ebx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140049f52
mov eax, 0x2000
or word [0x140184af8], ax
jmp 0x140049f5e
mov eax, 0xdfff
and word [0x140184af8], ax
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140049f7b
mov eax, 0x1000
or word [0x140184af8], ax
jmp 0x140049f87
mov eax, 0xefff
and word [0x140184af8], ax
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140049fa7
mov eax, 0x8000
or word [0x140184af8], ax
jmp 0x14004a07e
mov eax, 0x7fff
and word [0x140184af8], ax
jmp 0x14004a07e
mov ebx, 1
xor ecx, ecx
mov dword [rbp + 0x88], ebx
call fcn.1400548f0
call fcn.14009c540
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetClipCursor]
test eax, eax
je 0x14004a077
lea rbx, [rbp + 0x8c]
mov esi, 0x10
mov r8, rbx
lea rdx, [rsp + 0x30]
sub r8, rdx
lea rax, [rsp + 0x30]
mov ecx, esi
movzx edx, byte [r8 + rax]
dec rcx
movzx edi, byte [rax]
cmp dil, dl
jne 0x14004a077
inc rax
test rcx, rcx
jne 0x14004a000
call qword [sym.imp.USER32.dll_ClipCursor]
test bl, 3
je 0x14004a039
mov rax, rsi
dec rsi
test rax, rax
je 0x14004a077
mov byte [rbx], r14b
inc rbx
test bl, 3
jne 0x14004a023
mov rdx, rsi
shr rsi, 2
and edx, 3
test rsi, rsi
je 0x14004a056
mov rdi, rbx
xor eax, eax
mov rcx, rsi
lea rbx, [rbx + rsi*4]
rep stosd dword [rdi], eax
sub rdx, 1
je 0x14004a074
sub rdx, 1
je 0x14004a06e
cmp rdx, 1
jne 0x14004a077
mov byte [rbx], r14b
inc rbx
mov byte [rbx], r14b
inc rbx
mov byte [rbx], r14b
mov dword [rbp + 0x88], r14d
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret