Function at 0x140069ba0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, qword [0x140218c28]
mov qword [rsp + 0x50], rdi
mov rcx, qword [0x140218c00]
mov rsi, rcx
mov qword [rsp + 0x58], rcx
cmp byte [rdi], 0
je 0x140069cf9
call fcn.1400e46c0
test eax, eax
jne 0x140069cf9
call fcn.1400e4180
movzx ecx, byte [0x14021876b]
call fcn.1400eabe0
nop
mov rdx, rsi
mov rcx, rdi
call fcn.14006a010
jmp 0x140069c10
movzx eax, byte [0x14021876c]
neg al
sbb ebx, ebx
and ebx, 0x11
mov rcx, qword [0x140218c00]
call fcn.1400e8990
mov edx, ebx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
movzx r8d, byte [rdi + 1]
mov edx, 0x20007
mov rcx, rsi
call fcn.1400e41a0
cmp byte [rdi + 1], 0
jne 0x140069c66
mov edx, 0x2000d
mov r8d, 1
mov rcx, rsi
call fcn.1400e41a0
cmp byte [rdi + 1], 0
je 0x140069ce5
mov ecx, reloc.WLDAP32.dll_Ordinal_45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140069c9e
cmp byte [reloc.WS2_32.dll_accept], 0
sete al
mov byte [reloc.WS2_32.dll_accept], al
test al, al
je 0x140069c9e
mov rcx, qword [0x140218c00]
call fcn.1400e8990
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
lea rcx, [0x140218dd8]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [0x140218dd8]
mov rcx, qword [0x140218aa0]
call qword [sym.imp.USER32.dll_ScreenToClient]
movd xmm0, dword [0x140218dd8]
cvtdq2ps xmm0, xmm0
movd xmm1, dword [0x140218ddc]
cvtdq2ps xmm1, xmm1
movss dword [0x140218ae8], xmm0
movss dword [0x140218aec], xmm1
mov rcx, rsi
call fcn.1400eaba0
mov rcx, qword [0x140218c00]
jmp 0x140069bd1
mov byte [0x14021895e], 0
lea rcx, [rsp + 0x50]
call fcn.140054a80
movabs r14, 0x7ffffffffa0a1eff
mov rax, qword [rsp + 0x50]
mov esi, 0xff
cmp rax, r14
je 0x140069d46
mov ecx, 1
cmovl ecx, esi
test cl, cl
jns 0x140069d46
add rax, 0x5f5e100
mov qword [rsp + 0x50], rax
movabs rbx, 0x7fffffffffffffff
jmp 0x140069d55
movabs rbx, 0x7fffffffffffffff
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x50]
call fcn.140055b00
mov byte [rdi], 0
lea rcx, [rsp + 0x50]
call fcn.140054a80
mov rax, qword [rsp + 0x50]
cmp rax, r14
je 0x140069d8f
mov ecx, 1
cmovl ecx, esi
test cl, cl
jns 0x140069d8f
add rax, 0x5f5e100
mov qword [rsp + 0x50], rax
jmp 0x140069d94
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x50]
call fcn.140055b00
mov rbx, qword [0x140218770]
xor edi, edi
test rbx, rbx
je 0x140069db5
mov r15, qword [rbx + 0x98]
jmp 0x140069db8
mov r15, rdi
lea r14, [rbx + 8]
test rbx, rbx
je 0x140069dca
mov rsi, qword [rbx + 0x98]
jmp 0x140069dcd
mov rsi, rdi
cmp dword [rsi + 0x48], 0
je 0x140069dec
lea rdx, [rsi + 0x48]
mov ecx, 1
call qword [0x140218800]
mov dword [rsi + 0x48], edi
mov rbx, qword [0x140218770]
cmp dword [rsi + 0x4c], 0
je 0x140069e0b
lea rdx, [rsi + 0x4c]
mov ecx, 1
call qword [0x140218800]
mov dword [rsi + 0x4c], edi
mov rbx, qword [0x140218770]
mov ecx, dword [rsi + 0x30]
test ecx, ecx
je 0x140069e22
call qword [0x140218808]
mov dword [rsi + 0x30], edi
mov rbx, qword [0x140218770]
test rbx, rbx
je 0x140069e30
mov rsi, qword [rbx + 0x98]
jmp 0x140069e33
mov rsi, rdi
cmp dword [rsi + 0x2c], 0
je 0x140069e5a
lea rdx, [rsi + 0x2c]
mov ecx, 1
call qword [0x140218818]
mov rax, qword [rbx + 0x38]
mov qword [rax + 8], rdi
mov dword [rsi + 0x2c], edi
mov rbx, qword [0x140218770]
mov qword [r14 + 0x80], rdi
mov qword [r14 + 0x90], rdi
and dword [r14 + 4], 0xfffffff7
test r15, r15
je 0x140069e8d
test rbx, rbx
je 0x140069e7d
dec dword [rbx + 0xec]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [0x140218770]
test rbx, rbx
je 0x140069e9b
mov r15, qword [rbx + 0x90]
jmp 0x140069e9e
mov r15, rdi
cmp byte [r15 + 0x70], 0
je 0x140069f68
mov r14, qword [r15]
test rbx, rbx
je 0x140069eba
mov rsi, qword [rbx + 0x90]
jmp 0x140069ebd
mov rsi, rdi
mov rdx, qword [rsi + 0x78]
mov rcx, r14
call fcn.1400e4280
mov rdx, qword [rsi + 0x88]
mov rcx, r14
call fcn.1400e2b50
mov rdx, qword [rsi + 0x80]
mov rcx, r14
call fcn.1400e2c90
mov rdx, qword [rsi + 0x90]
mov rcx, r14
call fcn.1400e2f50
mov rdx, qword [rsi + 0x98]
mov rcx, r14
call fcn.1400e2f90
mov rdx, qword [rsi + 0xa0]
mov rcx, r14
call fcn.1400e2f10
mov rdx, qword [rsi + 0xa8]
mov rcx, r14
call fcn.1400e2ad0
mov rcx, qword [rsi + 0xb0]
call fcn.1400e4e00
mov byte [rsi + 0x70], 0
mov qword [rsi + 0x78], rdi
mov qword [rsi + 0x88], rdi
mov qword [rsi + 0x80], rdi
mov qword [rsi + 0x90], rdi
mov qword [rsi + 0x98], rdi
mov qword [rsi + 0xa0], rdi
mov qword [rsi + 0xa8], rdi
mov qword [rsi + 0xb0], rdi
lea rsi, [r15 + 0x20]
mov r14d, 9
mov rcx, qword [rsi]
call fcn.1400e1e20
lea rsi, [rsi + 8]
sub r14, 1
jne 0x140069f72
mov rax, qword [0x140218770]
mov rcx, qword [rax + 0x48e8]
mov rcx, qword [rcx]
mov r8, qword [r15 + 0xb8]
lea edx, [r14 - 4]
mov rcx, qword [rcx + 0x28]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov qword [r15 + 0xb8], rdi
mov qword [rbx + 0x80], rdi
mov qword [rbx + 0x90], rdi
and dword [rbx + 0xc], 0xfffffff8
mov rax, qword [0x140218770]
test rax, rax
je 0x140069fd5
dec dword [rax + 0xec]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [0x140218c00]
call fcn.1400e3e20
call fcn.1400e57b0
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret