Function at 0x1401a2520
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x1402bb040]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov dword [rsp + 0x48], r9d
mov r15d, r9d
mov qword [rbp - 0x80], rcx
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x201
je 0x1401a2572
cmp r8d, 0x204
jne 0x1401a2578
call qword [sym.imp.USER32.dll_SetFocus]
xor r12b, r12b
mov qword [rsp + 0x1c8], r14
mov eax, esi
mov r13d, 1
sub eax, 0x201
je 0x1401a2676
sub eax, r13d
je 0x1401a2667
nop
cmp eax, 2
jne 0x1401a25be
test byte [rdi + 0x40], al
je 0x1401a25be
mov edx, dword [rdi + 0x128]
mov rcx, rdi
call fcn.1401a4990
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov r14d, dword [rbp + 0xd0]
test byte [rdi + 0x40], 2
jne 0x1401a2d12
mov eax, dword [rbp + 0xd8]
lea rdx, [rsp + 0x60]
mov rcx, rdi
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x68], 3
call fcn.1401a6300
mov eax, r15d
xor ecx, ecx
and eax, 8
mov ebx, 0xffffffff
mov dword [rsp + 0x54], eax
mov eax, r15d
mov r15d, dword [rsp + 0x6c]
and eax, 4
mov r13d, r15d
mov dword [rsp + 0x58], eax
and r13d, 0x20
je 0x1401a26ee
cmp esi, 0x201
jne 0x1401a26fe
mov rbx, qword [rsp + 0x70]
mov rcx, rdi
mov rdx, rbx
mov r8d, dword [rbx]
shr r8d, 2
not r8b
and r8b, 1
call fcn.1401a5e20
mov r9, qword [rsp + 0x78]
mov r8d, 0xffffffff
mov edx, r8d
jmp 0x1401a2857
test byte [rdi + 0x40], 2
je 0x1401a25be
jmp 0x1401a25b8
mov ecx, dword [rdi + 0x40]
mov r14d, dword [rbp + 0xd0]
test cl, 0x20
je 0x1401a25c5
mov edx, dword [rdi + 0x88]
lea eax, [rdx - 8]
cmp r14d, eax
jl 0x1401a25c5
lea eax, ds:[rdx + 8]
cmp r14d, eax
jge 0x1401a25c5
or ecx, 2
mov dword [rdi + 0x124], r14d
mov dword [rdi + 0x40], ecx
movzx r12d, r13b
mov rcx, rbx
mov dword [rdi + 0x128], edx
call qword [sym.imp.USER32.dll_SetCapture]
xor r9d, r9d
mov r8d, 0x64
mov rdx, r13
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetTimer]
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x1401a25cf
cmp esi, 0x201
je 0x1401a2708
cmp esi, 0x204
je 0x1401a2708
mov rbx, qword [rsp + 0x70]
jmp 0x1401a2832
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x1401a2737
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41c
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rdi + 0x160], 0xffffffffffffffff
mov dword [rdi + 0x190], ebx
mov rax, qword [rsp + 0x78]
mov ecx, r15d
mov rbx, qword [rsp + 0x70]
and ecx, 0x10
mov dword [rsp + 0x40], ecx
je 0x1401a297c
xor r14d, r14d
mov qword [rdi + 0x98], rbx
test byte [rdi + 0x4c], 1
je 0x1401a27f4
test byte [rbx], 2
jne 0x1401a27f4
test r12b, r12b
jne 0x1401a27f4
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
mov r8, rax
mov rcx, rdi
call fcn.1401a5f60
test al, al
je 0x1401a27f4
mov eax, dword [rbp - 0x40]
mov r14d, 1
mov ecx, dword [rbp + 0xd0]
test al, 4
je 0x1401a27b9
cmp ecx, dword [rbp - 0xc]
jl 0x1401a27b9
cmp ecx, dword [rbp - 4]
mov edx, 0
cmovl r14d, edx
jmp 0x1401a27bb
xor edx, edx
and eax, 0x18
cmp al, 0x18
jne 0x1401a27f6
cmp ecx, dword [rbp + 0x14]
jl 0x1401a27f6
cmp ecx, dword [rbp + 0x1c]
jge 0x1401a27f6
mov r9d, dword [rsp + 0x58]
xor eax, eax
mov r8d, dword [rsp + 0x54]
cmp esi, 0x204
mov rdx, rbx
mov rcx, rdi
sete al
mov dword [rsp + 0x20], eax
call fcn.1401a6880
jmp 0x1401a2829
xor edx, edx
mov r9d, dword [rsp + 0x58]
mov eax, edx
mov r8d, dword [rsp + 0x54]
cmp esi, 0x204
mov rdx, rbx
mov rcx, rdi
sete al
mov dword [rsp + 0x20], eax
call fcn.1401a6880
nop word [rax + rax]
test r14d, r14d
jne 0x1401a2970
mov r14d, dword [rbp + 0xd0]
xor ecx, ecx
mov r9, qword [rsp + 0x78]
lea eax, [rsi - 0x201]
mov r8d, 0xffffffff
mov r10d, 0x49
mov edx, r8d
cmp eax, 6
ja 0x1401a28a5
bt r10d, eax
jae 0x1401a28a5
mov eax, dword ds:[rdi + 0xa8]
test eax, eax
je 0x1401a2883
cmp eax, esi
je 0x1401a2883
cmp eax, 0x201
jne 0x1401a2876
mov edx, 0xd
jmp 0x1401a2883
xor edx, edx
cmp eax, 0x204
setne dl
add edx, 0xe
mov eax, dword ds:[rbp + 0xd8]
mov dword [rdi + 0xb0], eax
mov dword [rdi + 0xa8], esi
mov dword [rdi + 0xac], r14d
jmp 0x1401a2933
lea eax, [rsi - 0x202]
cmp eax, 6
ja 0x1401a2909
bt r10d, eax
jae 0x1401a2909
mov eax, dword ds:[rdi + 0xa8]
test eax, eax
je 0x1401a2901
cmp dword [rdi + 0xac], r14d
jne 0x1401a2901
mov r10d, dword [rbp + 0xd8]
cmp dword [rdi + 0xb0], r10d
jne 0x1401a2901
nop dword [rax]
cmp eax, 0x201
jne 0x1401a28f4
mov edx, 0xd
mov dword [rdi + 0xa8], ecx
jmp 0x1401a292d
cmp eax, 0x204
mov edx, ecx
setne dl
add edx, 0xe
mov dword [rdi + 0xa8], ecx
jmp 0x1401a292d
cmp esi, 0x203
jne 0x1401a2918
mov edx, 0x10
jmp 0x1401a292d
nop dword [rax + rax]
cmp esi, 0x206
jne 0x1401a292d
mov edx, 0x11
mov eax, dword [rbp + 0xd8]
test r13d, r13d
jne 0x1401a2d12
nop dword [rax]
cmp edx, r8d
je 0x1401a2d12
mov r8d, dword [rsp + 0x48]
mov rcx, rdi
mov dword [rsp + 0x30], r8d
mov r8d, r14d
mov qword [rsp + 0x28], r9
mov r9d, eax
mov qword [rsp + 0x20], rbx
call fcn.1401a4a00
jmp 0x1401a2d12
mov r14d, dword [rbp + 0xd0]
mov rax, qword [rsp + 0x78]
xor r13b, r13b
mov byte [rsp + 0x50], 0
test r15b, 0xf
jne 0x1401a2c5d
test r12b, r12b
mov r12d, 0xffffffff
jne 0x1401a2c63
nop dword [rax]
test rbx, rbx
je 0x1401a29ab
mov r13d, dword [rbx + 0x2c]
jmp 0x1401a29ae
mov r13d, r12d
test rax, rax
je 0x1401a29bc
mov eax, dword [rax + 4]
mov dword [rsp + 0x5c], eax
jmp 0x1401a29c1
mov dword [rsp + 0x5c], r12d
mov edx, dword [rdi + 0x228]
mov eax, r14d
mov ecx, dword [rdi + 0x22c]
sub eax, edx
mov r8d, dword [rbp + 0xd8]
mov r9d, 2
mov dword [rbp + 0x40], eax
mov eax, r8d
sub eax, ecx
mov dword [rbp + 0x44], eax
lea eax, [rdx + r14]
mov dword [rbp + 0x48], eax
xor edx, edx
lea eax, [rcx + r8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov dword [rbp + 0x4c], eax
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetCapture]
xor r15d, r15d
mov ebx, r15d
nop word [rax + rax]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
lea rcx, [rbp - 0x78]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1401a2aad
mov eax, dword [rbp - 0x70]
sub eax, 0x200
je 0x1401a2a7d
sub eax, 1
je 0x1401a2a72
sub eax, 1
je 0x1401a2a72
sub eax, 2
je 0x1401a2a72
cmp eax, 1
je 0x1401a2a72
lea rcx, [rbp - 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1401a2ab3
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov ebx, dword [rbp - 0x70]
jmp 0x1401a2ab3
mov eax, dword [rbp - 0x54]
cmp eax, dword [rbp + 0x40]
jl 0x1401a2a97
cmp eax, dword [rbp + 0x48]
jge 0x1401a2a97
mov eax, dword [rbp - 0x50]
cmp eax, dword [rbp + 0x44]
jl 0x1401a2a97
cmp eax, dword [rbp + 0x4c]
jl 0x1401a2ab3
mov rcx, qword ds:[rdi]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
setne dl
jmp 0x1401a2ad5
call qword [sym.imp.USER32.dll_WaitMessage]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax]
test eax, eax
je 0x1401a2ad3
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, qword [rdi]
je 0x1401a2a20
xor dl, dl
cmp r13d, r12d
jne 0x1401a2adf
mov r14, r15
jmp 0x1401a2afa
mov rax, qword [rdi + 0x130]
cmp r13d, dword [rax]
jae 0x1401a2d12
mov rax, qword [rax + 8]
mov ecx, r13d
mov r14, qword [rax + rcx*8]
mov eax, dword ds:[rsp + 0x5c]
cmp eax, r12d
je 0x1401a2b2b
cmp eax, dword [rdi + 0xdc]
jae 0x1401a2d12
mov ecx, eax
mov rax, qword [rdi + 0xd0]
mov r13, qword [rax + rcx*8]
test r13, r13
je 0x1401a2d12
jmp 0x1401a2b30
mov r13, qword [rsp + 0x78]
test dl, dl
je 0x1401a2b72
mov sil, 1
cmp dword [rsp + 0x40], r15d
je 0x1401a2c52
test byte [rdi + 0x4c], sil
je 0x1401a2c52
mov ebx, dword ds:[rbp + 0xd0]
xor r13b, r13b
test r14, r14
je 0x1401a2c6c
mov r12d, dword [r14 + 0x2c]
jmp 0x1401a2c6c
cmp esi, 0x201
jne 0x1401a2b90
nop word [rax + rax]
cmp ebx, 0x202
je 0x1401a2ba8
xor r13b, r13b
jmp 0x1401a2c63
cmp esi, 0x204
jne 0x1401a2b88
nop dword [rax + rax]
cmp ebx, 0x205
jne 0x1401a2b88
cmp dword [rsp + 0x40], r15d
je 0x1401a2bc6
mov eax, dword [rsp + 0x50]
mov ecx, 1
test byte [rdi + 0x4c], 1
movzx eax, al
cmovne eax, ecx
mov dword [rsp + 0x50], eax
mov rbx, qword [rdi]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
lea rdx, [rsp + 0x40]
shr eax, 0x10
cwde
mov dword [rsp + 0x40], ecx
mov rcx, rbx
mov dword [rsp + 0x44], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [rbp + 0xd0]
cmp dword [rsp + 0x40], ebx
jne 0x1401a2c3b
mov rax, qword [rsp + 0x40]
mov ecx, dword [rbp + 0xd8]
shr rax, 0x20
cmp eax, ecx
jne 0x1401a2c3b
mov r8d, dword [rsp + 0x48]
cmp esi, 0x201
mov dword [rsp + 0x30], r8d
mov r9d, ecx
setne r15b
mov qword [rsp + 0x28], r13
mov r8d, ebx
mov qword [rsp + 0x20], r14
mov rcx, rdi
lea edx, [r15 + 0xd]
call fcn.1401a4a00
cmp esi, 0x204
sete r13b
cmp byte [rsp + 0x50], 0
jne 0x1401a2cf0
jmp 0x1401a2c69
mov ebx, dword [rbp + 0xd0]
xor r13b, r13b
jmp 0x1401a2c6c
mov r12d, 0xffffffff
mov ebx, dword [rbp + 0xd0]
xor sil, sil
cmp dword [rsp + 0x54], 0
jne 0x1401a2cda
cmp dword [rsp + 0x58], 0
jne 0x1401a2cda
lea rax, ds:[rsp + 0x48]
mov r9d, 4
mov qword [rsp + 0x28], rax
mov r8d, r12d
lea rax, [rsp + 0x40]
mov edx, r12d
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1401a6580
mov r8d, dword ds:[rsp + 0x48]
lea rax, [rbp + 0x50]
mov edx, dword [rsp + 0x40]
mov r9b, 1
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1401a6220
test al, al
je 0x1401a2cda
mov rcx, qword [rbp - 0x80]
lea rdx, [rbp + 0x50]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
test sil, sil
je 0x1401a2cf0
mov r8d, dword [rbp + 0xd8]
mov edx, ebx
mov rcx, rdi
call fcn.1401aaf00
test r13b, r13b
je 0x1401a2d12
mov rbx, qword [rdi]
call qword [sym.imp.USER32.dll_GetMessagePos]
mov r9d, eax
mov r8, rbx
mov edx, 0x7b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, qword [rsp + 0x1c8]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1401e5e40
add rsp, 0x170
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret