Function at 0x1400a03d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov eax, 0xa31
mov word [rsp + 0x58], ax
mov byte [rsp + 0x30], 0x28
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xc8], rax
cmp qword [rsp + 0xc8], 0
je 0x1400a0431
movabs rax, 0x29562352831002d3
cmp qword [rsp + 0xc8], rax
je 0x1400a04ec
jmp 0x1400a0580
movabs rax, 0x38352a7489141e56
mov rcx, qword [rsp + 0x1a0]
sub rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x48]
jg 0x1400a04be
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xd0], rax
movabs rax, 0x4d84812777bcada2
cmp qword [rsp + 0xd0], rax
je 0x1400a04ac
movabs rax, 0x7a3254fc003835e7
cmp qword [rsp + 0xd0], rax
je 0x1400a0487
jmp 0x1400a04bc
movabs rax, 0x27fe45f935d9f67a
mov rcx, qword [rsp + 0x1a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
call fcn.14009fa10
nop
jmp 0x1400a04bc
mov ecx, 0x86
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x34], ax
jmp 0x1400a04e7
movabs rax, 0x3ad05d03b93c6476
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0x1a0]
jne 0x1400a04e7
mov eax, 0x1982
mov word [rsp + 0x34], ax
jmp 0x1400a0580
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xd8], rax
movabs rax, 0x38a6b3a941ab1320
cmp qword [rsp + 0xd8], rax
je 0x1400a0523
movabs rax, 0x643abdae9712539f
cmp qword [rsp + 0xd8], rax
je 0x1400a0545
jmp 0x1400a056c
mov rdx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x130]
call qword [sym.imp.USER32.dll_ExcludeUpdateRgn]
mov dword [rsp + 0x50], eax
call fcn.14009fa10
nop
jmp 0x1400a056c
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x50], eax
mov edx, 0xc4
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
mov dword [rsp + 0x60], eax
movsx eax, word [rsp + 0x34]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0x42bf
je 0x1400a059b
jmp 0x1400a05b7
mov rdx, qword [rsp + 0x138]
mov cx, 0x1b
call qword [sym.imp.USER32.dll_VkKeyScanExW]
mov word [rsp + 0x40], ax
jmp 0x1400a0acc
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0
je 0x1400a05d2
cmp dword [rsp + 0x78], 0x67dfe76a
je 0x1400a0615
jmp 0x1400a0623
lea rax, [rsp + 0x44]
mov qword [rsp + 0x80], rax
movzx eax, byte [rsp + 0x30]
sar eax, 7
mov byte [rsp + 0x30], al
mov eax, dword [section..data]
mov dword [rsp + 0x5c], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov eax, 0xa6c
mov word [rsp + 0x3c], ax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x68], rax
jmp 0x1400a0623
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov dword [rsp + 0x50], eax
mov rax, qword [rsp + 0x68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x34]
or eax, ecx
movsx ecx, word [rsp + 0x40]
cmp eax, ecx
jle 0x1400a072b
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0xe0], rax
movabs rax, 0x61e3d51700f45983
cmp qword [rsp + 0xe0], rax
je 0x1400a0680
movabs rax, 0x7783c4847629eb5b
cmp qword [rsp + 0xe0], rax
je 0x1400a0715
jmp 0x1400a0729
movzx eax, byte [rsp + 0x30]
and eax, 0x18
mov rcx, qword [rsp + 0x70]
movzx ecx, byte [rcx]
cmp eax, ecx
jl 0x1400a0713
movzx eax, byte [rsp + 0x30]
sub eax, 0x87
mov rcx, qword [rsp + 0x70]
mov byte [rcx], al
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_SetFocus]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x30]
add eax, ecx
mov rcx, qword [rsp + 0x70]
mov byte [rcx], al
mov dword [rsp + 0x28], 0xd
mov dword [rsp + 0x20], 0x68
lea r9, [rsp + 0x110]
lea r8, [rsp + 0x5c]
mov edx, 0xab
mov ecx, 0x3a
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [rsp + 0x8c], eax
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x1a8], eax
jmp 0x1400a0729
movsx eax, word [rsp + 0x40]
movsx ecx, word [rsp + 0x34]
sub eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
jmp 0x1400a079b
lea rax, [rsp + 0x3c]
mov qword [rsp + 0xb8], rax
movsx eax, word [rsp + 0x34]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0
je 0x1400a0750
jmp 0x1400a077e
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x54], ax
lea rax, [rsp + 0x30]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0xa0], rax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x7c], eax
jmp 0x1400a079b
lea rdx, str.Killed_tropospheric_interrogator_Obscureness
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_RemovePropW]
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x100], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x118], rax
cmp qword [rsp + 0x118], 0
je 0x1400a07c2
jmp 0x1400a07fa
movabs rax, 0x5184a07be0679d6b
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0x39], 0x5b
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax]
mov byte [rsp + 0x38], al
lea rax, [rsp + 0x3c]
mov qword [rsp + 0xf8], rax
jmp 0x1400a08ba
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xf0], rax
movabs rax, 0x42209979eb47e550
cmp qword [rsp + 0xf0], rax
je 0x1400a0837
movabs rax, 0x67831e130a0cba26
cmp qword [rsp + 0xf0], rax
je 0x1400a089b
jmp 0x1400a08ba
mov rax, qword [rsp + 0x68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
add eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
mov rax, qword [rsp + 0xb8]
movzx eax, word [rax]
mov rcx, qword [rsp + 0xf8]
movzx ecx, word [rcx]
sar eax, cl
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x20], 1
mov r9d, 0x6e
mov r8d, 0x4a
mov edx, 0x62
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_SetScrollRange]
mov dword [rsp + 0x108], eax
jmp 0x1400a08ba
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov ecx, dword [rsp + 0x1a8]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0xa0]
mov dword [rcx], eax
movsx eax, byte [rsp + 0x39]
cmp eax, 0x10
jl 0x1400a09dc
movabs rax, 0x48e25708138a47e8
cmp qword [rsp + 0xb0], rax
jne 0x1400a0915
xor r8d, r8d
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.USER32.dll_UserHandleGrantAccess]
mov dword [rsp + 0x98], eax
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax]
mov rcx, qword [rsp + 0xc0]
movzx ecx, byte [rcx]
and eax, ecx
mov byte [rsp + 0x38], al
movzx eax, byte [rsp + 0x39]
mov byte [rsp + 0x94], al
cmp byte [rsp + 0x94], 0x44
je 0x1400a092d
jmp 0x1400a0962
movzx eax, word [rsp + 0x3c]
mov rcx, qword [rsp + 0xb8]
movzx ecx, word [rcx]
sub eax, ecx
mov rcx, qword [rsp + 0xf8]
mov word [rcx], ax
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.USER32.dll_SetFocus]
mov qword [rsp + 0x158], rax
jmp 0x1400a0989
lea rax, [rsp + 0x44]
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0xb8]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x3c]
add eax, ecx
mov word [rsp + 0x58], ax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x180], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x68]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
jmp 0x1400a0a67
mov rax, qword [rsp + 0x80]
mov eax, dword [rax]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x120], rcx
movzx ecx, al
mov rax, qword [rsp + 0x120]
mov eax, dword [rax]
shl eax, cl
mov ecx, dword [rsp + 0x1a8]
mov edx, dword [rsp + 0x44]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jle 0x1400a0a67
mov rax, qword [rsp + 0x68]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x34]
sub eax, ecx
mov rcx, qword [rsp + 0x68]
mov word [rcx], ax
mov edx, dword [rsp + 0x60]
mov rax, qword [rsp + 0x100]
mov rcx, qword [rax]
call fcn.1400a03d0
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x1a8], eax
mov rax, qword [rsp + 0xc0]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x38]
add eax, ecx
mov rcx, qword [rsp + 0x70]
mov byte [rcx], al
mov rax, qword [rsp + 0x100]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1a0]
and rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xa0]
mov ecx, dword [rcx]
mov eax, dword [rax]
sub eax, ecx
mov rcx, qword [rsp + 0x80]
mov dword [rcx], eax
mov eax, dword [section..data]
mov ecx, dword [rsp + 0x7c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x5c], eax
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.USER32.dll_IsWindow]
mov dword [rsp + 0x10c], eax
mov rax, qword [rsp + 0x1a0]
shl rax, 0x16
cmp rax, qword [rsp + 0x48]
jle 0x1400a0b37
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x1a0]
call fcn.1400a03d0
mov eax, 0xc4a
mov word [rsp + 0x34], ax
mov cx, 0xd4
call qword [sym.imp.USER32.dll_IsCharAlphaW]
mov dword [rsp + 0x98], eax
mov cl, 0xc7
call fcn.14009fbf0
movabs rax, 0x6f25e96394dff2d3
mov rcx, qword [rsp + 0x1a0]
xor rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov cl, 0x26
call fcn.1400a0b80
nop
mov eax, 0x2c32
mov word [rsp + 0x34], ax
xor r9d, r9d
mov r8d, 0xda
mov edx, 0x73
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.USER32.dll_SetScrollPos]
mov dword [rsp + 0x60], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x1a8], eax
mov eax, 0xfb
add rsp, 0x198
ret