Function at 0x140150320
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
cmp byte [0x14056ad2c], 0
je 0x140150493
mov dword [rsp + 0x20], 0
xor edi, edi
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140150489
mov dword [rsp + 0x20], 1
xor edi, edi
lea rcx, [rsp + 0x30]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x140150489
test rsi, rsi
je 0x140150390
cmp dword [rsp + 0x38], 0x12
jne 0x140150390
mov byte [rsi], 1
lea rcx, [rsp + 0x30]
call fcn.140150190
call fcn.140137f80
call fcn.14011daa0
mov al, byte [0x14056a310]
test al, al
je 0x1401505bc
mov rax, qword [0x1405698b0]
test rax, rax
je 0x1401503e7
mov rdx, qword [rax]
test rdx, rdx
je 0x1401503e7
mov rax, qword [rdx - 8]
add rdx, 0xfffffffffffffff8
lea rcx, [rsp + 0x28]
call qword [rax + 0x188]
cmp dword [rsp + 0x28], 0x80000000
jne 0x140150513
xor esi, esi
mov rax, qword [0x14056a308]
test rax, rax
je 0x14015043a
mov rcx, qword [rax]
lea rax, [rcx - 8]
test rcx, rcx
cmove rax, rcx
cmp rax, rsi
je 0x14015046f
test rcx, rcx
je 0x14015043a
mov rax, qword [rcx + 0x28]
mov cl, byte [rcx + 0x53]
test cl, 0x40
jne 0x14015041e
test rax, rax
jne 0x14015043a
test cl, 0x40
je 0x14015043a
test rax, rax
je 0x14015043a
mov rcx, qword [rax]
test rcx, rcx
je 0x14015043a
xor edx, edx
xor r8d, r8d
call sub.IMM32.dll_ImmAssociateContextEx
test rsi, rsi
je 0x14015046f
mov rax, qword [rsi + 0x30]
mov cl, byte [rsi + 0x5b]
test cl, 0x40
jne 0x140150450
test rax, rax
jne 0x14015046f
test cl, 0x40
je 0x14015046f
test rax, rax
je 0x14015046f
mov rcx, qword [rax]
test rcx, rcx
je 0x14015046f
xor edx, edx
mov r8d, 0x10
call sub.IMM32.dll_ImmAssociateContextEx
lea rdx, [rsi + 8]
test rsi, rsi
cmove rdx, rsi
lea rcx, [0x14056a308]
call fcn.1402bc100
mov dil, 1
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov bl, byte [0x140569849]
mov byte [0x140569849], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bl
test ax, ax
js 0x140150337
cmp byte [0x140569bb4], 0
jne 0x140150337
mov byte [0x140569849], 0
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bl
test ax, ax
js 0x140150337
mov byte [0x140569849], 0
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
mov byte [0x140569849], bl
test ax, ax
js 0x140150337
call fcn.1401351f0
jmp 0x140150337
mov rax, qword [0x1405698b0]
test rax, rax
je 0x14015052f
mov rax, qword [rax]
lea rdi, [rax - 8]
test rax, rax
cmove rdi, rax
jmp 0x140150531
xor edi, edi
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov ecx, dword [rax + 8]
lea edx, [rcx + 1]
mov dword [rax + 8], edx
test ecx, ecx
jne 0x140150570
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
nop dword [rax]
mov rsi, rdi
test byte [rdi + 0x5b], 0x40
jne 0x140150582
mov rdi, qword [rsi + 0x30]
test rdi, rdi
jne 0x140150570
mov eax, dword [0x140601e88]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
add dword [rax + 8], 0xffffffff
jne 0x1401503e9
lea rcx, [0x140569688]
call fcn.1400f4fe0
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
jmp 0x1401503e9
lea rcx, [0x14056a310]
call fcn.14035f9c4
test eax, eax
je 0x1401503b2
mov qword [0x14056a308], 0
lea rcx, [0x14013dfd0]
call fcn.140001440
lea rcx, [0x14056a310]
call fcn.14035fa9b
jmp 0x1401503b2