Function at 0x14000d88c
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, 0x1f
je 0x14000dacb
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
mov edi, edx
test rcx, rcx
je 0x14000da28
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x14000da28
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r12d, edi
mov cl, 0x80
and r12d, 0x10
je 0x14000d8ef
or byte [rsp + 0x7b], cl
mov r13d, edi
and r13d, 2
je 0x14000d903
mov eax, dword [rbx + 0x30]
or byte [rsp + 0x30], cl
or byte [rsp + rax + 0x20], cl
mov r14d, edi
and r14d, 4
je 0x14000d917
or byte [rsp + 0x30], cl
or byte [rsp + 0xc1], cl
mov esi, edi
and esi, 8
je 0x14000d922
or byte [rsp + 0x31], cl
mov ebp, edi
and ebp, 1
je 0x14000d92d
or byte [rsp + 0x32], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
mov r15d, 0x100
test r12d, r12d
je 0x14000d964
movzx eax, byte [rbx + 0x2d]
mov rcx, qword [rbx + 0x20]
mov r8d, 0x5b
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test r13d, r13d
je 0x14000d988
movzx eax, byte [rbx + 0x2b]
mov r8d, dword [rbx + 0x30]
mov rcx, qword [rbx + 0x20]
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test r14d, r14d
je 0x14000d9ae
movzx eax, byte [rbx + 0x2c]
mov rcx, qword [rbx + 0x20]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test esi, esi
je 0x14000d9d3
movzx eax, byte [rbx + 0x28]
mov rcx, qword [rbx + 0x20]
mov r8d, reloc.WSOCK32.dll_recvfrom
shl eax, 0x10
mov edx, r15d
movsxd r9, eax
or r9, 1
call qword [sym.imp.USER32.dll_PostMessageW]
test ebp, ebp
je 0x14000da9c
test esi, esi
jne 0x14000d9fd
bt edi, 0xb
jb 0x14000d9fd
movzx eax, byte [rbx + 0x29]
mov edx, 0x104
shl eax, 0x10
movsxd r9, eax
or r9, 0x20000001
jmp 0x14000da16
test ebp, ebp
je 0x14000da9c
movzx eax, byte [rbx + 0x29]
mov edx, r15d
shl eax, 0x10
movsxd r9, eax
or r9, 1
mov rcx, qword [rbx + 0x20]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x14000da9c
test dil, 0x10
je 0x14000da3f
mov dl, byte [rbx + 0x2d]
xor r9d, r9d
xor r8d, r8d
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 2
je 0x14000da57
mov dl, byte [rbx + 0x2b]
mov cl, byte [rbx + 0x30]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 4
je 0x14000da6e
mov dl, byte [rbx + 0x2c]
xor r9d, r9d
xor r8d, r8d
mov cl, RegisterTypeLib
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 8
je 0x14000da85
mov dl, byte [rbx + 0x28]
xor r9d, r9d
xor r8d, r8d
mov cl, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_keybd_event]
test dil, 1
je 0x14000da9c
mov dl, byte [rbx + 0x29]
xor r9d, r9d
xor r8d, r8d
mov cl, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
mov edx, dword [rbx + 4]
test edx, edx
je 0x14000daab
mov rcx, rbx
call fcn.14000e654
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret