Function at 0x1400d9850
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rsi, rdx
mov rdi, rcx
call fcn.1400d2d10
cmp dword [rsi + 8], 0x204
jne 0x1400d47a3
mov rdx, rsi
lea rcx, [rdi + 0x14a0]
call fcn.1400b9e60
test eax, eax
je 0x1400d47a3
lea rcx, [rdi + 0x14a0]
call fcn.1400bd8c0
xor eax, eax
jmp 0x1400d4c5d
mov eax, dword [rsi + 8]
cmp eax, 0x100
jne 0x1400d4a9b
lea rbx, [rdi + 0x14a0]
mov rdx, rsi
mov rcx, rbx
call fcn.1400b9e60
test eax, eax
je 0x1400d48ec
mov rax, qword [rsi + 0x10]
cmp rax, 0x5d
jne 0x1400d47e4
mov rcx, rbx
call fcn.1400bd8c0
xor eax, eax
jmp 0x1400d4c5d
cmp rax, 0x2e
jne 0x1400d4809
mov rcx, rbx
call fcn.1400b9ac0
test eax, eax
je 0x1400d4b3f
mov rcx, rbx
call fcn.1400b7f30
xor eax, eax
jmp 0x1400d4c5d
cmp rax, 0xd
je 0x1400d479c
cmp rax, 9
jne 0x1400d4825
mov rdx, rsi
mov rcx, rbx
call fcn.1400b8cd0
jmp 0x1400d4c5d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400d4b3f
mov rax, qword [rsi + 0x10]
cmp rax, 0x43
je 0x1400d48ba
cmp rax, 0x56
je 0x1400d4859
cmp rax, 0x63
je 0x1400d48ba
cmp rax, 0x76
jne 0x1400d4b3f
mov rcx, rbx
call fcn.1400b9ac0
test eax, eax
je 0x1400d4b3f
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400d4b3f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
test rbx, rbx
je 0x1400d4b3f
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x802b
mov rcx, qword [rdi + 0x14b0]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x1400d4c5d
mov rcx, rbx
call fcn.1400b9bf0
test eax, eax
je 0x1400d4b3f
xor r9d, r9d
mov edx, VarUI4FromDisp
mov r8d, 0x802a
mov rcx, qword [rdi + 0x14b0]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x1400d4c5d
lea rcx, [rdi + 0x840]
mov rdx, rsi
call fcn.1400af600
test eax, eax
je 0x1400d4951
lea rcx, [rdi + 0x2360]
mov dword [rcx], 0
mov r8d, 2
lea rdx, [rsp + 0x28]
call fcn.1400d0720
nop
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
cmp rdx, 5
jb 0x1400d4937
lea rcx, str.invalid_bitset_N__position
call fcn.1400dcdb0
int3
mov rax, rdx
shr rax, 5
lea rcx, [rcx + rax*4]
and edx, 0x1f
mov eax, dword [rcx]
bts eax, edx
mov dword [rcx], eax
jmp 0x1400d4b3f
mov rcx, qword [rdi + 0x390]
cmp qword [rsi], rcx
jne 0x1400d4b3f
mov rax, qword [rsi + 0x10]
cmp rax, 0xd
je 0x1400d4a2e
cmp rax, 0x20
je 0x1400d4a2e
cmp rax, 9
jne 0x1400d4b3f
and dword [rdi + 0x400], 0xfffffffe
xor edx, edx
lea r8d, [rax - 8]
call qword [sym.imp.USER32.dll_InvalidateRect]
lea rcx, [rdi + 0x2360]
lea rdx, [rsp + 0x28]
cmp dword [rdi + 0x2394], 0
mov dword [rcx], 0
je 0x1400d49ee
xor r8d, r8d
call fcn.1400d0720
nop
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
cmp rdx, 5
jb 0x1400d49d4
lea rcx, str.invalid_bitset_N__position
call fcn.1400dcdb0
int3
mov rax, rdx
shr rax, 5
lea rcx, [rcx + rax*4]
and edx, 0x1f
mov eax, dword [rcx]
bts eax, edx
mov dword [rcx], eax
jmp 0x1400d4b3f
mov r8d, 2
call fcn.1400d0720
nop
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
cmp rdx, 5
jb 0x1400d4a14
lea rcx, str.invalid_bitset_N__position
call fcn.1400dcdb0
int3
mov rax, rdx
shr rax, 5
lea rcx, [rcx + rax*4]
and edx, 0x1f
mov eax, dword [rcx]
bts eax, edx
mov dword [rcx], eax
jmp 0x1400d4b3f
and dword [rdi + 0x400], 0xfffffffe
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, rdi
call fcn.1400d2420
lea rcx, [rdi + 0x2360]
mov dword [rcx], 0
mov r8d, 2
lea rdx, [rsp + 0x28]
call fcn.1400d0720
nop
mov rdx, qword [rax + 8]
mov rcx, qword [rax]
cmp rdx, 5
jb 0x1400d4a81
lea rcx, str.invalid_bitset_N__position
call fcn.1400dcdb0
int3
mov rax, rdx
shr rax, 5
lea rcx, [rcx + rax*4]
and edx, 0x1f
mov eax, dword [rcx]
bts eax, edx
mov dword [rcx], eax
jmp 0x1400d4b3f
cmp eax, 0x104
jne 0x1400d4b3f
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400d4b3f
mov rax, qword [rsi + 0x10]
sub rax, 0x24
je 0x1400d4b15
sub rax, 1
je 0x1400d4aff
sub rax, 2
je 0x1400d4ae9
sub rax, 0x1e
je 0x1400d4adc
cmp rax, 0x20
jne 0x1400d4b3f
mov rcx, rdi
call fcn.1400d2420
jmp 0x1400d4c58
lea rcx, [rdi + 0x14a0]
mov edx, 1
call fcn.1400b8bb0
jmp 0x1400d4c58
lea rcx, [rdi + 0x14a0]
mov edx, 1
call fcn.1400b8a90
jmp 0x1400d4c58
mov r8d, 3
mov word [rsp + 0x28], r8w
mov dword [rsp + 0x30], 0
lea rcx, [rdi + 0x14a0]
lea rdx, [rsp + 0x28]
call fcn.1400bcf30
jmp 0x1400d4c58
xor r8d, r8d
lea rdx, [rsp + 0x28]
lea rcx, [rdi + 0x2360]
call fcn.1400d0720
nop
mov rdx, qword [rax + 8]
mov r8, qword [rax]
cmp rdx, 5
jb 0x1400d4b6e
lea rcx, str.invalid_bitset_N__position
call fcn.1400dcdb0
nop
movzx eax, dl
and al, 0x1f
movzx ecx, al
shr rdx, 5
mov eax, dword [r8 + rdx*4]
bt eax, ecx
jae 0x1400d4b97
lea rcx, [rdi + 0xaa0]
mov rdx, rsi
call fcn.1400c5e00
jmp 0x1400d4c5d
mov r8d, 1
lea rdx, [rsp + 0x28]
lea rcx, [rdi + 0x2360]
call fcn.1400d0720
nop
mov rdx, qword [rax + 8]
mov r8, qword [rax]
cmp rdx, 5
jb 0x1400d4bc9
lea rcx, str.invalid_bitset_N__position
call fcn.1400dcdb0
nop
movzx eax, dl
and al, 0x1f
movzx ecx, al
shr rdx, 5
mov eax, dword [r8 + rdx*4]
bt eax, ecx
jae 0x1400d4bf0
lea rcx, [rdi + 0x14a0]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x18]
jmp 0x1400d4c5d
mov r8d, 2
lea rdx, [rsp + 0x28]
lea rcx, [rdi + 0x2360]
call fcn.1400d0720
mov rcx, rax
call fcn.1400d0730
cmp al, 1
jne 0x1400d4c24
lea rcx, [rdi + 0x840]
mov rdx, rsi
call fcn.1400b0440
jmp 0x1400d4c5d
mov r8d, 3
lea rdx, [rsp + 0x28]
lea rcx, [rdi + 0x2360]
call fcn.1400d0720
mov rcx, rax
call fcn.1400d0730
cmp al, 1
jne 0x1400d4c58
lea rcx, [rdi + 0x1908]
mov rdx, rsi
call fcn.1400ab880
jmp 0x1400d4c5d
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rcx - 8]
test rdx, rdx
je 0x1400d988a
mov rcx, qword [rcx - 0x60]
mov r8, rdi
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
je 0x1400d988a
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0x38]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1400d4750