Function at 0x1400a7fd0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
movzx eax, word [rdx + 0x18]
mov rbx, rcx
cmp eax, 0x2e
je 0x1400a7d2a
cmp eax, 0x43
je 0x1400a7cee
cmp eax, 0x56
je 0x1400a7cb3
cmp eax, 0x58
jne 0x1400a7d4a
lea ecx, [rax - 0x47]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400a7d4a
xor edx, edx
mov rcx, rbx
call fcn.1400a72c0
jmp 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400a7d4a
mov rcx, rbx
call fcn.1400a6d10
jmp 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILClone
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1400a7d4a
mov edx, 1
mov rcx, rbx
call fcn.1400a72c0
jmp 0x1400a7d4a
mov ecx, reloc.SHELL32.dll_ILFindLastID
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rbx
test al, al
jns 0x1400a7d43
mov edx, 1
jmp 0x1400a7d45
xor edx, edx
call fcn.1400a6810
mov ecx, reloc.SHELL32.dll_ILRemoveLastID
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 0x80
mov eax, 0
setne al
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x40
mov eax, dword [rdx + 0x10]
mov rbx, rcx
cmp eax, 0xfffffe64
ja 0x1400a8078
je 0x1400a806e
add eax, 0x1cc
cmp eax, 9
ja case.0x1400a800d.458
lea r8, [0x140000000]
mov ecx, dword [r8 + rax*4 + 0xa80f8]
add rcx, r8
jmp rcx
mov rcx, rbx
call fcn.1400a7e60
cdqe
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call int.1400a6650
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400a65d0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400a6ee0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, qword [rbx + 0x98]
xor r8d, r8d
mov r9, rdx
lea edx, [r8 + 0x4e]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
add rsp, 0x40
pop rbx
ret
add rsp, 0x40
pop rbx
jmp 0x1400a7c40
cmp eax, 0xfffffffb
jne case.0x1400a800d.458
mov rax, qword [rcx + 0x98]
cmp qword [rdx], rax
jne case.0x1400a800d.458
call qword [sym.imp.USER32.dll_GetMessagePos]
lea rdx, [rsp + 0x20]
movsx ecx, ax
shr eax, 0x10
cwde
mov dword [rsp + 0x58], ecx
mov rcx, qword [rbx + 0x98]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, qword [rbx + 0x98]
lea r9, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x1111
call qword [sym.imp.USER32.dll_SendMessageW]
test byte [rsp + 0x28], 1
jne case.0x1400a800d.458
mov rdx, qword [rsp + 0x30]
lea r8, [rsp + 0x58]
mov rcx, rbx
call fcn.1400a7900
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, r8d
mov rbx, r9
mov edi, r8d
sub eax, 0x4e
mov rsi, rdx
je 0x1400a81a6
sub eax, 0xc3
je 0x1400a8182
cmp eax, 2
jne 0x1400a8161
call fcn.1400a7d70
mov r9, qword [rsp + 0x50]
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140001a50
mov eax, 0x1770
cmp bx, ax
jne 0x1400a8191
call fcn.1400a3ee0
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x1400a7fd0