Function at 0x1401fa310
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [rcx]
mov rdi, rdx
mov rsi, rcx
call qword [rax + 0x150]
test al, al
jne 0x1401fa35c
mov ecx, dword [rdi]
lea eax, [rcx - 0x13]
cmp eax, 0x12
jbe 0x1401fa33c
lea eax, [rcx - 1]
cmp eax, 2
ja 0x1401fa35c
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1401fab6c
mov rax, qword [rcx]
mov rdx, rdi
add rsp, 0x68
pop rdi
pop rsi
jmp qword [rax + 0x238]
mov eax, dword [rdi]
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rbp
mov qword [rsp + 0x58], r14
cmp eax, 0x35
jne 0x1401fa4d8
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x128]
test al, al
je 0x1401fa4ba
cmp qword [rsi + 0x890], 0
je 0x1401fa4ba
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x7e0]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fa3ea
cmp dword [rsi + 0x4f4], eax
jne 0x1401fa3cf
mov edx, 0x7f03
jmp 0x1401fa496
mov rcx, qword [rsi + 0x9c0]
test rcx, rcx
je 0x1401fab57
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x1401fab57
movzx eax, byte [rsi + 0x7b9]
test al, al
je 0x1401fa4ba
mov ecx, dword [rsi + 0x7f4]
mov eax, dword [rsi + 0x84c]
mov edx, dword [rsi + 0x840]
add edx, dword [rsi + 0x83c]
add edx, dword [rsi + 0x7e8]
lea r8d, [rax + rcx*2]
add edx, ecx
add r8d, dword [rsi + 0x848]
movzx eax, byte [rsi + 0x7ba]
test al, al
jne 0x1401fa43e
mov eax, dword [rsi + 0x848]
add eax, dword [rsi + 0x7f4]
add r8d, eax
mov r9d, dword [rdi + 0x14]
cmp r9d, edx
jl 0x1401fa4ac
mov ecx, dword [rsi + 0x7f0]
add ecx, edx
cmp r9d, ecx
jge 0x1401fa4ac
mov ecx, dword [rdi + 0x18]
mov edx, dword [rsi + 0x7e4]
cmp ecx, edx
jl 0x1401fa4ac
mov eax, r8d
imul eax, dword [rsi + 0x880]
add eax, edx
cmp ecx, eax
jge 0x1401fa4ac
sub ecx, edx
mov eax, ecx
cdq
idiv r8d
test edx, edx
js 0x1401fa4ac
cmp edx, dword [rsi + 0x7f4]
jge 0x1401fa4ac
mov eax, ecx
cdq
idiv r8d
mov edx, 0x7f89
mov dword [0x1404b0424], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x1401fab57
mov r8, 0xffffffffffffffff
mov dword [0x1404b0424], r8d
mov rcx, qword [rsi + 0x38]
test rcx, rcx
je 0x1401fab57
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x238]
jmp 0x1401fab57
cmp eax, 5
jne 0x1401fa4e9
mov byte [rsi + 0x16a], 1
jmp 0x1401fab57
cmp eax, 6
jne 0x1401fa4fa
mov byte [rsi + 0x16a], 0
jmp 0x1401fab57
cmp eax, 4
jne 0x1401fa590
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x128]
test al, al
je 0x1401fa590
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0xd0]
test al, al
je 0x1401fa4ba
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x578]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fa547
xor r9d, r9d
jmp 0x1401fa570
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x600]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fab57
mov r9d, 1
mov rax, qword [rdi + 0x28]
mov r8d, reloc.SinoSPE.dll_Ordinal_32
mov rcx, qword [rsi + 0x30]
mov rdx, rsi
mov qword [rsp + 0x20], rax
call fcn.1401b7bb0
jmp 0x1401fab57
mov eax, dword [rdi]
cmp eax, 0x17
je 0x1401fac65
cmp eax, 0x2d
jne 0x1401fa6bb
cmp byte [rsi + 0x170], 0
jne 0x1401fac65
cmp eax, 0x21
jne 0x1401fab73
mov rax, qword [rsi]
mov rcx, rsi
mov qword [rsp + 0x60], r12
mov r12d, dword [rdi + 0x20]
call qword [rax + 0x128]
test al, al
je 0x1401fab52
cmp qword [rsi + 0x890], 0
je 0x1401fab52
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x7e0]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fab52
mov rax, qword [rsi + 0x850]
movaps xmmword [rsp + 0x30], xmm7
movss xmm7, dword [0x140452cd0]
cmp rax, 2
jle 0x1401fa627
test r12d, r12d
jg 0x1401fa641
movss xmm0, dword [rsi + 0x87c]
comiss xmm7, xmm0
jbe 0x1401fab4d
test r12d, r12d
jns 0x1401fab4d
mov qword [rsp + 0x50], r15
mov ecx, reloc.SinoSPE.dll_Ordinal_17
movaps xmmword [rsp + 0x40], xmm6
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x80
mov ecx, reloc.SinoSPE.dll_Ordinal_16
movzx ebp, ax
and bp, bx
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetUBound
and r14w, bx
call qword [sym.imp.USER32.dll_GetKeyState]
movd xmm1, r12d
xorps xmm0, xmm0
cvtdq2pd xmm1, xmm1
movzx r15d, ax
and r15w, bx
comisd xmm1, xmm0
jbe 0x1401faa05
test bp, bp
je 0x1401fa9f3
movsd xmm0, qword [0x140452d20]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
jmp 0x1401faa4a
cmp eax, 0x18
je 0x1401fa6d2
cmp eax, 0x2f
jne 0x1401fa6de
cmp byte [rsi + 0x170], 0
je 0x1401fa5b1
mov byte [0x1404c7ae8], 0
jmp 0x1401fab57
cmp eax, 0x16
jne 0x1401fa7c0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x128]
test al, al
je 0x1401fab57
cmp qword [rsi + 0x890], 0
je 0x1401fab57
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x7e0]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fab57
cmp byte [0x1404c7ae8], 0
je 0x1401fab57
lea rcx, [rsi + 0x9c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rdi + 0x14]
lea rcx, [rsi + 0x9c8]
sub eax, dword [0x1404c7ae0]
mov r8, 0xffffffffffffffff
add dword [rsi + 0x500], eax
mov dword [rsi + 0x508], r8d
mov eax, dword [rdi + 0x18]
sub eax, dword [0x1404c7ae4]
add dword [rsi + 0x588], eax
mov dword [rsi + 0x590], r8d
mov eax, dword [rdi + 0x18]
sub eax, dword [0x1404c7ae4]
add dword [rsi + 0x610], eax
mov dword [rsi + 0x618], r8d
mov byte [rsi + 0x7bb], 0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi + 0x14]
mov rcx, qword [rsi + 0xa68]
mov qword [0x1404c7ae0], rax
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401fab57
cmp eax, 0x19
jne 0x1401fa873
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x128]
test al, al
je 0x1401fab57
cmp qword [rsi + 0x890], 0
je 0x1401fab57
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x7e0]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fab57
mov rax, qword [rsi + 0x960]
mov byte [0x1404c7ae8], 0
test rax, rax
je 0x1401fab57
mov rax, qword [rax + 0x78]
cmp qword [rax], 2
jl 0x1401fab57
lea rcx, [rsi + 0x9f0]
mov dword [rsi + 0x4f4], 1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rsi + 0x968], 0xfffffffffffffffe
lea rcx, [rsi + 0x9f0]
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x984], eax
mov eax, dword [rdi + 0x18]
mov dword [rsi + 0x988], eax
jmp 0x1401fa92f
cmp eax, 1
jne 0x1401fa947
mov rax, qword [rsi]
xor ebp, ebp
mov rcx, rsi
mov dword [rsi + 0x4f4], ebp
call qword [rax + 0x128]
test al, al
je 0x1401fab57
cmp qword [rsi + 0x890], rbp
je 0x1401fab57
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x7e0]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fab57
lea rcx, [rsi + 0x9c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r8, 0xffffffffffffffff
mov dword [rsi + 0x500], ebp
mov dword [rsi + 0x508], r8d
lea rcx, [rsi + 0x9c8]
mov dword [rsi + 0x590], r8d
mov dword [rsi + 0x618], r8d
mov dword [rsi + 0x504], 0x3f800000
mov dword [rsi + 0x588], ebp
mov dword [rsi + 0x58c], 0x3f800000
mov dword [rsi + 0x610], ebp
mov dword [rsi + 0x614], 0x3f800000
mov byte [rsi + 0x7bb], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401fab57
cmp eax, 2
jne 0x1401fa5b1
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x128]
test al, al
je 0x1401fab57
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x7e0]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401fab57
cmp qword [rsi + 0x968], 0
jl 0x1401fab57
mov r8, 0xffffffffffffffff
mov qword [rsi + 0x968], r8
mov dword [rsi + 0x970], r8d
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x9c0]
xor ebp, ebp
mov dword [rsi + 0x4f4], ebp
test rcx, rcx
je 0x1401fa9d1
call qword [sym.imp.USER32.dll_SetCursor]
mov rcx, qword [rsi + 0x30]
xor r9d, r9d
movsxd r8, dword [rsi + 0x4f0]
mov edx, 0x5f5
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1401fab57
movsd xmm0, qword [0x140452d28]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
jmp 0x1401faa4a
comisd xmm0, xmm1
jbe 0x1401faa42
test bp, bp
je 0x1401faa29
movsd xmm0, qword [0x140452d60]
xorps xmm1, xmmword [0x1404531c0]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
jmp 0x1401faa4a
movsd xmm0, qword [0x140452d58]
xorps xmm1, xmmword [0x1404531c0]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
jmp 0x1401faa4a
movsd xmm6, qword [0x140452d48]
lea rcx, [rsi + 0x9c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebp, ebp
mov dword [rsi + 0x500], ebp
mov dword [rsi + 0x588], ebp
mov dword [rsi + 0x610], ebp
mov byte [rsi + 0x7bb], bpl
test r15w, r15w
je 0x1401faa7e
test r14w, r14w
je 0x1401faa89
mov eax, dword [rsi + 0x4f8]
cmp eax, 1
jne 0x1401faaa9
mov eax, dword [rdi + 0x14]
mov r8, 0xffffffffffffffff
mov dword [rsi + 0x590], r8d
movaps xmm0, xmm7
mov dword [rsi + 0x508], eax
cvtsd2ss xmm6, xmm6
jmp 0x1401faaf7
test r14w, r14w
je 0x1401faab5
test r15w, r15w
je 0x1401faaba
cmp eax, 2
jne 0x1401faada
mov dword [rsi + 0x508], 0xffffffff
mov eax, dword [rdi + 0x18]
cvtsd2ss xmm6, xmm6
mov dword [rsi + 0x590], eax
mov r8d, dword [rdi + 0x18]
movaps xmm0, xmm6
jmp 0x1401faafa
mov eax, dword [rdi + 0x14]
mov dword [rsi + 0x508], eax
mov eax, dword [rdi + 0x18]
cvtsd2ss xmm6, xmm6
mov dword [rsi + 0x590], eax
mov r8d, dword [rdi + 0x18]
movaps xmm0, xmm6
movaps xmm7, xmm6
mov dword [rsi + 0x618], r8d
lea rcx, [rsi + 0x9c8]
movss dword [rsi + 0x504], xmm7
movss dword [rsi + 0x58c], xmm0
movss dword [rsi + 0x614], xmm0
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mulss xmm6, dword [rsi + 0x87c]
movss dword [rsi + 0x87c], xmm6
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
movaps xmm6, xmmword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x30]
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov r14, qword [rsp + 0x58]
add rsp, 0x68
pop rdi
pop rsi
ret
cmp eax, 0xd
jne 0x1401fa4ba
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x128]
test al, al
je 0x1401fab57
cmp qword [rsi + 0x968], 0
jl 0x1401fab57
mov ecx, reloc.SinoSPE.dll_Ordinal_17
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edx, ax
mov ebx, 0x80
movzx eax, word [rdi + 0x1c]
and dx, bx
cmp ax, 0x25
je 0x1401fac06
cmp ax, 0x27
jne 0x1401fab57
test dx, dx
mov ecx, 1
mov eax, 5
cmove eax, ecx
add qword [rsi + 0x968], rax
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x30]
mov edx, 0x5f4
movsxd r8, dword [rsi + 0x4f0]
mov r9, qword [rsi + 0x968]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1401fab57
mov rcx, qword [rsi + 0x968]
test dx, dx
je 0x1401fac22
xor ebp, ebp
lea rax, [rcx - 5]
cmp rcx, 5
cmovl rax, rbp
jmp 0x1401fac2b
test rcx, rcx
jle 0x1401fac32
lea rax, [rcx - 1]
mov qword [rsi + 0x968], rax
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0x30]
mov edx, 0x5f4
movsxd r8, dword [rsi + 0x4f0]
mov r9, qword [rsi + 0x968]
mov rcx, qword [rcx + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1401fab57
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x128]
test al, al
je 0x1401fab57
cmp qword [rsi + 0x890], 0
je 0x1401fab57
mov edx, dword [rdi + 0x18]
lea rcx, [rsi + 0x7e0]
mov eax, dword [rdi + 0x14]
shl rdx, 0x20
or rdx, rax
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
jne 0x1401facd7
mov rcx, qword [rsi + 0x9b8]
xor ebp, ebp
mov dword [rsi + 0x4f4], ebp
test rcx, rcx
je 0x1401facc0
call qword [sym.imp.USER32.dll_SetCursor]
mov rax, qword [rdi + 0x14]
mov qword [0x1404c7ae0], rax
mov byte [0x1404c7ae8], 1
jmp 0x1401fab57
movzx eax, byte [rsi + 0x7b9]
test al, al
je 0x1401fab57
mov r8d, dword [0x1404b0424]
test r8d, r8d
js 0x1401fab57
mov rcx, qword [rsi + 0x898]
xor ebp, ebp
mov edx, ebp
mov rax, qword [rcx]
cmp rax, rcx
je 0x1401fab57
nop dword [rax]
cmp byte [rax + 0x50], bpl
je 0x1401fad1d
cmp edx, r8d
jge 0x1401fad2a
inc edx
mov rax, qword [rax]
cmp rax, rcx
jne 0x1401fad10
jmp 0x1401fab57
mov rbx, qword [rax + 0x10]
test rbx, rbx
js 0x1401fab57
cmp qword [rsi + 0x960], rbp
je 0x1401fab57
mov byte [rsi + 0x7bb], 1
mov byte [rsi + 0x7bc], 1
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0xa78]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1401faf42
mov rcx, qword [rsi + 0x960]
mov rax, qword [rcx + 0x68]
movss xmm3, dword [rax]
mulss xmm3, dword [rsi + 0x860]
mov rax, qword [rcx + 0x58]
movss xmm2, dword [rax]
mov rax, qword [rcx + 0x48]
movaps xmm1, xmm2
addss xmm1, xmm3
subss xmm3, xmm2
mulss xmm1, dword [0x140452c60]
subss xmm1, dword [rax + rbx*4]
mov eax, dword [rsi + 0x7e8]
sub eax, dword [rsi + 0x7e0]
movd xmm0, eax
mov rax, qword [rcx + 0x70]
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm0
divss xmm1, xmm3
movss xmm3, dword [rax]
mov rax, qword [rcx + 0x60]
mulss xmm3, dword [rsi + 0x864]
cvttss2si edi, xmm1
movss xmm2, dword [rax]
mov rax, qword [rcx + 0x50]
movaps xmm0, xmm2
addss xmm0, xmm3
subss xmm3, xmm2
lea rcx, [rsi + 0x9c8]
movss xmm1, dword [rax + rbx*4]
mov eax, dword [rsi + 0x7ec]
mulss xmm0, dword [0x140452c60]
sub eax, dword [rsi + 0x7e4]
subss xmm1, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
mulss xmm1, xmm0
divss xmm1, xmm3
cvttss2si ebx, xmm1
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add dword [rsi + 0x500], edi
lea rcx, [rsi + 0x9c8]
add dword [rsi + 0x588], ebx
mov r8, 0xffffffffffffffff
mov dword [rsi + 0x508], r8d
mov dword [rsi + 0x590], r8d
mov dword [rsi + 0x618], r8d
mov byte [rsi + 0x7bb], bpl
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsi + 0x7bc], 1
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rsi + 0xa78]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1401faf42
lea rcx, [rsi + 0x9c8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [rsi + 0x7e0]
lea rcx, [rsi + 0x9c8]
add eax, dword [rsi + 0x7e8]
cdq
mov dword [rsi + 0x500], ebp
sub eax, edx
mov dword [rsi + 0x588], ebp
sar eax, 1
mov dword [rsi + 0x508], eax
mov eax, dword [rsi + 0x7ec]
add eax, dword [rsi + 0x7e4]
cdq
mov dword [rsi + 0x610], ebp
sub eax, edx
mov byte [rsi + 0x7bb], bpl
sar eax, 1
mov dword [rsi + 0x590], eax
mov dword [rsi + 0x618], eax
mov dword [rsi + 0x504], 0x3e4ccccd
mov dword [rsi + 0x58c], 0x3e4ccccd
mov dword [rsi + 0x614], 0x3e4ccccd
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [rsi + 0x87c], 0x3dcccccd
mov rcx, qword [rsi + 0xa68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401fab57
mov byte [rsi + 0x7bc], bpl
jmp 0x1401fab57