Function at 0x10001cea0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov ebp, 0x9c69
xor r15d, r15d
mov edi, edx
cmp edx, ebp
mov rsi, rcx
jg 0x10001d040
je 0x10001cfef
cmp edx, 0x418
je 0x10001d31d
cmp edx, 0x419
je 0x10001d27d
cmp edx, 0x41a
je 0x10001d104
mov ebp, 0x755b
cmp edx, ebp
je 0x10001cfb7
mov r8d, 0x9c41
cmp edx, r8d
je 0x10001cf9d
cmp edx, 0x9c66
jle 0x10001d46a
cmp edx, 0x9c68
jg 0x10001d46a
mov edx, dword [rcx + 0x30]
lea r8, [rax + 0x10]
call fcn.10001c21c
mov rbx, rax
cmp rax, r15
je 0x10001cf90
mov eax, dword [rsp + 0xb8]
cmp eax, r15d
jbe 0x10001cf7c
lea edx, [r15 + 6]
lea r12d, [r15 + 3]
cmp edi, 0x9c67
mov rbp, rbx
mov r13, rax
cmove r12d, edx
mov rcx, qword [rbp]
mov edx, r12d
call qword [sym.imp.USER32.dll_ShowWindowAsync]
add rbp, 8
sub r13, 1
jne 0x10001cf65
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.100012c74
mov r8d, edi
jmp 0x10001d459
mov rcx, qword [0x10002a358]
xor r9d, r9d
mov edx, 0x111
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x10001d46a
mov edx, dword [rcx + 0x30]
lea r8, [rsp + 0xb8]
call fcn.10001c21c
mov rbx, rax
cmp rax, r15
je 0x10001cfe2
mov r8d, dword [rsp + 0xb8]
mov rdx, rax
mov rcx, rsi
call fcn.10001c1d0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor edx, edx
jmp 0x10001d41f
mov edx, dword [rcx + 0x30]
lea r8, [rsp + 0xb8]
call fcn.10001c21c
mov rbx, rax
cmp rax, r15
je 0x10001d01a
mov r8d, dword [rsp + 0xb8]
mov rdx, rax
mov rcx, rsi
call fcn.10001c1d0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov r9d, dword [rsp + 0xb8]
xor r8d, r8d
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_CascadeWindows]
jmp 0x10001d438
mov ecx, edx
mov ebp, 0x9c6a
sub ecx, ebp
je 0x10001d3e6
sub ecx, 2
je 0x10001d31d
sub ecx, 1
je 0x10001d27d
sub ecx, 1
je 0x10001d104
sub ecx, 1
je 0x10001d078
cmp ecx, 0x54
jne 0x10001d46a
lea r8, [rsp + 0xb8]
mov edx, 1
mov rcx, rsi
call fcn.10001c21c
mov rbp, rax
cmp rax, r15
je 0x10001cf90
mov rbx, qword [rax]
mov dword [rsp + 0xb8], r15d
mov rcx, rbx
call qword [sym.imp.USER32.dll_HungWindowFromGhostWindow]
lea rdx, [rsp + 0xb8]
cmp rax, r15
cmovne rbx, rax
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [rsp + 0xb8]
cmp ecx, r15d
je 0x10001d0f6
mov r9, rcx
mov rcx, qword [0x10002a358]
mov r8d, eax
mov edx, 0x405
cmp edi, 0x9cc3
je 0x10001d0f0
mov edx, 0x401
call qword [sym.imp.USER32.dll_PostMessageW]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbp
jmp 0x10001cf85
lea r8, [rsp + 0xb8]
mov edx, 1
mov rcx, rsi
call fcn.10001c21c
mov ecx, 0x11
or ebx, 0xffffffff
mov r14, rax
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
shr ecx, 0x10
and ecx, 1
cmp r14, r15
je 0x10001d46a
lea eax, [rdi + 0x10000]
cmp ecx, r15d
cmovne edi, eax
mov eax, dword [rsp + 0xb8]
cmp eax, r15d
jbe 0x10001d26f
mov r12, r14
mov r13, rax
mov esi, ecx
mov r15, qword [r12]
and dword [rsp + 0xb8], 0
lea rdx, [rsp + 0xb8]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rcx, r15
call qword [sym.imp.USER32.dll_HungWindowFromGhostWindow]
test rax, rax
je 0x10001d19c
lea rdx, [rsp + 0xb8]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0xb8], ebx
je 0x10001d256
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
lea r8d, [rdx + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x10001d1d2
lea rbx, [rsp + 0x40]
xor ebp, ebp
jmp 0x10001d1d7
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
mov qword [rbx + 8], r15
xor r15d, r15d
mov dword [rbx + 0x10], r15d
mov dword [rbx + 0x14], esi
mov dword [rbx + 0x18], edi
mov qword [rbx], rax
mov eax, dword [rsp + 0xb8]
mov dword [rbx + 0x1c], eax
cmp ebp, r15d
je 0x10001d241
lea r8d, [r15 + 0x11]
lea rcx, [fcn.10001b684]
xor r9d, r9d
mov rdx, rbx
mov dword [rbx + 0x20], 1
call qword [sym.imp.SHLWAPI.dll_SHCreateThread]
cmp eax, r15d
jne 0x10001d24d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10001d24d
mov rcx, rbx
mov dword [rbx + 0x20], r15d
call fcn.10001b684
mov ebx, dword [rsp + 0xb8]
jmp 0x10001d259
xor r15d, r15d
add r12, 8
sub r13, 1
jne 0x10001d160
mov rsi, qword [rsp + 0xb0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, r14
jmp 0x10001d383
lea r8, [rsp + 0xb8]
mov edx, 1
mov rcx, rsi
call fcn.10001c21c
mov rbp, rax
cmp rax, r15
je 0x10001cf90
mov ebx, dword [rsp + 0xb8]
mov rdx, rax
mov rcx, rsi
mov r8d, ebx
call fcn.10001c1d0
lea r11d, [rbx - 1]
movsxd rbx, r11d
cmp rbx, r15
jl 0x10001d2ea
mov rcx, qword [rbp + rbx*8]
mov dword [rsp + 0x30], 0x4003
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_SetWindowPos]
sub rbx, 1
jns 0x10001d2bf
mov rcx, qword [rbp]
lea rdx, [rsp + 0xb8]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, r15d
je 0x10001d30e
mov ecx, dword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, qword [rbp]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x10001d0f6
mov edx, dword [rsi + 0x30]
lea r8, [rsp + 0xb8]
mov rcx, rsi
call fcn.10001c21c
mov rbx, rax
cmp rax, r15
je 0x10001cf90
mov rcx, qword [rax]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, r15d
je 0x10001d358
mov rcx, qword [rbx]
mov edx, 9
call qword [sym.imp.USER32.dll_ShowWindowAsync]
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_GetLastActivePopup]
mov rcx, rax
mov rbp, rax
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, r15d
jne 0x10001d393
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10001d46a
mov edx, 0xfffffff0
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1b
jb 0x10001d3d9
mov edx, 1
mov rcx, rbp
call qword [sym.imp.USER32.dll_SwitchToThisWindow]
test byte [0x10002b1a0], 1
je 0x10001cf7c
mov rcx, qword [0x10002a358]
mov edx, 6
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10001cf7c
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x10001cf7c
mov edx, dword [rsi + 0x30]
lea r8, [rsp + 0xb8]
mov rcx, rsi
call fcn.10001c21c
mov rbx, rax
cmp rax, r15
je 0x10001d414
mov r8d, dword [rsp + 0xb8]
mov rdx, rax
mov rcx, rsi
call fcn.10001c1d0
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, 1
mov r9d, dword [rsp + 0xb8]
xor r8d, r8d
mov rcx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.USER32.dll_TileWindows]
cmp rbx, r15
je 0x10001d451
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.100012c74
mov r8d, ebp
xor r9d, r9d
xor edx, edx
mov ecx, eax
mov dword [rsp + 0x20], r15d
call fcn.100021bd0
mov dword [rsi + 0x20], r15d
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret