Function at 0x100034e9c
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov rsi, rdx
mov rbp, rcx
cmp rcx, r12
je 0x100035350
cmp rdx, r12
je 0x100035350
mov rbx, qword [0x1000b0fb8]
cmp rdx, qword [rbx + 0x148]
je 0x100035361
cmp byte [0x1000b111d], r12b
je 0x100034f36
lea ecx, [r12 + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [r12 + 0x11]
movzx ebx, ax
shr bx, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
lea ecx, [r12 + 0x10]
movzx edi, ax
shr di, 0xf
and di, bx
call qword [sym.imp.USER32.dll_GetKeyState]
shr ax, 0xf
test dil, al
je 0x100034f2f
mov al, 1
jmp 0x100035363
mov rbx, qword [0x1000b0fb8]
xor edx, edx
mov rcx, rsi
call fcn.100034ca8
lea edi, [rdx + 1]
cmp eax, r12d
je 0x100035302
sub eax, edi
je 0x100035101
sub eax, edi
jne 0x100035361
cmp dword [rbp + 0x130], edi
jne 0x100035361
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax]
mov ecx, dword [rcx + 8]
cmp dword [rsi + 0x130], r12d
jne 0x100034fd8
call fcn.10006dac8
cmp eax, 0xd
cmove eax, r12d
cmp eax, r12d
je 0x100035170
mov rcx, qword [0x1000b0fb8]
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x100017368]
mov rcx, qword [rcx + 0x150]
xor r8d, r8d
mov r9d, edi
call fcn.100042bc0
mov rcx, qword [0x1000b0fb8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 7]
call fcn.10002f310
jmp 0x100035361
call fcn.10006da74
mov edx, dword [rsi + 0x130]
mov rcx, qword [rsi + 0x140]
sub edx, edi
mov ebx, eax
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdx + 8]
call fcn.10006da74
cmp ebx, eax
je 0x100035099
mov ecx, dword [rsi + 0x130]
mov rax, qword [rsi + 0x140]
sub ecx, edi
mov rcx, qword [rax + rcx*8]
mov ecx, dword [rcx + 8]
call fcn.10006da74
mov rcx, qword [0x1000b0fb8]
cmp eax, r12d
je 0x10003507f
sub eax, edi
je 0x100035065
sub eax, edi
je 0x10003504b
sub eax, edi
jne 0x100034fc4
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x100017420]
jmp 0x100034fab
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x1000173f0]
jmp 0x100034fab
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x1000173c0]
jmp 0x100034fab
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x100017390]
jmp 0x100034fab
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax]
mov ecx, dword [rcx + 8]
call fcn.10006dac8
mov edx, dword [rsi + 0x130]
mov rcx, qword [rsi + 0x140]
mov ebx, eax
cmp eax, 0xd
cmove ebx, r12d
sub edx, edi
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdx + 8]
call fcn.10006dac8
cmp eax, 0xd
cmove eax, r12d
inc eax
cmp ebx, eax
je 0x100035170
mov rcx, qword [0x1000b0fb8]
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x100017450]
jmp 0x100034fab
cmp dword [rsi + 0x130], r12d
jne 0x100035178
mov cl, dil
call fcn.100034c00
mov ecx, dword [rbp + 0x130]
cmp ecx, eax
jle 0x100035170
mov rdx, qword [rbx + 0x58]
cmp byte [rdx + 0xe], r12b
jne 0x100035361
xor r8d, r8d
mov r9d, edi
cmp eax, edi
jne 0x100035150
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbx + 0x150]
lea rdx, [0x1000171e0]
call fcn.100042bc0
jmp 0x100035361
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rbx + 0x150]
lea rdx, [0x100017210]
call fcn.100042bc0
jmp 0x100035361
mov al, dil
jmp 0x100035363
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax]
mov ecx, dword [rcx + 8]
call fcn.10006da74
cmp eax, r12d
je 0x1000351b6
cmp eax, 2
je 0x1000351b6
cmp eax, edi
je 0x10003526c
cmp eax, 3
je 0x10003526c
lea rdx, [0x100024cf0]
mov ecx, 0x10001
call fcn.10005e464
mov ebx, r12d
mov ecx, dword [rsi + 0x130]
mov rax, qword [rsi + 0x140]
sub ecx, edi
mov rcx, qword [rax + rcx*8]
mov ecx, dword [rcx + 8]
call fcn.10006da74
cmp eax, r12d
je 0x100035200
cmp eax, 2
je 0x100035200
cmp eax, edi
je 0x100035273
cmp eax, 3
je 0x100035273
lea rdx, [0x100024cf0]
mov ecx, 0x10001
call fcn.10005e464
mov r11d, r12d
cmp ebx, r11d
jne 0x100035299
mov ecx, dword [rsi + 0x130]
mov rax, qword [rsi + 0x140]
sub ecx, edi
mov rcx, qword [rax + rcx*8]
mov ecx, dword [rcx + 8]
call fcn.10006da74
cmp eax, r12d
je 0x10003524b
cmp eax, 2
je 0x10003524b
cmp eax, edi
je 0x100035278
cmp eax, 3
je 0x100035278
lea rdx, [0x100024cf0]
mov ecx, 0x10001
call fcn.10005e464
mov rcx, qword [0x1000b0fb8]
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x100017320]
jmp 0x100034fab
mov ebx, edi
jmp 0x1000351b9
mov r11d, edi
jmp 0x100035203
mov rcx, qword [0x1000b0fb8]
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x1000172f8]
jmp 0x100034fab
mov rax, qword [rbp + 0x140]
mov rcx, qword [rax]
mov ecx, dword [rcx + 8]
call fcn.10006dac8
mov edx, dword [rsi + 0x130]
mov rcx, qword [rsi + 0x140]
mov ebx, eax
cmp eax, 0xd
cmove ebx, r12d
sub edx, edi
mov rdx, qword [rcx + rdx*8]
mov ecx, dword [rdx + 8]
call fcn.10006dac8
lea ecx, [rbx + 1]
cmp eax, 0xd
cmove eax, r12d
cmp ecx, eax
je 0x100035170
mov rcx, qword [0x1000b0fb8]
mov rax, qword [rcx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x100034fc4
lea rdx, [0x100017348]
jmp 0x100034fab
cmp dword [rsi + 0x130], r12d
je 0x100035345
cmp dword [rbp + 0x130], edi
jne 0x10003534b
mov rax, qword [rbx + 0x58]
cmp byte [rax + 0xe], r12b
jne 0x10003533d
mov rcx, qword [rbx + 0x150]
lea rdx, [0x1000172d0]
mov r9d, edi
xor r8d, r8d
call fcn.100042bc0
mov rbx, qword [0x1000b0fb8]
mov rcx, rbx
jmp 0x100034fc4
cmp dword [rbp + 0x130], edi
sete al
jmp 0x100035363
lea rdx, [0x100017230]
mov ecx, 0x10000001
call fcn.10005e464
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret