Function at 0x7ff71cd491c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
mov eax, edx
mov rsi, r9
mov rbx, r8
sub eax, 0x803
mov r12d, edx
mov ebp, ecx
je 0x7ff71cd4b83
mov r13d, 1
sub eax, r13d
je 0x7ff71cd4ac1
sub eax, 0xc
je 0x7ff71cd4a77
sub eax, r13d
je 0x7ff71cd4a1b
cmp eax, r13d
je 0x7ff71cd49e4
mov rdi, qword [rsp + 0x70]
test bl, 2
je 0x7ff71cd49c6
lea rax, [0x7ff71cdb020]
cmp qword [rdi + 0x28], rax
jne 0x7ff71cd49c6
mov rcx, qword [0x7ff71cee2c0]
lea rax, [0x7ff71cee2c0]
cmp rcx, rax
je 0x7ff71cd49bd
bt dword [rcx + 0x1c], 0x16
jae 0x7ff71cd49bd
cmp byte [rcx + 0x19], 5
jb 0x7ff71cd49bd
mov rcx, qword [rcx + 0x10]
lea edx, [r13 + 0xc]
lea r8, [0x7ff71ce9590]
call fcn.7ff71cc12c0
mov ecx, dword [rdi + 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [rdi + 0x60]
mov r9, rsi
mov r8, rbx
mov edx, r12d
mov dword [rsp + 0x20], r13d
call fcn.7ff71cc6fe4
mov rdi, rax
jmp 0x7ff71cd4b97
bt rbx, 8
jae 0x7ff71cd49f1
mov rcx, qword [r9 + 8]
jmp 0x7ff71cd49f8
lea rcx, [0x7ff71ce9770]
shr r8, 1
xor edx, edx
not r8d
and r8d, r13d
bts r8d, 0x10
call sym.WINMM.dll_PlaySoundW
test eax, eax
jne 0x7ff71cd4a6a
mov edi, 0x106
jmp 0x7ff71cd4b97
bt ebx, 8
jae 0x7ff71cd4a58
bt ebx, 0xa
jae 0x7ff71cd4a31
mov edi, 0x11c
jmp 0x7ff71cd4b97
bt ebx, 9
jae 0x7ff71cd4a3d
mov r8, qword [r9 + 0xc]
jmp 0x7ff71cd4a40
xor r8d, r8d
mov edx, dword [r9 + 8]
mov ecx, ebp
call fcn.7ff71cdb068
neg eax
sbb ecx, ecx
not ecx
and ecx, 0xb
mov edi, ecx
jmp 0x7ff71cd4a73
bt ebx, 0xa
jae 0x7ff71cd4a6e
xor r8d, r8d
xor edx, edx
mov ecx, ebp
call sym.WINMM.dll_mciSetYieldProc
xor edi, edi
jmp 0x7ff71cd4a8d
mov edi, 0x111
test edi, edi
jmp 0x7ff71cd4a87
mov r8, r9
mov edx, ebx
mov ecx, ebp
call fcn.7ff71cd91cc
mov edi, eax
test eax, eax
jne 0x7ff71cd4b97
test r13b, bl
je 0x7ff71cd4b97
test rsi, rsi
je 0x7ff71cd4b97
mov rcx, qword [rsi]
test rcx, rcx
je 0x7ff71cd4b97
mov r9, rbp
mov r8, r13
mov edx, 0x3b9
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x7ff71cd4b97
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r12, qword [rsp + 0x70]
mov edx, eax
cmp rdx, qword [r12 + 0x50]
je 0x7ff71cd4b72
mov rdi, qword [r12]
or rcx, 0xffffffffffffffff
xor eax, eax
repne scasw ax, word [rdi]
not rcx
sub rcx, r13
lea edi, [rcx + rcx + 0xe]
cmp dword [rsp + 0x78], eax
jne 0x7ff71cd4b00
mov edi, 0x12f
jmp 0x7ff71cd4b97
mov ecx, edi
call fcn.7ff71cdf53c
mov rbx, rax
test rax, rax
jne 0x7ff71cd4b19
mov eax, 0x108
jmp 0x7ff71cd4b99
lea r8, [0x7ff71cf09f8]
mov rdx, rdi
mov rcx, rax
call fcn.7ff71cc2090
lea r8, [0x7ff71ce976c]
mov rdx, rdi
mov rcx, rbx
call fcn.7ff71cc1a00
mov r8, qword [r12]
mov rdx, rdi
mov rcx, rbx
call fcn.7ff71cc1a00
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.7ff71cd5d28
mov rcx, qword [0x7ff71cee2d8]
mov r8, rbx
xor edx, edx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x7ff71cd4b97
mov r9d, r13d
mov r8, rsi
mov edx, ebx
mov ecx, ebp
call fcn.7ff71cdac34
jmp 0x7ff71cd4b95
mov r8, qword [rsp + 0x80]
mov rdx, r9
mov ecx, ebx
call fcn.7ff71cda6c8
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret