Function at 0x1400643f0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x40
mov rax, qword [0x140129080]
xor rax, rsp
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 1
mov dword [0x14020b610], eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
lea rcx, [rsp + 0x30]
mov dword [0x14020b388], eax
call qword [sym.imp.USER32.dll_GetCursorPos]
cmp byte [0x14020fedf], 0
mov ebp, dword [rsp + 0x30]
mov esi, dword [rsp + 0x34]
mov ecx, dword [0x14020fde0]
jne 0x140064557
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ebx, ebx
test al, 1
je 0x1400644c5
cmp byte [0x1401d9fdb], bl
mov eax, dword [0x14020b610]
sete cl
cdq
sub eax, edx
mov byte [0x1401d9fdb], cl
sar eax, 1
cmp ebp, eax
je 0x14006449a
mov eax, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
je 0x14006449a
mov byte [0x1401d9fdb], bl
jmp 0x1400644b4
test cl, cl
je 0x1400644b4
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
cmp byte [0x1401d9fdb], bl
je 0x14006470e
cmp byte [0x1401db13e], bl
je 0x14006470e
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp ebp, eax
jne 0x14006470e
mov eax, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x14006470e
mov ecx, dword [0x1401d8e20]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x1401d8dc8]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x14006470e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140064573
cmp byte [0x1401d9fdb], 0
sete al
mov byte [0x1401d9fdb], al
jmp 0x14006457a
movzx eax, byte [0x1401d9fdb]
test al, al
je 0x14006470e
mov ecx, 0xa0
mov qword [rsp + 0x50], rdi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 2
movzx ebx, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, bx
jge 0x1400645ae
mov byte [0x14020fbac], 1
jmp 0x1400645be
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400645be
mov byte [0x14020fbac], 0
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x44
movsx ebx, ax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edi, ax
mov ecx, 0x41
and edi, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
or eax, edi
mov rdi, qword [rsp + 0x50]
je 0x1400646f0
xor ebx, ebx
mov byte [reloc.WS2_32.dll_accept], 0
cmp dword [0x14020fdec], ebx
jne 0x140064669
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp ebp, eax
jne 0x140064669
mov eax, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x140064669
cmp byte [0x14020fbac], bl
je 0x140064669
cmp byte [0x1401d9fdb], bl
je 0x14006464e
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea ecx, [rbx + 0x18]
xor edx, edx
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [0x14020fdec], 1
cmp byte [0x1401db13e], bl
je 0x14006470e
mov eax, dword [0x14020b610]
cdq
sub eax, edx
sar eax, 1
cmp ebp, eax
jne 0x14006470e
mov eax, dword [0x14020b388]
cdq
sub eax, edx
sar eax, 1
cmp esi, eax
jne 0x14006470e
cmp byte [0x14020fbac], bl
je 0x14006470e
mov ecx, dword [0x1401d8e20]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0xa0
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [0x1401d8dc8]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
xor edx, edx
mov cl, 0xa0
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x14006470e
cmp dword [0x14020fdec], 0
je 0x14006470e
xor ebx, ebx
mov byte [reloc.WS2_32.dll_accept], 1
mov dword [0x14020fdec], ebx
mov byte [0x14020fbac], bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d4090
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret