Function at 0x4493c0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rbp, rdx
lea r13, [rsp + 0x4c]
mov r14, r9
mov edi, r8d
mov qword [rsp + 0x4c], 0
mov rbx, rcx
mov rcx, r13
mov r15d, r14d
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rbp + 0x10]
mov rdx, r13
mov esi, dword [rsp + 0x4c]
mov r12d, dword [rsp + 0x50]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rdx, qword [rsp + 0x1d0]
mov r13, qword [sym.imp.USER32.dll_MapVirtualKeyA]
sar rdx, 0x10
movzx ebp, dl
cmp r14, 0x10
je 0x449760
xor edx, edx
mov ecx, r15d
call r13
mov edx, 2
mov ecx, r15d
mov dword [rsp + 0x3c], eax
call r13
xor ecx, ecx
test dil, dil
sete cl
mov r13d, eax
add ecx, 0xb
mov dword [rbx], ecx
call qword [sym.imp.USER32.dll_GetMessageTime]
pxor xmm0, xmm0
mov ecx, 0x10
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x00510bc0]
movsd qword [rbx + 8], xmm0
call rdi
mov ecx, 0x11
movsx r14d, ax
call rdi
shr r14d, 0x1f
mov ecx, 0x12
mov r8d, r14d
or r8d, 2
test ax, ax
cmovs r14d, r8d
call rdi
mov ecx, 0x5b
mov r9d, r14d
or r9d, 4
test ax, ax
cmovs r14d, r9d
call rdi
mov ecx, 0x5c
mov r10d, r14d
or r10d, 8
test ax, ax
cmovs r14d, r10d
call rdi
pxor xmm2, xmm2
pxor xmm1, xmm1
mov dword [rbx + 0x34], ebp
pxor xmm3, xmm3
pxor xmm4, xmm4
mov r11d, eax
mov eax, r14d
cvtsi2sd xmm3, esi
or eax, 8
test r11w, r11w
mov esi, r15d
cvtsi2sd xmm4, r12d
cmovs r14d, eax
sub rsi, 8
mov dword [rbx + 0x38], 0
cvtsi2sd xmm2, dword [rsp + 0x4c]
cvtsi2sd xmm1, dword [rsp + 0x50]
mov dword [rbx + 0x30], r14d
unpcklpd xmm3, xmm4
movups xmmword [rbx + 0x10], xmm3
unpcklpd xmm2, xmm1
movups xmmword [rbx + 0x20], xmm2
cmp rsi, 0x9d
ja 0x449588
lea r12, [0x00516360]
movzx edx, word [r12 + rsi*2]
mov eax, edx
test edx, edx
je 0x449588
test qword [rsp + 0x1d0], 0x1000000
je 0x449778
add ax, 0x1fe9
test ax, 0xfffd
jne 0x449778
add edx, 1
mov dword [rbx + 0x38], edx
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test r13d, r13d
js 0x44956d
xor ebp, ebp
lea r9, [rsp + 0x56]
lea r8, [rsp + 0x60]
mov ecx, r15d
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x56], 0
mov edx, dword [rsp + 0x3c]
mov word [rsp + 0x5e], bp
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_ToUnicode]
movzx r15d, word [rsp + 0x56]
mov ecx, 0xfffd
lea r13d, [r15 - 0xd800]
cmp r13d, 0x3ff
cmovbe r15d, ecx
mov dword [rbx + 0x38], r15d
jmp 0x44956d
mov edx, 3
mov ecx, ebp
call r13
mov r15d, eax
jmp 0x449433
mov dword [rbx + 0x38], edx
jmp 0x44956d