Function at 0x140053810
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, 0x1f
je 0x140053a3e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rdi, rcx
mov rcx, qword [rcx + 0x20]
mov ebx, edx
test rcx, rcx
je 0x1400539a2
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x1400539a2
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r12d, ebx
mov r15d, 0xc0000001
and r12d, 1
mov r14d, 0x101
je 0x14005389c
test bl, 8
jne 0x14005389c
bt ebx, 0xb
jb 0x14005389c
movzx eax, byte [rdi + 0x29]
lea edx, [r14 + 4]
shl eax, 0x10
movsxd r9, eax
mov eax, 0xe0000001
or r9, rax
jmp 0x1400538b1
test r12d, r12d
je 0x1400538c1
movzx eax, byte [rdi + 0x29]
mov edx, r14d
shl eax, 0x10
movsxd r9, eax
or r9, r15
mov rcx, qword [rdi + 0x20]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
mov r13d, ebx
and r13d, 8
je 0x1400538ea
movzx eax, byte [rdi + 0x28]
mov rcx, qword [rdi + 0x20]
mov r8d, reloc.WSOCK32.dll_recvfrom
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ebp, ebx
and ebp, 2
je 0x14005390f
movzx eax, byte [rdi + 0x2b]
mov r8d, dword [rdi + 0x30]
mov rcx, qword [rdi + 0x20]
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov esi, ebx
and esi, 4
je 0x140053936
movzx eax, byte [rdi + 0x2c]
mov rcx, qword [rdi + 0x20]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
and ebx, 0x10
je 0x14005395b
movzx eax, byte [rdi + 0x2d]
mov rcx, qword [rdi + 0x20]
mov r8d, 0x5b
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov cl, 0x80
test ebx, ebx
je 0x140053965
xor byte [rsp + 0x7b], cl
test ebp, ebp
je 0x140053974
mov eax, dword [rdi + 0x30]
xor byte [rsp + 0x30], cl
xor byte [rsp + rax + 0x20], cl
test esi, esi
je 0x140053983
xor byte [rsp + 0x30], cl
xor byte [rsp + 0xc1], cl
test r13d, r13d
je 0x14005398c
xor byte [rsp + 0x31], cl
test r12d, r12d
je 0x140053995
xor byte [rsp + 0x32], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140053a16
mov esi, 2
test bl, 1
je 0x1400539bd
mov dl, byte [rdi + 0x29]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 8
je 0x1400539d3
mov dl, byte [rdi + 0x28]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_keybd_event]
test sil, bl
je 0x1400539ea
mov dl, byte [rdi + 0x2b]
mov cl, byte [rdi + 0x30]
xor r9d, r9d
mov r8d, esi
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 4
je 0x140053a00
mov dl, byte [rdi + 0x2c]
xor r9d, r9d
mov r8d, esi
mov cl, RegisterTypeLib
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 0x10
je 0x140053a16
mov dl, byte [rdi + 0x2d]
xor r9d, r9d
mov r8d, esi
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
call fcn.140045040
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret