Function at 0x1400a6cd0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push r12
push r13
push r15
sub rsp, 0x50
mov rbx, r9
mov r13, r8
mov r12d, edx
mov r15, rcx
cmp edx, 0x104
ja 0x1400a6f89
je 0x1400a6d15
cmp edx, 8
je 0x1400a6fab
cmp edx, 0x18
je 0x1400a6d72
cmp edx, 0x100
jne 0x1400a704b
cmp r13, 0x1b
jne 0x1400a6d31
call fcn.140026de0
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1400a701f
mov rax, r13
mov qword [rsp + 0x48], rdi
mov ebp, 1
sub rax, 9
je 0x1400a6f31
sub rax, 0x1a
je 0x1400a6eaf
sub rax, rbp
je 0x1400a6e68
sub rax, 2
je 0x1400a6def
cmp rax, 2
je 0x1400a6db0
xor ebp, ebp
jmp 0x1400a6f5d
cmp r13, 1
jne 0x1400a704b
call fcn.1400c8110
movzx edx, r13b
mov rcx, r15
call fcn.140041840
mov rcx, qword [r15 + 0x360]
xor edx, edx
call fcn.140058a00
mov rcx, qword [r15 + 0x360]
mov rax, qword [rcx]
call qword [rax + 0x170]
jmp 0x1400a704b
mov rdi, qword [r15 + 0x368]
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x2b8]
test eax, eax
jle 0x1400a6f5d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x2b8]
mov edx, dword [rdi + 0x72c]
dec eax
cmp edx, eax
je 0x1400a6f5d
inc edx
movzx r8d, bpl
jmp 0x1400a6e1d
mov rdi, qword [r15 + 0x368]
mov rcx, rdi
mov rax, qword [rdi]
call qword [rax + 0x2b8]
test eax, eax
jle 0x1400a6f5d
mov edx, dword [rdi + 0x72c]
test edx, edx
je 0x1400a6f5d
dec edx
xor r8d, r8d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x298]
mov r10, qword [rdi + 0x720]
lea rcx, [rdi + 0x720]
movzx r9d, bpl
movzx r8d, bpl
mov edx, eax
mov ebx, eax
call qword [r10 + ILCombine]
mov r8, qword [rdi + 0x720]
lea rcx, [rdi + 0x720]
mov edx, ebx
call qword [r8 + 0x30]
mov rbx, qword [rsp + 0x98]
jmp 0x1400a6f5d
mov rcx, qword [r15 + 0x368]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
lea rdi, [rcx + 0x720]
mov rbx, qword [rdi]
call qword [rax + 0x298]
movzx r9d, bpl
movzx r8d, bpl
mov edx, eax
mov rcx, rdi
call qword [rbx + ILCombine]
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x30]
mov rbx, qword [rsp + 0x98]
jmp 0x1400a6f5d
mov qword [rsp + 0x80], rsi
mov rsi, qword [r15 + 0x368]
mov rcx, rsi
mov qword [rsp + 0x40], r14
mov rbx, qword [rsi]
mov rdi, qword [rsi + 0x720]
call qword [rbx + 0x2b8]
movzx r8d, bpl
mov rcx, rsi
lea edx, [rax - 1]
call qword [rbx + 0x298]
movzx r9d, bpl
lea rcx, [rsi + 0x720]
mov edx, eax
movzx r8d, bpl
call qword [rdi + ILCombine]
mov rax, qword [rsi]
mov rcx, rsi
mov rbx, qword [rsi + 0x720]
call qword [rax + 0x2b8]
lea rcx, [rsi + 0x720]
lea edx, [rax - 1]
call qword [rbx + 0x30]
mov rbx, qword [rsp + 0x98]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x80]
jmp 0x1400a6f5d
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
movzx edx, bpl
and ax, cx
mov rcx, qword [r15 + 0x368]
je 0x1400a6f58
call fcn.1400cac70
jmp 0x1400a6f5d
call fcn.1400cabe0
mov rcx, qword [r15 + 0x360]
mov rax, qword [rcx]
call qword [rax + 0x170]
mov rdi, qword [rsp + 0x48]
test ebp, ebp
je 0x1400a704b
xor eax, eax
add rsp, 0x50
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
mov eax, r12d
sub eax, 0x231
je 0x1400a7040
sub eax, 1
je 0x1400a703c
cmp eax, 0x5b8
jne 0x1400a704b
cmp byte [rcx + 0x35c], 0
jne 0x1400a702d
call fcn.140026de0
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1400a702d
mov rax, qword [r15 + 0x350]
test rax, rax
je 0x1400a702d
cmp qword [rax + 0x10], 0
jne 0x1400a702d
xor ebp, ebp
mov rcx, r15
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
call fcn.140026de0
mov rcx, rax
lea rdx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x1400a702d
mov rax, qword [r15]
mov r8b, 1
xor edx, edx
mov rcx, r15
call qword [rax + 0x28]
xor eax, eax
add rsp, 0x50
pop r15
pop r13
pop r12
pop rbp
pop rbx
ret
xor ebp, ebp
jmp 0x1400a7045
mov ebp, 1
mov dword [rcx + 0x358], ebp
mov r9, rbx
mov r8, r13
mov edx, r12d
mov rcx, r15
add rsp, 0x50
pop r15
pop r13
pop r12
pop rbp
pop rbx
jmp fcn.140040ce0