Function at 0x2f8aa6e29
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
movzx eax, word [0x2f8ab40ba]
xor eax, 0x6e
mov byte [0x2f8ab40b4], al
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
sub eax, 0x1b7e887c
mov dword [0x2f8ab40b0], eax
mov eax, dword [0x2f8ab40bc]
imul ax, ax, 0x990d
mov word [0x2f8ab40b6], ax
movzx eax, word [0x2f8ab40ba]
add eax, 0x21
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40bc]
mov edx, 0x47
imul eax, edx
mov byte [0x2f8ab40b5], al
mov dword [rbp - 4], 0x23
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
sub eax, 0x6c169ebf
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40b6]
or eax, 0xffffffa4
mov byte [0x2f8ab40b4], al
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
and ax, 0x158e
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40b0]
or ax, 0x7350
mov word [0x2f8ab40b8], ax
movzx eax, byte [0x2f8ab40b5]
xor eax, 0xc
mov byte [0x2f8ab40b5], al
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
and eax, 0x2108f426
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40ba]
movzx eax, ax
xor eax, 0x31ac3b18
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40ba]
or ax, 0xa9a4
mov word [0x2f8ab40ba], ax
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
or eax, 0x596aae53
mov dword [0x2f8ab40bc], eax
mov eax, dword [rbp + 0x10]
mov dword [rbp - 0x1c], eax
movzx eax, word [0x2f8ab40ba]
xor ax, 0xde9e
mov word [0x2f8ab40b8], ax
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
and eax, 0x9fcc214
mov dword [0x2f8ab40b0], eax
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
add eax, 0x5ae0137d
mov dword [0x2f8ab40b0], eax
movzx eax, byte [0x2f8ab40b4]
and eax, 0xffffffaf
mov byte [0x2f8ab40b5], al
movzx eax, word [0x2f8ab40b8]
xor eax, 0x70
mov byte [0x2f8ab40b4], al
movzx eax, byte [0x2f8ab40b4]
add eax, 0x3a
mov byte [0x2f8ab40b5], al
lea rax, [rbp - 0x1c]
mov qword [rbp - 0x18], rax
movzx eax, word [0x2f8ab40ba]
or eax, 0xffffffd6
mov byte [0x2f8ab40b5], al
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
add ax, 0x47b5
mov word [0x2f8ab40ba], ax
mov eax, dword [0x2f8ab40bc]
and eax, 0x2e76a629
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40b6]
xor ax, 0x52fe
mov word [0x2f8ab40b6], ax
mov eax, dword [0x2f8ab40b0]
sub eax, 9
mov byte [0x2f8ab40b5], al
movzx eax, word [0x2f8ab40b8]
xor eax, 0x1a
mov byte [0x2f8ab40b5], al
add dword [rbp - 4], 1
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
imul ax, ax, 0xe015
mov word [0x2f8ab40b8], ax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0xbc
mov rax, qword [sym.imp.USER32.dll_RedrawWindow]
call rax
mov eax, dword [0x2f8ab40bc]
sub ax, 0x7e64
mov word [0x2f8ab40ba], ax
mov eax, dword [0x2f8ab40b0]
add ax, 0x5d2
mov word [0x2f8ab40b8], ax
movzx eax, word [0x2f8ab40b8]
add ax, 0x545
mov word [0x2f8ab40b6], ax
movzx eax, word [0x2f8ab40b6]
movzx eax, ax
imul eax, eax, 0xf03fc5f3
mov dword [0x2f8ab40b0], eax
mov eax, dword [0x2f8ab40b0]
or ax, 0x8c95
mov word [0x2f8ab40b6], ax
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax]
mov byte [rbp - 5], al
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
imul ax, ax, 0x7d93
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40bc]
add ax, 0x3f15
mov word [0x2f8ab40ba], ax
movzx eax, word [0x2f8ab40b6]
and ax, 0x6224
mov word [0x2f8ab40b8], ax
movzx eax, word [0x2f8ab40ba]
or eax, 0xffffffd4
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40ba]
imul ax, ax, 0x80da
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40bc]
xor eax, 0xffffffe0
mov byte [0x2f8ab40b5], al
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
or ax, 0x2014
mov word [0x2f8ab40b6], ax
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
or eax, 0x14156e46
mov dword [0x2f8ab40b0], eax
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 1]
mov byte [rbp - 6], al
movzx eax, word [0x2f8ab40b6]
xor eax, 0xc
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40b0]
add eax, 0x2e
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40bc]
imul ax, ax, 0xfe46
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40b0]
xor eax, 0x21cb76e3
mov dword [0x2f8ab40b0], eax
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x18]
movzx eax, byte [rax + 2]
mov byte [rbp - 7], al
mov eax, dword [0x2f8ab40bc]
xor eax, 0x2dfd3f8e
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40b6]
or ax, 0xc09e
mov word [0x2f8ab40b6], ax
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
add eax, 0x490bb8ac
mov dword [0x2f8ab40b0], eax
movzx eax, word [0x2f8ab40b8]
add eax, 0x11
mov byte [0x2f8ab40b5], al
add dword [rbp - 4], 1
not byte [rbp - 6]
movzx eax, word [0x2f8ab40ba]
xor ax, 0x5b67
mov word [0x2f8ab40b6], ax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
add ax, 0x12c1
mov word [0x2f8ab40b6], ax
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
or eax, 0xcddc33e3
mov dword [0x2f8ab40b0], eax
add dword [rbp - 4], 1
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
imul ax, ax, 0xf5b7
mov word [0x2f8ab40ba], ax
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
imul eax, eax, 0x30456631
mov dword [0x2f8ab40b0], eax
movzx eax, word [0x2f8ab40b8]
add eax, 0x1a
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40b0]
add ax, 0x51cf
mov word [0x2f8ab40b8], ax
movzx eax, word [0x2f8ab40ba]
movzx eax, ax
and eax, 0x8abafeb0
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40ba]
xor ax, 0xa4b6
mov word [0x2f8ab40b8], ax
mov dword [rbp - 0xc], 0
jmp 0x2f8aa79ac
mov eax, dword [0x2f8ab40b0]
sub eax, 0x1b
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40bc]
add eax, 0x1a
mov byte [0x2f8ab40b5], al
movzx eax, word [0x2f8ab40b8]
and ax, 0x6b85
mov word [0x2f8ab40ba], ax
mov eax, dword [0x2f8ab40bc]
sub eax, 0xc76409b
mov dword [0x2f8ab40bc], eax
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
sub ax, 0x653b
mov word [0x2f8ab40b6], ax
movzx eax, word [0x2f8ab40ba]
and ax, 0xd0a3
mov word [0x2f8ab40b6], ax
movzx eax, byte [0x2f8ab40b4]
or eax, 0x7c
mov byte [0x2f8ab40b5], al
movzx eax, word [0x2f8ab40b8]
imul ax, ax, 0x82ff
mov word [0x2f8ab40ba], ax
add dword [rbp - 4], 1
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
or eax, 0xe3f76e04
mov dword [0x2f8ab40bc], eax
mov eax, dword [0x2f8ab40bc]
xor ax, 0x60c0
mov word [0x2f8ab40b6], ax
movzx eax, word [0x2f8ab40b6]
xor eax, 0x22
mov byte [0x2f8ab40b5], al
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
xor eax, 0x6dfb45fb
mov dword [0x2f8ab40b0], eax
movzx eax, byte [0x2f8ab40b4]
xor eax, 0xfffffffc
mov byte [0x2f8ab40b4], al
movzx edx, byte [0x2f8ab40b4]
mov eax, edx
shl eax, 2
add eax, edx
mov byte [0x2f8ab40b5], al
movzx edx, byte [rbp - 5]
movzx eax, byte [rbp - 6]
add eax, edx
mov byte [rbp - 0xd], al
movzx eax, word [0x2f8ab40ba]
add eax, 0x1c
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40b8]
xor ax, 0x5821
mov word [0x2f8ab40ba], ax
mov eax, dword [0x2f8ab40bc]
mov edx, 0xffffffd6
imul eax, edx
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40b6]
sub eax, 0x28
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40ba]
sub eax, 0xe
mov byte [0x2f8ab40b4], al
add dword [rbp - 4], 1
movzx eax, byte [rbp - 6]
mov byte [rbp - 5], al
movzx eax, word [0x2f8ab40b6]
movzx eax, ax
sub eax, 0xe4f9ef0
mov dword [0x2f8ab40b0], eax
movzx eax, word [0x2f8ab40b6]
movzx eax, ax
imul eax, eax, 0x92723ac8
mov dword [0x2f8ab40b0], eax
mov eax, dword [0x2f8ab40b0]
xor eax, 0x2e
mov byte [0x2f8ab40b4], al
mov eax, dword [0x2f8ab40bc]
xor eax, 0x37782bf2
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40b8]
or ax, 0xb167
mov word [0x2f8ab40b8], ax
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
sub ax, 0x1d92
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40bc]
xor ax, 0xde2d
mov word [0x2f8ab40b6], ax
add dword [rbp - 4], 1
movzx eax, byte [rbp - 7]
mov byte [rbp - 6], al
mov eax, dword [0x2f8ab40bc]
sub eax, 0x75
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40b6]
add ax, 0x1dad
mov word [0x2f8ab40b8], ax
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
add ax, 0x752e
mov word [0x2f8ab40b8], ax
movzx eax, word [0x2f8ab40b6]
or eax, 0xffffff93
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
imul eax, eax, 0xf1077d87
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40ba]
movzx eax, ax
add eax, 0x28d77c6b
mov dword [0x2f8ab40b0], eax
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
add eax, 0x60d6145f
mov dword [0x2f8ab40bc], eax
add dword [rbp - 4], 1
movzx eax, byte [rbp - 7]
add byte [rbp - 0xd], al
mov eax, dword [0x2f8ab40b0]
and eax, 0x24
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40ba]
and ax, 0xf9b3
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40b0]
sub eax, 0x3c
mov byte [0x2f8ab40b4], al
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
imul eax, eax, 0xe3b8ecbf
mov dword [0x2f8ab40b0], eax
movzx eax, byte [0x2f8ab40b4]
and eax, 0xffffff89
mov byte [0x2f8ab40b5], al
add dword [rbp - 4], 1
mov eax, dword [0x2f8ab40b0]
sub eax, 0x4bbffb7a
mov dword [0x2f8ab40bc], eax
movzx eax, byte [0x2f8ab40b4]
mov edx, 0x27
imul eax, edx
mov byte [0x2f8ab40b4], al
movzx eax, byte [0x2f8ab40b5]
and eax, 0xfffffff8
mov byte [0x2f8ab40b4], al
mov ecx, 0x1a
mov rax, qword [sym.imp.USER32.dll_GetSysColorBrush]
call rax
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
xor eax, 0x7d01e931
mov dword [0x2f8ab40bc], eax
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
sub ax, 0x36b8
mov word [0x2f8ab40b8], ax
movzx eax, byte [rbp - 0xd]
test al, al
jns 0x2f8aa7782
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
imul eax, eax, 0xf2d05bfc
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40ba]
sub eax, 0x68
mov byte [0x2f8ab40b4], al
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
xor eax, 0xa2dbad60
mov dword [0x2f8ab40bc], eax
movzx eax, word [0x2f8ab40b8]
and ax, 0x8d1e
mov word [0x2f8ab40ba], ax
movzx eax, word [0x2f8ab40ba]
movzx eax, ax
add eax, 0x1dadef6d
mov dword [0x2f8ab40b0], eax
movzx eax, word [0x2f8ab40ba]
movzx eax, ax
xor eax, 0x6ebe5e77
mov dword [0x2f8ab40b0], eax
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
xor eax, 0x727d5a87
mov dword [0x2f8ab40b0], eax
mov eax, dword [0x2f8ab40bc]
or eax, 0xffffffb7
mov byte [0x2f8ab40b5], al
shl byte [rbp - 0xd], 1
movzx eax, word [0x2f8ab40b6]
xor ax, 0x9a81
mov word [0x2f8ab40b8], ax
movzx eax, word [0x2f8ab40b8]
and eax, 0x5f
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40b6]
and eax, 0x3e
mov byte [0x2f8ab40b5], al
movzx eax, byte [0x2f8ab40b4]
movzx eax, al
or ax, 0xbcfb
mov word [0x2f8ab40b6], ax
mov eax, dword [0x2f8ab40bc]
add ax, 0x5cad
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40bc]
sub eax, 0x3cf145c6
mov dword [0x2f8ab40bc], eax
add dword [rbp - 4], 1
mov eax, dword [0x2f8ab40b0]
or ax, 0x8d9b
mov word [0x2f8ab40b8], ax
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
or ax, 0x5f41
mov word [0x2f8ab40b6], ax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
or byte [rbp - 0xd], 1
jmp 0x2f8aa7867
mov eax, dword [0x2f8ab40b0]
or ax, 0x5d92
mov word [0x2f8ab40b8], ax
mov edx, 0
mov ecx, 0x83
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
and ax, 0x6248
mov word [0x2f8ab40b8], ax
movzx eax, byte [0x2f8ab40b5]
movzx eax, al
imul ax, ax, 0xe536
mov word [0x2f8ab40ba], ax
movzx eax, word [0x2f8ab40b8]
mov edx, 0x31
imul eax, edx
mov byte [0x2f8ab40b4], al
mov eax, dword [0x2f8ab40bc]
imul ax, ax, 0x6edc
mov word [0x2f8ab40ba], ax
movzx eax, word [0x2f8ab40b6]
sub eax, 0x1f
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40b0]
sub ax, 0x78cf
mov word [0x2f8ab40b8], ax
movzx edx, word [0x2f8ab40b6]
mov eax, edx
shl eax, 0xa
add eax, edx
shl eax, 2
add eax, edx
mov word [0x2f8ab40b8], ax
mov ecx, 0xb6
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
movzx eax, word [0x2f8ab40b6]
xor eax, 0x11
mov byte [0x2f8ab40b4], al
mov eax, dword [0x2f8ab40b0]
and eax, 0xffffff81
mov byte [0x2f8ab40b4], al
add dword [rbp - 4], 1
shl byte [rbp - 0xd], 1
movzx eax, byte [rbp - 0xd]
mov byte [rbp - 7], al
movzx eax, word [0x2f8ab40b8]
xor ax, 0x6fdc
mov word [0x2f8ab40b6], ax
movzx eax, word [0x2f8ab40ba]
and eax, 0x7c
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40b0]
xor eax, 0xffffffbd
mov byte [0x2f8ab40b5], al
movzx eax, word [0x2f8ab40b8]
imul ax, ax, 0x5f25
mov word [0x2f8ab40b8], ax
movzx eax, word [0x2f8ab40b8]
movzx eax, ax
sub eax, 0x12364fdf
mov dword [0x2f8ab40bc], eax
mov eax, dword [0x2f8ab40b0]
xor ax, 0x9fc9
mov word [0x2f8ab40b8], ax
add dword [rbp - 4], 1
mov eax, dword [0x2f8ab40b0]
sub eax, 0x440ba428
mov dword [0x2f8ab40bc], eax
mov eax, dword [0x2f8ab40b0]
mov edx, 0xffffff86
imul eax, edx
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40b6]
sub ax, 0x5c1e
mov word [0x2f8ab40b8], ax
movzx eax, byte [0x2f8ab40b5]
and eax, 0xffffffad
mov byte [0x2f8ab40b4], al
movzx eax, word [0x2f8ab40b6]
sub eax, 0x5b
mov byte [0x2f8ab40b5], al
mov eax, dword [0x2f8ab40bc]
sub eax, 0x73
mov byte [0x2f8ab40b5], al
movzx eax, byte [0x2f8ab40b4]
sub eax, 0x2d
mov byte [0x2f8ab40b4], al
mov eax, dword [rbp - 0xc]
movsxd rdx, eax
mov rax, qword [rbp + 0x18]
add rax, rdx
movzx eax, byte [rax]
mov edx, dword [rbp - 0xc]
movsxd rcx, edx
mov rdx, qword [rbp + 0x18]
add rdx, rcx
xor al, byte [rbp - 0xd]
mov byte [rdx], al
mov eax, dword [0x2f8ab40b0]
xor eax, 0xfffffffb
mov byte [0x2f8ab40b5], al
movzx eax, word [0x2f8ab40b6]
or ax, 0xf526
mov word [0x2f8ab40b8], ax
mov eax, dword [0x2f8ab40bc]
add eax, 0x39
mov byte [0x2f8ab40b4], al
add dword [rbp - 4], 1
add dword [rbp - 0xc], 1
mov eax, dword [rbp - 0xc]
cdqe
cmp rax, qword [rbp + 0x20]
jb 0x2f8aa72db
nop
nop
add rsp, 0x40
pop rbp
ret