Function at 0x14022caf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov rdi, rdx
mov rbx, rcx
call qword [rax + 0x150]
test al, al
jne 0x14022cb3b
mov eax, dword [rdi]
sub eax, 0x13
cmp eax, 0x12
ja 0x14022cb3b
mov rcx, qword [rbx + 0x38]
mov rdx, rdi
test rcx, rcx
je 0x14022cd72
mov rax, qword [rcx]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x238]
mov eax, dword [rdi]
cmp eax, 1
jne 0x14022cb5c
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x420]
cmp eax, 6
je 0x14022cd90
cmp eax, 7
je 0x14022cd84
cmp eax, 0x3f
je 0x14022cd84
cmp eax, 0x3e
jne 0x14022cb9f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x3e8]
mov rax, qword [rbx]
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x188]
cmp eax, 0x3d
jne 0x14022cc10
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x3e8]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x188]
mov ecx, dword [rbx + 0x730]
sub ecx, 1
je 0x14022cbef
sub ecx, 1
je 0x14022cbe8
sub ecx, 1
je 0x14022cbe1
cmp ecx, 1
jne 0x14022cd90
mov edx, reloc.SinoSPE.dll_Ordinal_40
jmp 0x14022cbf4
mov edx, reloc.SinoSPE.dll_Ordinal_39
jmp 0x14022cbf4
mov edx, Ordinal_40
jmp 0x14022cbf4
mov edx, Ordinal_40
lea rcx, [rbx + 0x6b8]
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401d4f40
cmp eax, 0x16
jne 0x14022cc2f
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x428]
cmp eax, 0xd
jne 0x14022cc4e
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x430]
cmp eax, 0xf
jne 0x14022cd5e
mov qword [rsp + 0x30], rbp
mov ecx, reloc.SinoSPE.dll_Ordinal_17
mov qword [rsp + 0x38], rsi
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x80
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetUBound
movzx esi, ax
and si, bp
call qword [sym.imp.USER32.dll_GetKeyState]
and ax, bp
mov rbp, qword [rsp + 0x30]
cmp qword [rbx + 0x830], 0
jne 0x14022cd13
test si, si
jne 0x14022cd13
test ax, ax
jne 0x14022cd13
mov rcx, qword [rbx + 0x6e0]
mov rax, qword [rbx + 0x6e8]
sub rax, rcx
cmp rax, 0x10
jne 0x14022cd13
movups xmm0, xmmword [rcx]
movq r8, xmm0
test r8d, r8d
js 0x14022cd13
mov rax, r8
shr rax, 0x20
test eax, eax
js 0x14022cd13
psrldq xmm0, 8
movq rdx, xmm0
test edx, edx
js 0x14022cd13
mov rcx, rdx
shr rcx, 0x20
test ecx, ecx
js 0x14022cd13
cmp r8d, edx
jne 0x14022cd13
cmp eax, ecx
jne 0x14022cd13
mov rdx, r8
mov rcx, rbx
shr rdx, 0x20
call fcn.14022c560
test rax, rax
je 0x14022cd13
mov r8, qword [rbx]
mov rdx, rax
mov rcx, rbx
call qword [r8 + 0x3e0]
cmp qword [rbx + 0x830], 0
mov rsi, qword [rsp + 0x38]
je 0x14022cd3c
mov r9, qword [rdi + 0x28]
mov edx, 0x102
mov r8, qword [rdi + 0x20]
mov rcx, qword [0x1404c4920]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbx + 0x7e8]
test rcx, rcx
je 0x14022cd90
mov rax, qword [rcx]
xor edx, edx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [rax + 0x120]
cmp eax, 0x21
jne 0x14022cd6f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x3e8]
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1401be2f0
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x3e8]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret