Function at 0x696f7e60
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rbp, qword [rsp + 0x1d0]
mov r12, rdx
lea r14, [rsp + 0x4c]
mov r15, r9
mov edi, r8d
mov qword [rsp + 0x4c], 0
mov rbx, rcx
mov rcx, r14
mov r13d, r15d
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdx, qword [r12 + 0x10]
mov eax, dword [rsp + 0x50]
mov esi, dword [rsp + 0x4c]
mov rcx, qword [rdx + 0x30]
mov dword [rsp + 0x38], eax
mov rdx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rcx, rbp
mov r14, qword [sym.imp.USER32.dll_MapVirtualKeyA]
sar rcx, 0x10
movzx r12d, cl
cmp r15, 0x10
je 0x696f80b0
xor edx, edx
mov ecx, r13d
and ebp, 0x1000000
call r14
mov edx, 2
mov ecx, r13d
mov dword [rsp + 0x3c], eax
call r14
xor r8d, r8d
test dil, dil
sete r8b
mov r14d, eax
add r8d, 9
mov dword [rbx], r8d
call qword [sym.imp.USER32.dll_GetMessageTime]
pxor xmm0, xmm0
mov ecx, 0x10
mov rdi, qword [sym.imp.USER32.dll_GetKeyState]
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x699f3928]
movsd qword [rbx + 8], xmm0
call rdi
mov ecx, 0x11
movsx r15d, ax
call rdi
shr r15d, 0x1f
mov ecx, 0x12
mov r9d, r15d
or r9d, 2
test ax, ax
cmovs r15d, r9d
call rdi
mov ecx, 0x5b
mov r10d, r15d
or r10d, 4
test ax, ax
cmovs r15d, r10d
call rdi
mov ecx, 0x5c
mov r11d, r15d
or r11d, 8
test ax, ax
cmovs r15d, r11d
call rdi
pxor xmm2, xmm2
pxor xmm1, xmm1
mov dword [rbx + 0x34], r12d
pxor xmm3, xmm3
cvtsi2sd xmm2, dword [rsp + 0x4c]
pxor xmm4, xmm4
mov edx, eax
cvtsi2sd xmm3, esi
mov eax, r15d
lea esi, [r13 - 0x70]
mov dword [rbx + 0x38], 0
cvtsi2sd xmm1, dword [rsp + 0x50]
or eax, 8
test dx, dx
cvtsi2sd xmm4, dword [rsp + 0x38]
cmovs r15d, eax
mov dword [rbx + 0x30], r15d
unpcklpd xmm2, xmm1
unpcklpd xmm3, xmm4
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm3
cmp esi, 0xb
ja 0x696f8020
lea r12d, [r13 + 0xdf90]
mov dword [rbx + 0x38], r12d
mov r8d, r15d
sub r12d, 0xe051
and r8d, 0xfffffffe
cmp r12d, 2
cmovb r15d, r8d
mov dword [rbx + 0x30], r15d
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp rbp, 1
lea ecx, [r13 - 0x21]
sbb r12d, r12d
and r12d, 0x40
add r12d, 0xe031
add r12d, ecx
cmp ecx, 7
jbe 0x696f83a6
lea r12d, [r13 - 0x60]
cmp r12d, 9
ja 0x696f8070
lea r12d, [r13 + 0xe000]
mov dword [rbx + 0x38], r12d
sub r12d, 0xe057
cmp r12d, 1
ja 0x696f8001
and r15d, 0xfffffff7
jmp 0x696f8001
lea r8d, [r13 - 0x6a]
cmp r8d, 5
jbe 0x696f80c8
lea edi, [r13 - 0xa0]
cmp edi, 5
ja 0x696f80f0
lea r12d, [r13 + 0xdfb1]
mov dword [rbx + 0x38], r12d
cmp r12d, 0xe054
jbe 0x696f80d1
nop word [rax + rax]
and r15d, 0xfffffffb
jmp 0x696f8001
mov edx, 3
mov ecx, r12d
call r14
mov r13d, eax
jmp 0x696f7edb
lea r12d, [r13 + 0xe040]
jmp 0x696f8053
cmp r12d, 0xe052
jbe 0x696f7feb
and r15d, 0xfffffffd
jmp 0x696f8001
cmp r13d, 0x2c
ja 0x696f8130
cmp r13d, 7
jbe case.0x696f811c.9
lea r10d, [r13 - 8]
cmp r10d, 0x24
ja case.0x696f811c.9
lea r11, [0x699f331c]
movsxd rdx, dword [r11 + r10*4]
add rdx, r11
jmp rdx
mov r13d, 0xe09d
mov dword [rbx + 0x38], r13d
jmp 0x696f8001
cmp r13d, 0x90
je 0x696f83e0
jbe 0x696f8160
cmp r13d, 0x91
jne 0x696f83f0
mov dword [rbx + 0x38], 0xe046
jmp 0x696f8001
cmp r13d, 0x5b
je 0x696f83d0
cmp r13d, 0x5c
jne case.0x696f811c.9
mov dword [rbx + 0x38], 0xe058
jmp 0x696f8064
mov dword [rbx + 0x38], 0xe041
jmp 0x696f8001
mov dword [rbx + 0x38], 0xe047
jmp 0x696f8001
mov dword [rbx + 0x38], 0xe043
jmp 0x696f8001
mov r9d, r13d
test rbp, rbp
je 0x696f83fc
sub r9, 0xd
cmp r9, 0x21
ja 0x696f81cb
lea rax, [0x69a01fa0]
movzx r12d, word [rax + r9*2]
test r12d, r12d
jne 0x696f83a6
test r14d, r14d
js 0x696f8005
xor r14d, r14d
lea r9, [rsp + 0x56]
lea r8, [rsp + 0x60]
mov ecx, r13d
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x56], 0
mov edx, dword [rsp + 0x3c]
mov word [rsp + 0x5e], r14w
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_ToUnicode]
movzx r15d, word [rsp + 0x56]
mov ecx, 0xfffd
lea esi, [r15 - 0xd800]
cmp esi, 0x3ff
cmovbe r15d, ecx
mov dword [rbx + 0x38], r15d
jmp 0x696f8005
mov dword [rbx + 0x38], r12d
cmp r12d, 0xe054
jbe 0x696f80d1
cmp r12d, 0xe056
jbe 0x696f80a0
jmp 0x696f8057
mov dword [rbx + 0x38], 0xe057
jmp 0x696f8064
mov dword [rbx + 0x38], 0xe045
jmp 0x696f8001
mov r9d, r13d
test rbp, rbp
jne 0x696f81cb
sub r9, 0x10
cmp r9, 0x1e
ja 0x696f81cb
lea rbp, [0x69a02000]
mov r12d, dword [rbp + r9*4]
jmp 0x696f81c2