Function at 0x180002cd0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push r15
sub rsp, 0x88
mov rax, qword [0x180035020]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, rcx
mov rbx, rdx
mov rcx, qword [rcx + 0xa8]
mov edx, 0x133f
mov qword [rsp + 0x20], rcx
mov rax, qword [r15 + 0x380]
mov qword [rsp + 0x28], rax
mov rax, qword [r15 + 0x4b0]
mov qword [rsp + 0x30], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [r15 + 0x380]
mov edx, 0x1359
mov qword [rsp + 0x50], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [r15 + 0x4b0]
mov edx, 0x134d
mov qword [rsp + 0x58], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [r15 + 0xa8]
mov edx, 0x134c
mov qword [rsp + 0x60], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [r15 + 0x380]
mov edx, 0x135a
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, qword [r15 + 0x4b0]
mov edx, 0x1355
mov qword [rsp + 0x40], rax
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowEnabled]
mov rcx, qword [r15 + 0x4b0]
mov edx, 0x1355
test eax, eax
jne 0x180002db0
mov edx, 0x1353
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [rbx + 8], 0x100
mov qword [rsp + 0xb0], rbp
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x48], rax
jne 0x180002f17
cmp qword [rbx + 0x10], 9
jne 0x180002f17
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x180002f17
mov rcx, qword [r15 + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r15 + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1304
mov rdi, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x10
mov rbx, rax
lea esi, [rax - 1]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x180002e4b
test edi, edi
cmove edi, ebx
dec edi
jmp 0x180002e55
cmp edi, esi
jne 0x180002e53
xor edi, edi
jmp 0x180002e55
inc edi
mov rcx, qword [r15 + 0x50]
xor r9d, r9d
movsxd r8, edi
mov edx, 0x130c
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [r15 + 0xa8]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [r15 + 0x380]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [r15 + 0x4b0]
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [r15 + 0x50]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [r15 + 0x7c0], eax
test eax, eax
je 0x180002efb
sub eax, 1
je 0x180002edf
cmp eax, 1
jne 0x180002ff2
mov rcx, qword [r15 + 0x4b0]
lea edx, [rax + 4]
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x180003090
mov rcx, qword [r15 + 0x380]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x180003090
mov rcx, qword [r15 + 0xa8]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
jmp 0x180003090
xor edi, edi
cmp dword [rbx + 8], 0x100
jne 0x180002f5c
cmp qword [rbx + 0x10], 9
jne 0x180002f5c
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [r15 + 0x50]
jne 0x180002f5c
mov esi, edi
lea r14, [rsp + 0x20]
nop dword [rax]
mov rcx, qword [r14]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x180002fe4
inc esi
add r14, 8
cmp esi, 3
jb 0x180002f40
mov ebp, edi
lea rsi, [rsp + 0x38]
cmp dword [rbx + 8], 0x100
jne 0x180002f7e
cmp qword [rbx + 0x10], 9
jne 0x180002f7e
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, qword [rsi]
je 0x180002ffc
inc ebp
add rsi, 8
cmp ebp, 3
jb 0x180002f63
cmp dword [rbx + 8], 0x104
jne 0x180003042
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x180003042
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 0x41]
cmp rax, 0x19
ja 0x180003042
add rcx, 0xffffffffffffffbf
cmp rcx, 0x11
ja 0x18000301b
mov eax, 0x2008d
bt rax, rcx
jae 0x18000301b
mov rcx, qword [r15 + 8]
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
mov qword [rbx], rax
jmp 0x180003042
movsxd rcx, esi
mov rcx, qword [rsp + rcx*8 + 0x50]
call qword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
jmp 0x180003090
mov rcx, qword [r15 + 8]
mov edx, 0x1335
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
jmp 0x180003090
mov ebp, edi
mov rsi, rdi
mov rcx, qword [rsp + rsi + 0x20]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x180003037
mov rax, qword [rsp + rsi + 0x50]
mov qword [rbx], rax
inc ebp
add rsi, 8
cmp ebp, 3
jb 0x180003020
lea rsi, [rsp + 0x20]
nop word [rax + rax]
mov rbp, qword [rsi]
mov rcx, rbp
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x180003070
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x180002ff2
inc edi
add rsi, 8
cmp edi, 3
jb 0x180003050
mov rcx, qword [r15 + 8]
mov rdx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x180002ff2
mov r14, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180021550
add rsp, 0x88
pop r15
pop rbx
ret