Function at 0x140067d20
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r15, r8
mov esi, edx
mov r14, rcx
mov rax, qword [0x140206880]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r8
call fcn.14002eb10
test rax, rax
je 0x1400687eb
call fcn.1400365a0
mov rbx, rax
call fcn.14002eb10
test rax, rax
je 0x140067d7d
call fcn.1400365a0
mov r13, qword [rax + 0x90]
jmp 0x140067d80
xor r13d, r13d
xor r12d, r12d
cmp esi, 0x1ff
jle 0x140067e65
lea eax, [rsi - 0x200]
cmp eax, 0xa3
ja case.0x140067dae.527
lea rcx, [0x140119864]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor edi, edi
cmp rax, rdx
sete dil
cmp rax, rcx
mov eax, 2
cmove edi, eax
mov ecx, esi
and ecx, 0xfffffffd
xor ebp, ebp
cmp ecx, 0x204
sete bpl
lea ecx, [rsi - 0x207]
test ecx, 0xfffffffd
cmove ebp, eax
cmp esi, 0x20d
je 0x140067e09
cmp esi, 0x20b
jne 0x140067e20
and r15d, 0xffff0000
xor ebp, ebp
cmp r15d, 0x10000
setne bpl
add ebp, 3
cmp dword [r13 + 0x14], 0
jne 0x140067e3b
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x140067e3b
mov rcx, r14
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, 1
shlx eax, eax, ebp
or dword [r13 + 0x14], eax
mov rcx, rbx
mov edx, edi
call fcn.14002d020
mov rcx, rbx
mov edx, ebp
mov r8b, 1
call fcn.14002cca0
jmp 0x1400687eb
cmp esi, 0xff
jle 0x140067f60
lea eax, [rsi - 0x100]
cmp eax, 5
ja case.0x140067dae.527
mov ecx, 0x33
bt ecx, eax
jae 0x140068171
cmp r15, 0xff
ja 0x1400687eb
and esi, 0xfffffffb
call fcn.1400365a0
mov rbx, rax
mov r14, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x1000
call fcn.14002ca00
mov ecx, 0x10
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x2000
call fcn.14002ca00
mov ecx, 0x12
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x4000
call fcn.14002ca00
mov ecx, 0x5d
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x8000
call fcn.14002ca00
cmp r15, 0xd
mov ebx, 0x10d
cmovne ebx, r15d
test edi, 0x1000000
cmove ebx, r15d
lea eax, [rbx - 8]
cmp eax, 0x105
ja case.0x140067f54.10
lea rcx, [0x140119af4]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov ebp, 0x20b
jmp 0x140068637
lea eax, [rsi - 7]
cmp eax, 2
jb 0x14006815e
cmp esi, 0x20
je 0x1400681f8
cmp esi, 0xa0
jne case.0x140067dae.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor r8d, r8d
cmp rax, rdx
sete r8b
cmp rax, rcx
mov ebp, 2
cmovne ebp, r8d
xor r15d, r15d
cmp esi, 0x200
setne r15b
inc r15d
mov qword [r13 + 8], r14
cmp dword [r13 + 0x10], r15d
je 0x14006802d
xor eax, eax
cmp esi, 0x200
setne al
movabs rcx, 0x8000000000000018
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x38], 0x18
shl eax, 4
or eax, 2
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], 0
cmp dword [r13 + 0x10], 0
je 0x14006801e
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov dword [r13 + 0x10], r15d
movsx eax, di
mov dword [rsp + 0x50], eax
sar edi, 0x10
mov dword [rsp + 0x54], edi
cmp esi, 0xa0
jne 0x140068059
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1400687eb
mov rcx, rbx
mov edx, ebp
call fcn.14002d020
vcvtsi2ss xmm2, xmm0, dword [rsp + 0x54]
vcvtsi2ss xmm1, xmm0, dword [rsp + 0x50]
mov rcx, rbx
call fcn.14002ca60
jmp 0x1400687eb
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor edi, edi
cmp rax, rdx
sete dil
cmp rax, rcx
mov eax, 2
cmove edi, eax
xor ecx, ecx
cmp esi, 0x205
sete cl
cmp esi, 0x208
cmove ecx, eax
and r15d, 0xffff0000
xor ebp, ebp
cmp r15d, 0x10000
setne bpl
add ebp, 3
cmp esi, 0x20c
cmovne ebp, ecx
mov eax, 0xfffffffe
mov ecx, ebp
rol eax, cl
and dword [r13 + 0x14], eax
jne 0x1400680f9
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r14
jne 0x1400680f9
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, rbx
mov edx, edi
call fcn.14002d020
xor r12d, r12d
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call fcn.14002cca0
jmp case.0x140067dae.527
xor eax, eax
cmp esi, 0x2a3
setne al
inc eax
cmp dword [r13 + 0x10], eax
jne 0x1400687eb
cmp qword [r13 + 8], r14
jne 0x14006813d
mov qword [r13 + 8], 0
mov dword [r13 + 0x10], 0
vmovss xmm1, dword [0x1401119d0]
mov rcx, rbx
vmovaps xmm2, xmm1
call fcn.14002ca60
jmp 0x1400687eb
cmp esi, 7
sete dl
mov rcx, rbx
call fcn.14002d030
jmp 0x1400687eb
cmp eax, 2
jne case.0x140067dae.527
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x14006821a
lea rax, [r15 - 1]
cmp rax, 0xfffe
ja 0x1400687eb
mov rcx, rbx
mov edx, r15d
call fcn.14002c480
jmp 0x1400687eb
sar r15d, 0x10
vcvtsi2ss xmm0, xmm0, r15d
vmulss xmm2, xmm0, dword [0x140119820]
vxorps xmm1, xmm1, xmm1
jmp 0x1400681d7
sar r15d, 0x10
vcvtsi2ss xmm0, xmm0, r15d
vmulss xmm1, xmm0, dword [0x14011981c]
vxorps xmm2, xmm2, xmm2
mov rcx, rbx
call fcn.14002ce90
jmp 0x1400687eb
cmp r15d, 7
jne 0x1400687eb
mov byte [r13 + 0x2d], 1
jmp 0x1400687eb
cmp di, 1
jne 0x1400687eb
mov r12d, 1
call fcn.140067c80
test al, al
je 0x1400687eb
jmp case.0x140067dae.527
mov word [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
xor r12d, r12d
lea r8, [rsp + 0x68]
xor ecx, ecx
mov edx, 1
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [rsp + 0x50]
mov rcx, rbx
call fcn.14002c330
jmp case.0x140067dae.527
mov ebp, 0x200
jmp 0x140068637
shr edi, 0x10
movzx edi, dil
jmp 0x140068675
mov ebp, 0x20d
jmp 0x140068637
mov ebp, 0x257
jmp 0x140068637
mov ebp, 0x253
jmp 0x140068637
mov ebp, 0x20e
jmp 0x140068637
mov ebp, 0x20c
jmp 0x140068637
mov ebp, 0x205
jmp 0x140068637
mov ebp, 0x206
jmp 0x140068637
mov ebp, 0x208
jmp 0x140068637
mov ebp, 0x207
jmp 0x140068637
mov ebp, 0x201
jmp 0x140068637
mov ebp, 0x203
jmp 0x140068637
mov ebp, 0x202
jmp 0x140068637
mov ebp, 0x204
jmp 0x140068637
mov ebp, 0x256
jmp 0x140068637
mov ebp, 0x209
jmp 0x140068637
mov ebp, 0x20a
jmp 0x140068637
mov ebp, 0x218
jmp 0x140068637
mov ebp, 0x219
jmp 0x140068637
mov ebp, 0x21a
jmp 0x140068637
mov ebp, 0x21b
jmp 0x140068637
mov ebp, 0x21c
jmp 0x140068637
mov ebp, 0x21d
jmp 0x140068637
mov ebp, 0x21e
jmp 0x140068637
mov ebp, 0x21f
jmp 0x140068637
mov ebp, 0x220
jmp 0x140068637
mov ebp, 0x221
jmp 0x140068637
mov ebp, 0x222
jmp 0x140068637
mov ebp, 0x223
jmp 0x140068637
mov ebp, 0x224
jmp 0x140068637
mov ebp, 0x225
jmp 0x140068637
mov ebp, 0x226
jmp 0x140068637
mov ebp, 0x227
jmp 0x140068637
mov ebp, 0x228
jmp 0x140068637
mov ebp, 0x229
jmp 0x140068637
mov ebp, 0x22a
jmp 0x140068637
mov ebp, 0x22b
jmp 0x140068637
mov ebp, 0x22c
jmp 0x140068637
mov ebp, 0x22d
jmp 0x140068637
mov ebp, 0x22e
jmp 0x140068637
mov ebp, 0x22f
jmp 0x140068637
mov ebp, 0x230
jmp 0x140068637
mov ebp, 0x231
jmp 0x140068637
mov ebp, 0x232
jmp 0x140068637
mov ebp, 0x233
jmp 0x140068637
mov ebp, 0x234
jmp 0x140068637
mov ebp, 0x235
jmp 0x140068637
mov ebp, 0x236
jmp 0x140068637
mov ebp, 0x237
jmp 0x140068637
mov ebp, 0x238
jmp 0x140068637
mov ebp, 0x239
jmp 0x140068637
mov ebp, 0x23a
jmp 0x140068637
mov ebp, 0x23b
jmp 0x140068637
mov ebp, 0x212
jmp 0x140068637
mov ebp, 0x216
jmp 0x140068637
mov ebp, 0x217
jmp 0x140068637
mov ebp, 0x258
jmp 0x140068637
mov ebp, 0x259
jmp 0x140068637
mov ebp, 0x25a
jmp 0x140068637
mov ebp, 0x25b
jmp 0x140068637
mov ebp, 0x25c
jmp 0x140068637
mov ebp, 0x25d
jmp 0x140068637
mov ebp, 0x25e
jmp 0x140068637
mov ebp, 0x25f
jmp 0x140068637
mov ebp, 0x260
jmp 0x140068637
mov ebp, 0x261
jmp 0x140068637
mov ebp, 0x264
jmp 0x140068637
mov ebp, 0x266
jmp 0x140068637
mov ebp, 0x265
jmp 0x140068637
mov ebp, 0x262
jmp 0x140068637
mov ebp, 0x263
jmp 0x140068637
mov ebp, 0x23c
jmp 0x140068637
mov ebp, 0x23d
jmp 0x140068637
mov ebp, 0x23e
jmp 0x140068637
mov ebp, 0x23f
jmp 0x140068637
mov ebp, 0x240
jmp 0x140068637
mov ebp, 0x241
jmp 0x140068637
mov ebp, 0x242
jmp 0x140068637
mov ebp, 0x243
jmp 0x140068637
mov ebp, 0x244
jmp 0x140068637
mov ebp, 0x245
jmp 0x140068637
mov ebp, 0x246
jmp 0x140068637
mov ebp, 0x247
jmp 0x140068637
mov ebp, 0x255
jmp 0x140068637
mov ebp, 0x254
jmp 0x140068637
mov ebp, 0x210
jmp 0x140068637
mov ebp, 0x214
jmp 0x140068637
mov ebp, 0x20f
jmp 0x140068637
mov ebp, 0x213
jmp 0x140068637
mov ebp, 0x211
jmp 0x140068637
mov ebp, 0x215
jmp 0x140068637
mov ebp, 0x24d
jmp 0x140068637
mov ebp, 0x24e
jmp 0x140068637
mov ebp, 0x249
jmp 0x140068637
mov ebp, 0x24a
jmp 0x140068637
mov ebp, 0x24b
jmp 0x140068637
mov ebp, 0x24c
jmp 0x140068637
mov ebp, 0x252
jmp 0x140068637
mov ebp, 0x24f
jmp 0x140068637
mov ebp, 0x250
jmp 0x140068637
mov ebp, 0x251
jmp 0x140068637
mov ebp, 0x248
jmp 0x140068637
mov ebp, 0x267
cmp esi, 0x100
sete r14b
shr edi, 0x10
movzx edi, dil
call fcn.1400365a0
mov r15, rax
mov rcx, rax
mov edx, ebp
mov r8d, r14d
call fcn.14002ca00
mov dword [rsp + 0x20], 0xffffffff
mov rcx, r15
mov edx, ebp
mov r8d, ebx
mov r9d, edi
call fcn.14002ca30
cmp ebx, 0x12
je 0x140068705
cmp ebx, 0x11
je 0x140068777
cmp ebx, 0x10
jne 0x1400687eb
cmp esi, 0x100
sete bl
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x1400686ca
cmp esi, 0x100
sete dl
mov ecx, 0x210
mov r8d, 0xa0
mov r9d, edi
call fcn.140068810
cmp esi, 0x100
sete bl
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x1400687eb
cmp esi, 0x100
sete dl
mov ecx, 0x214
mov r8d, 0xa1
jmp 0x1400687e3
cmp esi, 0x100
sete bl
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14006873f
cmp esi, 0x100
sete dl
mov ecx, 0x211
mov r8d, 0xa4
mov r9d, edi
call fcn.140068810
cmp esi, 0x100
sete bl
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x1400687eb
cmp esi, 0x100
sete dl
mov ecx, 0x215
mov r8d, 0xa5
jmp 0x1400687e3
cmp esi, 0x100
sete bl
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x1400687b1
cmp esi, 0x100
sete dl
mov ecx, 0x20f
mov r8d, 0xa2
mov r9d, edi
call fcn.140068810
cmp esi, 0x100
sete bl
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x1400687eb
cmp esi, 0x100
sete dl
mov ecx, 0x213
mov r8d, 0xa3
mov r9d, edi
call fcn.140068810
xor r12d, r12d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400f4f10
mov rax, r12
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret