Function at 0x1400334bc
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov rax, qword [0x14007b040]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rsi, qword [0x14007cef0]
xor r10d, r10d
mov qword [rbp + 7], r8
mov r12, r9
mov edi, edx
mov r13, rcx
test rsi, rsi
je 0x140033ce1
mov r14, qword [rsi + 0x98]
test r14, r14
je 0x140033ce1
add rsi, 8
lea r15d, [r10 + 2]
mov eax, 0x203
cmp edx, eax
ja 0x140033aaa
je 0x140033bd9
mov eax, 0x101
lea ebx, [r10 + 1]
cmp edx, eax
ja 0x14003372f
je 0x140033859
mov eax, edx
sub eax, 7
je 0x140033697
sub eax, ebx
je 0x140033697
sub eax, 0x18
je 0x140033678
sub eax, 0x31
je 0x14003366e
sub eax, 0x2d
je 0x140033665
sub eax, 0x22
je 0x140033769
cmp eax, 0x60
jne 0x140033ce1
mov dil, bl
mov r14d, pe_nt_image_headers64
cmp r8, r14
jae 0x140033ce1
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x1000
and al, bl
mov rcx, rsi
mov r8b, al
call fcn.1400028ac
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x2000
and al, bl
mov rcx, rsi
mov r8b, al
call fcn.1400028ac
mov r15d, 0x12
mov ecx, r15d
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x4000
and al, bl
mov rcx, rsi
mov r8b, al
call fcn.1400028ac
lea ecx, [r15 + 0x4b]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov edx, 0x8000
and al, bl
mov rcx, rsi
mov r8b, al
call fcn.1400028ac
mov rsi, qword [rbp + 7]
cmp rsi, 0xd
jne 0x140033632
shr r12, 0x10
lea eax, [r14 + 0xd]
test r14w, r12w
cmovne esi, eax
movsxd rcx, esi
call fcn.140032e4c
mov r14d, eax
mov eax, 0x262
cmp r14d, eax
jne 0x140033861
test dil, dil
jne 0x140033866
mov r8d, esi
mov dl, bl
mov ecx, eax
call fcn.140032344
jmp 0x140033866
mov byte [r14 + 0x30], bl
jmp 0x140033ce1
call fcn.1400320b4
jmp 0x140033ce1
cmp r12w, bx
jne 0x140033ce1
call fcn.140032298
test al, al
je 0x140033ce1
mov rax, rbx
jmp 0x140033ce3
mov rcx, qword [rsi + 0xf0]
cmp edi, 7
sete r8b
lea r9, [rcx + 0x40f8]
mov eax, dword [r9]
sub eax, ebx
js 0x1400336cf
movsxd rdx, eax
imul rax, rdx, 0x1c
add rax, qword [rcx + 0x4100]
cmp dword [rax], 7
je 0x140033725
sub rax, 0x1c
sub rdx, rbx
jns 0x1400336c1
cmp byte [rcx + 0x2bc0], r10b
sete dl
cmp dl, r8b
je 0x140033ce1
cmp byte [rsi + 0x7b], r10b
je 0x1400336f1
cmp edi, 7
jne 0x140033ce1
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x29], eax
mov eax, dword [rcx + 0x411c]
mov dword [rbp - 0x39], eax
inc eax
mov dword [rcx + 0x411c], eax
mov rcx, r9
mov dword [rbp - 0x41], 7
mov byte [rbp - 0x35], r8b
jmp 0x140033a9c
test rax, rax
je 0x1400336cf
mov dl, byte [rax + 0xc]
jmp 0x1400336d9
mov eax, edi
sub eax, 0x102
je 0x140033974
sub eax, r15d
je 0x14003384d
sub eax, ebx
je 0x14003384d
sub eax, 0xfb
je 0x140033769
sub eax, ebx
je 0x140033bde
cmp eax, ebx
je 0x140033b02
jmp 0x140033ce1
call fcn.140033484
xor ecx, ecx
mov dword [rbp - 0x49], eax
mov eax, ecx
mov qword [r14 + 8], r13
mov edx, 0x200
cmp edi, edx
setne al
add eax, ebx
mov dword [rbp - 9], eax
cmp dword [r14 + 0x10], eax
je 0x1400337df
lea eax, [rcx + 0x18]
mov dword [rbp - 0x1d], 0x80000000
cmp edi, edx
mov dword [rbp - 0x21], eax
mov dword [rbp - 0x41], eax
lea eax, [rcx + 0x12]
cmovne r15d, eax
mov qword [rbp - 0x19], r13
mov dword [rbp - 0x3d], r15d
mov dword [rbp - 0x11], ecx
mov qword [rbp - 0x39], r13
mov dword [rbp - 0x31], ecx
cmp dword [r14 + 0x10], ecx
je 0x1400337c9
lea rcx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rbp - 0x41]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov eax, dword [rbp - 9]
mov edx, 0x200
mov dword [r14 + 0x10], eax
movsx eax, r12w
mov dword [rbp - 1], eax
shr r12, 0x10
movsx eax, r12w
mov dword [rbp + 3], eax
mov eax, dword [rsi]
shr eax, 0xa
and al, bl
cmp edi, edx
jne 0x14003380f
test al, al
je 0x140033828
lea rdx, [rbp - 1]
mov rcx, r13
call qword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x140033828
cmp edi, 0xa0
jne 0x140033828
test al, al
jne 0x140033828
lea rdx, [rbp - 1]
mov rcx, r13
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsi + 0xf0]
mov ecx, dword [rbp - 0x49]
mov dword [rax + 0x4118], ecx
movd xmm2, dword [rbp + 3]
movd xmm1, dword [rbp - 1]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
jmp 0x140033cd9
cmp edi, 0x104
je 0x140033584
mov dil, r10b
jmp 0x140033587
test r14d, r14d
je 0x140033874
mov r8d, esi
mov dl, dil
mov ecx, r14d
call fcn.140032344
cmp esi, 0x10
jne 0x1400338c6
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
cmp al, dil
jne 0x1400338a1
mov r8d, 0xa0
mov dl, dil
mov ecx, 0x210
call fcn.140032344
mov esi, 0xa1
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
cmp al, dil
jne 0x140033ce1
mov ecx, 0x214
jmp 0x140033964
cmp esi, 0x11
jne 0x140033914
mov esi, 0xa2
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
cmp al, dil
jne 0x1400338f2
mov r8d, esi
mov dl, dil
mov ecx, 0x20f
call fcn.140032344
mov esi, 0xa3
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
cmp al, dil
jne 0x140033ce1
mov ecx, 0x213
jmp 0x140033964
cmp esi, r15d
jne 0x140033ce1
mov esi, 0xa4
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
cmp al, dil
jne 0x140033944
mov r8d, esi
mov dl, dil
mov ecx, 0x211
call fcn.140032344
mov esi, 0xa5
mov ecx, esi
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, bl
cmp al, dil
jne 0x140033ce1
mov ecx, 0x215
mov r8d, esi
mov dl, dil
call fcn.140032344
jmp 0x140033ce1
call qword [sym.imp.USER32.dll_IsWindowUnicode]
xor edi, edi
test eax, eax
je 0x140033a2b
mov rbx, qword [rbp + 7]
lea rax, [rbx - 1]
cmp rax, 0xfffe
ja 0x140033ce1
test bx, bx
jne 0x1400339aa
cmp word [rsi + 0x2bbc], di
je 0x140033ce1
cmp byte [rsi + 0x2bb9], dil
je 0x140033ce1
mov ecx, 0xfc00
movzx eax, bx
and ax, cx
mov edx, 0xd800
movzx ecx, word [rsi + 0x2bbc]
cmp ax, dx
jne 0x1400339f1
test cx, cx
je 0x1400339e5
mov edx, 0xfffd
mov rcx, rsi
call fcn.140002650
mov word [rsi + 0x2bbc], bx
jmp 0x140033ce1
test cx, cx
je 0x140033a1b
mov ecx, 0xdc00
cmp ax, cx
je 0x140033a0f
mov edx, 0xfffd
mov rcx, rsi
call fcn.140002650
jmp 0x140033a14
mov ebx, 0xfffd
mov word [rsi + 0x2bbc], di
movzx edx, bx
mov rcx, rsi
call fcn.140002650
jmp 0x140033ce1
mov ecx, dword [r14 + 0x2c]
lea rax, [rbp - 9]
mov dword [rsp + 0x28], ebx
lea r8, [rbp + 7]
mov r9d, ebx
mov qword [rsp + 0x20], rax
mov edx, ebx
mov word [rbp - 9], di
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [rbp - 9]
mov rcx, qword [rsi + 0xf0]
test edx, edx
je 0x140033ce1
cmp byte [rsi + 0x2bb9], dil
je 0x140033ce1
mov eax, dword [rcx + 0x411c]
mov dword [rbp - 0x39], eax
inc eax
mov dword [rcx + 0x411c], eax
add rcx, 0x40f8
mov qword [rbp - 0x31], rdi
mov dword [rbp - 0x29], edi
mov dword [rbp - 0x41], 6
mov dword [rbp - 0x3d], r15d
mov dword [rbp - 0x35], edx
lea rdx, [rbp - 0x41]
call fcn.140023198
jmp 0x140033ce1
mov eax, 0x219
cmp edi, eax
ja 0x140033c99
je 0x140033c8c
mov eax, 0x209
cmp edi, eax
ja 0x140033b82
je 0x140033bd9
mov eax, edi
sub eax, 0x204
je 0x140033bd9
sub eax, 1
je 0x140033afd
sub eax, 1
je 0x140033bd9
sub eax, 1
je 0x140033bd9
cmp eax, 1
jne 0x140033ce1
mov ebx, 1
call fcn.140033484
xor edx, edx
mov r12d, eax
cmp edi, 0x205
mov ecx, edx
sete cl
cmp edi, 0x208
je 0x140033b40
mov r15d, ecx
cmp edi, 0x20c
jne 0x140033b40
mov rax, qword [rbp + 7]
mov r15d, edx
shr rax, 0x10
cmp ax, bx
setne r15b
add r15d, 3
mov eax, dword [r14 + 0x14]
btr eax, r15d
mov dword [r14 + 0x14], eax
test eax, eax
jne 0x140033b61
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r13
jne 0x140033b61
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rax, qword [rsi + 0xf0]
xor r8d, r8d
mov edx, r15d
mov dword [rax + 0x4118], r12d
mov rcx, rsi
call fcn.140002a10
jmp 0x140033ce1
mov eax, edi
sub eax, 0x20a
je 0x140033c6d
sub eax, 1
je 0x140033bd9
sub eax, 1
je 0x140033afd
sub eax, 1
je 0x140033bd9
cmp eax, 1
jne 0x140033ce1
shr r8, 0x10
xorps xmm2, xmm2
movsx eax, r8w
movd xmm1, eax
cvtdq2ps xmm1, xmm1
xorps xmm1, xmmword [0x1400743b0]
divss xmm1, dword [0x140073ef8]
mov rcx, rsi
call fcn.140002bc8
jmp 0x140033ce1
mov ebx, 1
call fcn.140033484
mov edx, 0xfffffffd
mov dword [rbp - 0x49], eax
lea ecx, [rdi - 0x204]
mov r8d, 0
test edx, ecx
lea eax, [rdi - 0x20b]
mov r12d, r8d
lea ecx, [rdi - 0x207]
cmove r12d, ebx
test edx, ecx
cmove r12d, r15d
test edx, eax
jne 0x140033c2c
mov rax, qword [rbp + 7]
mov r12d, r8d
shr rax, 0x10
cmp ax, bx
setne r12b
add r12d, 3
cmp dword [r14 + 0x14], r8d
jne 0x140033c46
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x140033c46
mov rcx, r13
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [r14 + 0x14]
mov r8b, bl
mov ecx, dword [rbp - 0x49]
bts eax, r12d
mov dword [r14 + 0x14], eax
mov edx, r12d
mov rax, qword [rsi + 0xf0]
mov dword [rax + 0x4118], ecx
jmp 0x140033b75
shr r8, 0x10
xorps xmm1, xmm1
movsx eax, r8w
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm2, dword [0x140073ef8]
jmp 0x140033bcc
cmp r8d, 7
jne 0x140033ce1
mov byte [r14 + 0x32], 1
jmp 0x140033ce1
mov eax, edi
sub eax, 0x2a2
je 0x140033ca7
cmp eax, 1
jne 0x140033ce1
cmp edi, 0x2a3
mov eax, r10d
mov ebx, 1
setne al
add eax, ebx
cmp dword [r14 + 0x10], eax
jne 0x140033ce1
cmp qword [r14 + 8], r13
jne 0x140033cca
mov qword [r14 + 8], r10
movss xmm1, dword [0x140073f48]
movaps xmm2, xmm1
mov dword [r14 + 0x10], r10d
mov rcx, rsi
call fcn.1400028d8
xor eax, eax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.140042580
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret