Function at 0x6b140bb1
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x1e0
cmp r8, r11
jns 0x6b140c27
test qword [0x6b1ab779], r9
jne 0x6b140bd1
lea r9, [rbp - 0xfc]
movzx eax, ax
movzx eax, byte [rbp - 0x13]
mov edx, edx
mov qword [rbp - 0xa5], rdx
mov dl, byte [rbp - 0x19]
mov edx, ecx
and edx, 0xb379
mov rax, r9
movzx eax, ch
mov edx, dword [rbp - 0xc]
mov qword [rbp - 0x8b], r10
movzx edx, ah
add edx, eax
sub eax, eax
mov qword [rbp - 0x1b4], rax
mov qword [0x6b1aaeae], r8
mov eax, 0xd6f1
lea rdx, [rbp - 0x1bf]
mov dword [rbp - 0x63], eax
movzx ecx, word [rbp - 0xa1]
mov r11, rcx
mov ecx, edx
cmp rcx, 0x519e0268
je 0x6b140c7b
sub eax, dword [rbp - 0x67]
mov dl, byte [0x6b1a7c0e]
mov dword [rbp - 0x153], ecx
mov edx, 0x2af6
or rdx, qword [rbp - 0x8f]
mov edx, ecx
mov dword [0x6b1a9a8a], ecx
mov rcx, r10
lea rax, [rbp - 0x1b2]
mov r11, 0x954
mov ecx, ecx
mov qword [rbp - 0x18a], r10
mov eax, dword [rbp - 0xe5]
sub dword [rbp - 0x72], ecx
mov r11, rcx
mov r11, r10
test eax, eax
jns 0x6b140c8e
mov rdx, r9
sub edx, dword [rbp - 0x1b1]
mov byte [rbp - 0x99], ah
mov ecx, ecx
or rcx, 0x4fc9
movzx edx, ch
mov qword [rbp - 0xa5], r10
mov dword [rbp - 0x118], edx
cmp dx, 0xa2ea
jae 0x6b140cf9
lea ecx, [rbp - 0x1d0]
mov qword [0x6b1a7095], r11
mov edx, 0x678a
add eax, ecx
movzx eax, ah
mov qword [rbp - 0x70], r9
test dword [0x6b1a25a3], edx
jno 0x6b140cd7
mov qword [rbp - 0xf7], r8
mov r10, r10
mov eax, dword [rbp - 0x59]
sub r9, 0x326e
mov qword [rbp - 0x17b], r10
call sub.USER32.dll_GetMenuItemRect
or ecx, ecx
mov r9, qword [rbp - 0x125]
test r8, rcx
je 0x6b140d78
mov rcx, qword [rbp - 0x9e]
mov dword [rbp - 0x1a9], edx
lea r11, [rbp - 0x1de]
mov qword [rbp - 0x1d5], rcx
cmp edx, 0x61ea5e53
je 0x6b140d4b
mov dword [rbp - 0x102], ecx
mov qword [rbp - 0x14a], r9
mov qword [rbp - 0x32], r10
mov ax, cx
mov rcx, rax
xor dword [rbp - 0xd9], edx
mov dword [rbp - 0x18c], edx
mov rcx, r9
movzx edx, ah
mov ecx, dword [rbp - 0x1bd]
mov eax, edx
xor edx, dword [rbp - 0xb3]
mov word [rbp - 0x150], dx
lea eax, [rbp - 0x30]
add edx, dword [rbp - 0x1ca]
and eax, 0x91c4
and r8, qword [rbp - 0x45]
mov ax, word [rbp - 0xc3]
mov dword [0x6b1a7c0e], ecx
xor r11, qword [rbp - 0x1a9]
test eax, eax
je 0x6b140da4
mov eax, edx
mov qword [rbp - 0xb6], rcx
mov edx, dword [rbp - 0x65]
mov eax, ecx
sub ecx, dword [rbp - 0xd6]
mov r8, r11
mov ecx, dword [rbp - 0x1ce]
mov edx, edx
movzx eax, byte [0x6b1a3e6d]
mov rcx, qword [rbp - 0xa7]
mov cx, ax
mov qword [rbp - 0xae], rax
mov edx, edx
cmp ecx, eax
jb 0x6b140ddf
mov dword [rbp - 0x1db], edx
mov rax, rcx
mov r8, r8
mov dword [rbp - 0x173], edx
push r8
add ecx, dword [rbp - 0x1a5]
cmp ecx, 0x41efc145
je 0x6b140def
mov eax, dword [rbp - 3]
xor eax, dword [rbp - 0xfa]
cmp ecx, edx
jo 0x6b140e1a
sub dword [rbp - 0x8d], edx
mov dword [0x6b1a8508], eax
mov ecx, dword [rbp - 0x17e]
or eax, 0x8f64
mov rax, qword [rbp - 0x110]
mov ecx, ecx
mov qword [rbp - 0x108], rcx
or eax, dword [rbp - 0x97]
mov r8, qword [rbp - 0xa3]
lea edx, [rbp - 0x1b6]
mov dword [rbp - 0x50], edx
mov dword [rbp - 0xc8], eax
push r9
and eax, 0x75d1
lea eax, [rbp - 0x178]
mov r9, qword [rbp - 0x1ad]
mov edx, eax
and ecx, dword [rbp - 0xd3]
sub qword [rbp - 0x4b], r8
mov cl, ch
mov ecx, dword [rbp - 0x18d]
cmp eax, dword [0x6b1a8637]
je 0x6b140e9f
cmp r9, 0x46757529
je 0x6b140e78
sub r9, qword [0x6b1a7d4d]
mov eax, eax
mov rcx, qword [rbp - 0x1af]
mov ecx, dword [rbp - 0x125]
add r10, r9
mov r10, qword [rbp - 0x9d]
mov rdx, qword [rbp - 0xa5]
movzx eax, ah
mov dword [rbp - 0x1d3], eax
mov eax, 0x38b1
sub ecx, 0xa2d7
mov dword [rbp - 0x6f], edx
mov edx, dword [rbp - 0x64]
mov qword [rbp - 0x96], r9
mov dword [rbp - 0xc1], edx
call sub.USER32.dll_GetKeyboardState
sub dword [rbp - 0x42], ecx
movzx edx, ah
mov r10, 0x88d9
cmp r11, 0x52d87e01
jb 0x6b140ef1
mov r11, qword [rbp - 0x7d]
mov ecx, 0xa836
mov rcx, 0x460
movzx edx, al
call sub.USER32.dll_DialogBoxParamW
mov qword [rbp - 0x27], rax
mov qword [rbp - 0xc], rdx
add dword [rbp - 0xee], ecx
sub r10, rdx
sub ecx, dword [rbp - 0xab]
mov r11, qword [rbp - 0x148]
mov r10, rax
movzx edx, word [rbp - 0x19b]
mov qword [rbp - 0x11], r9
mov r10, qword [rbp - 0x52]
movzx eax, ch
mov qword [rbp - 0xca], rdx
mov dword [rbp - 0x11d], edx
add ecx, eax
sub qword [rbp - 0x15c], rdx
and rax, rax
sub r10, qword [rbp - 0xd8]
mov r8, r11
cmp eax, dword [0x6b1a5ec8]
je 0x6b140f6d
mov r10, qword [rbp - 0x85]
mov eax, ecx
mov dword [rbp - 0xe7], eax
mov ecx, edx
cmp r10, r9
jae 0x6b140f6d
pop rax
pop r9
leave
ret