Function at 0x140079ea0
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rdi, r9
mov r15, r8
mov esi, edx
mov r14, rcx
mov rax, qword [0x14021fc40]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x68], r8
call fcn.140040a90
test rax, rax
je 0x14007a96f
call fcn.140048550
mov rbx, rax
call fcn.140040a90
test rax, rax
je 0x140079efd
call fcn.140048550
mov r13, qword [rax + 0x90]
jmp 0x140079f00
xor r13d, r13d
xor r12d, r12d
cmp esi, 0x1ff
jle 0x140079fe8
lea eax, [rsi - 0x200]
cmp eax, 0xa3
ja case.0x140079f2e.527
lea rcx, [0x14007a994]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor edi, edi
cmp rax, rdx
sete dil
cmp rax, rcx
mov eax, 2
cmove edi, eax
mov ecx, esi
and ecx, 0xfffffffd
xor ebp, ebp
cmp ecx, 0x204
sete bpl
lea ecx, [rsi - 0x207]
test ecx, 0xfffffffd
cmove ebp, eax
cmp esi, 0x20d
je 0x140079f89
cmp esi, 0x20b
jne 0x140079fa3
and r15d, 0xffff0000
xor eax, eax
cmp r15d, 0x10000
sete al
mov ebp, 4
sub ebp, eax
cmp dword [r13 + 0x14], 0
jne 0x140079fbe
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x140079fbe
mov rcx, r14
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, 1
shlx eax, eax, ebp
or dword [r13 + 0x14], eax
mov rcx, rbx
mov edx, edi
call fcn.14003ef20
mov rcx, rbx
mov edx, ebp
mov r8b, 1
call fcn.14003eb80
jmp 0x14007a96f
cmp esi, 0xff
jle 0x14007a0e8
lea eax, [rsi - 0x100]
cmp eax, 5
ja case.0x140079f2e.527
mov ecx, 0x33
bt ecx, eax
jae 0x14007a2ff
cmp r15, 0xff
ja 0x14007a96f
and esi, 0xfffffffb
call fcn.140048550
mov rbx, rax
mov r14, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x11
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x1000
call fcn.14003e8d0
mov ecx, 0x10
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x2000
call fcn.14003e8d0
mov ecx, 0x12
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x4000
call fcn.14003e8d0
mov ecx, 0x5d
call r14
movzx r8d, ax
shr r8d, 0xf
mov rcx, rbx
mov edx, 0x8000
call fcn.14003e8d0
cmp r15, 0xd
mov ebx, 0x10d
cmovne ebx, r15d
test edi, 0x1000000
cmove ebx, r15d
lea eax, [rbx - 8]
cmp eax, 0x105
ja case.0x14007a0dc.10
mov ebp, 0x200
lea rcx, [0x14007ac24]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov ebp, 0x20b
jmp case.0x14007a0dc.9
lea eax, [rsi - 7]
cmp eax, 2
jb 0x14007a2ec
cmp esi, 0x20
je 0x14007a386
cmp esi, 0xa0
jne case.0x140079f2e.527
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor ebp, ebp
cmp rax, rdx
sete bpl
cmp rax, rcx
mov r15d, 2
cmove ebp, r15d
xor eax, eax
cmp esi, 0x200
sete al
sub r15d, eax
mov qword [r13 + 8], r14
cmp dword [r13 + 0x10], r15d
je 0x14007a1b3
xor eax, eax
cmp esi, 0x200
setne al
movabs rcx, 0x8000000000000018
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x60], 0
mov dword [rsp + 0x38], 0x18
shl eax, 4
or eax, 2
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], 0
cmp dword [r13 + 0x10], 0
je 0x14007a1a4
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov dword [r13 + 0x10], r15d
movsx eax, di
mov dword [rsp + 0x50], eax
sar edi, 0x10
mov dword [rsp + 0x54], edi
cmp esi, 0xa0
jne 0x14007a1df
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x14007a96f
mov rcx, rbx
mov edx, ebp
call fcn.14003ef20
vcvtsi2ss xmm2, xmm0, dword [rsp + 0x54]
vcvtsi2ss xmm1, xmm0, dword [rsp + 0x50]
mov rcx, rbx
call fcn.14003e930
jmp 0x14007a96f
call qword [sym.imp.USER32.dll_GetMessageExtraInfo]
and eax, 0xffffff80
mov ecx, 0xff515700
lea rdx, [rcx + 0x80]
xor edi, edi
cmp rax, rdx
sete dil
cmp rax, rcx
mov eax, 2
cmove edi, eax
xor ecx, ecx
cmp esi, 0x205
sete cl
cmp esi, 0x208
cmove ecx, eax
and r15d, 0xffff0000
xor eax, eax
cmp r15d, 0x10000
sete al
mov ebp, 4
sub ebp, eax
cmp esi, 0x20c
cmovne ebp, ecx
mov eax, 0xfffffffe
mov ecx, ebp
rol eax, cl
and dword [r13 + 0x14], eax
jne 0x14007a282
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r14
jne 0x14007a282
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov rcx, rbx
mov edx, edi
call fcn.14003ef20
xor r12d, r12d
mov rcx, rbx
mov edx, ebp
xor r8d, r8d
call fcn.14003eb80
jmp case.0x140079f2e.527
xor eax, eax
cmp esi, 0x2a3
sete al
mov ecx, 2
sub ecx, eax
cmp dword [r13 + 0x10], ecx
jne 0x14007a96f
cmp qword [r13 + 8], r14
jne 0x14007a2cb
mov qword [r13 + 8], 0
mov dword [r13 + 0x10], 0
vmovss xmm1, dword [0x140125e50]
mov rcx, rbx
vmovaps xmm2, xmm1
call fcn.14003e930
jmp 0x14007a96f
cmp esi, 7
sete dl
mov rcx, rbx
call fcn.14003ef30
jmp 0x14007a96f
cmp eax, 2
jne case.0x140079f2e.527
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x14007a3a8
lea rax, [r15 - 1]
cmp rax, 0xfffe
ja 0x14007a96f
mov rcx, rbx
mov edx, r15d
call fcn.14003e340
jmp 0x14007a96f
sar r15d, 0x10
vcvtsi2ss xmm0, xmm0, r15d
vmulss xmm2, xmm0, dword [0x140130a30]
vxorps xmm1, xmm1, xmm1
jmp 0x14007a365
sar r15d, 0x10
vcvtsi2ss xmm0, xmm0, r15d
vmulss xmm1, xmm0, dword [0x140130a2c]
vxorps xmm2, xmm2, xmm2
mov rcx, rbx
call fcn.14003ed80
jmp 0x14007a96f
cmp r15d, 7
jne 0x14007a96f
mov byte [r13 + 0x2d], 1
jmp 0x14007a96f
cmp di, 1
jne 0x14007a96f
mov r12d, 1
call fcn.140079de0
test al, al
je 0x14007a96f
jmp case.0x140079f2e.527
mov word [rsp + 0x50], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 1
xor r12d, r12d
lea r8, [rsp + 0x68]
xor ecx, ecx
mov edx, 1
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [rsp + 0x50]
mov rcx, rbx
call fcn.14003e1e0
jmp case.0x140079f2e.527
shr edi, 0x10
movzx edi, dil
jmp 0x14007a7f9
mov ebp, 0x20d
jmp case.0x14007a0dc.9
mov ebp, 0x257
jmp case.0x14007a0dc.9
mov ebp, 0x253
jmp case.0x14007a0dc.9
mov ebp, 0x20e
jmp case.0x14007a0dc.9
mov ebp, 0x20c
jmp case.0x14007a0dc.9
mov ebp, 0x205
jmp case.0x14007a0dc.9
mov ebp, 0x206
jmp case.0x14007a0dc.9
mov ebp, 0x208
jmp case.0x14007a0dc.9
mov ebp, 0x207
jmp case.0x14007a0dc.9
mov ebp, 0x201
jmp case.0x14007a0dc.9
mov ebp, 0x203
jmp case.0x14007a0dc.9
mov ebp, 0x202
jmp case.0x14007a0dc.9
mov ebp, 0x204
jmp case.0x14007a0dc.9
mov ebp, 0x256
jmp case.0x14007a0dc.9
mov ebp, 0x209
jmp case.0x14007a0dc.9
mov ebp, 0x20a
jmp case.0x14007a0dc.9
mov ebp, 0x218
jmp case.0x14007a0dc.9
mov ebp, 0x219
jmp case.0x14007a0dc.9
mov ebp, 0x21a
jmp case.0x14007a0dc.9
mov ebp, 0x21b
jmp case.0x14007a0dc.9
mov ebp, 0x21c
jmp case.0x14007a0dc.9
mov ebp, 0x21d
jmp case.0x14007a0dc.9
mov ebp, 0x21e
jmp case.0x14007a0dc.9
mov ebp, 0x21f
jmp case.0x14007a0dc.9
mov ebp, 0x220
jmp case.0x14007a0dc.9
mov ebp, 0x221
jmp case.0x14007a0dc.9
mov ebp, 0x222
jmp case.0x14007a0dc.9
mov ebp, 0x223
jmp case.0x14007a0dc.9
mov ebp, 0x224
jmp case.0x14007a0dc.9
mov ebp, 0x225
jmp case.0x14007a0dc.9
mov ebp, 0x226
jmp case.0x14007a0dc.9
mov ebp, 0x227
jmp case.0x14007a0dc.9
mov ebp, 0x228
jmp case.0x14007a0dc.9
mov ebp, 0x229
jmp case.0x14007a0dc.9
mov ebp, 0x22a
jmp case.0x14007a0dc.9
mov ebp, 0x22b
jmp case.0x14007a0dc.9
mov ebp, 0x22c
jmp case.0x14007a0dc.9
mov ebp, 0x22d
jmp case.0x14007a0dc.9
mov ebp, 0x22e
jmp case.0x14007a0dc.9
mov ebp, 0x22f
jmp case.0x14007a0dc.9
mov ebp, 0x230
jmp case.0x14007a0dc.9
mov ebp, 0x231
jmp case.0x14007a0dc.9
mov ebp, 0x232
jmp case.0x14007a0dc.9
mov ebp, 0x233
jmp case.0x14007a0dc.9
mov ebp, 0x234
jmp case.0x14007a0dc.9
mov ebp, 0x235
jmp case.0x14007a0dc.9
mov ebp, 0x236
jmp case.0x14007a0dc.9
mov ebp, 0x237
jmp case.0x14007a0dc.9
mov ebp, 0x238
jmp case.0x14007a0dc.9
mov ebp, 0x239
jmp case.0x14007a0dc.9
mov ebp, 0x23a
jmp case.0x14007a0dc.9
mov ebp, 0x23b
jmp case.0x14007a0dc.9
mov ebp, 0x212
jmp case.0x14007a0dc.9
mov ebp, 0x216
jmp case.0x14007a0dc.9
mov ebp, 0x217
jmp case.0x14007a0dc.9
mov ebp, 0x258
jmp case.0x14007a0dc.9
mov ebp, 0x259
jmp case.0x14007a0dc.9
mov ebp, 0x25a
jmp case.0x14007a0dc.9
mov ebp, 0x25b
jmp case.0x14007a0dc.9
mov ebp, 0x25c
jmp case.0x14007a0dc.9
mov ebp, 0x25d
jmp case.0x14007a0dc.9
mov ebp, 0x25e
jmp case.0x14007a0dc.9
mov ebp, 0x25f
jmp case.0x14007a0dc.9
mov ebp, 0x260
jmp case.0x14007a0dc.9
mov ebp, 0x261
jmp case.0x14007a0dc.9
mov ebp, 0x264
jmp case.0x14007a0dc.9
mov ebp, 0x266
jmp case.0x14007a0dc.9
mov ebp, 0x265
jmp case.0x14007a0dc.9
mov ebp, 0x262
jmp case.0x14007a0dc.9
mov ebp, 0x263
jmp case.0x14007a0dc.9
mov ebp, 0x23c
jmp case.0x14007a0dc.9
mov ebp, 0x23d
jmp case.0x14007a0dc.9
mov ebp, 0x23e
jmp case.0x14007a0dc.9
mov ebp, 0x23f
jmp case.0x14007a0dc.9
mov ebp, 0x240
jmp case.0x14007a0dc.9
mov ebp, 0x241
jmp case.0x14007a0dc.9
mov ebp, 0x242
jmp case.0x14007a0dc.9
mov ebp, 0x243
jmp case.0x14007a0dc.9
mov ebp, 0x244
jmp case.0x14007a0dc.9
mov ebp, 0x245
jmp case.0x14007a0dc.9
mov ebp, 0x246
jmp case.0x14007a0dc.9
mov ebp, 0x247
jmp case.0x14007a0dc.9
mov ebp, 0x255
jmp case.0x14007a0dc.9
mov ebp, 0x254
jmp case.0x14007a0dc.9
mov ebp, 0x210
jmp case.0x14007a0dc.9
mov ebp, 0x214
jmp case.0x14007a0dc.9
mov ebp, 0x20f
jmp case.0x14007a0dc.9
mov ebp, 0x213
jmp case.0x14007a0dc.9
mov ebp, 0x211
jmp case.0x14007a0dc.9
mov ebp, 0x215
jmp case.0x14007a0dc.9
mov ebp, 0x24d
jmp case.0x14007a0dc.9
mov ebp, 0x24e
jmp case.0x14007a0dc.9
mov ebp, 0x249
jmp case.0x14007a0dc.9
mov ebp, 0x24a
jmp case.0x14007a0dc.9
mov ebp, 0x24b
jmp case.0x14007a0dc.9
mov ebp, 0x24c
jmp case.0x14007a0dc.9
mov ebp, 0x252
jmp case.0x14007a0dc.9
mov ebp, 0x24f
jmp case.0x14007a0dc.9
mov ebp, 0x250
jmp case.0x14007a0dc.9
mov ebp, 0x251
jmp case.0x14007a0dc.9
mov ebp, 0x248
jmp case.0x14007a0dc.9
mov ebp, 0x267
cmp esi, 0x100
sete r14b
shr edi, 0x10
movzx edi, dil
call fcn.140048550
mov r15, rax
mov rcx, rax
mov edx, ebp
mov r8d, r14d
call fcn.14003e8d0
mov dword [rsp + 0x20], 0xffffffff
mov rcx, r15
mov edx, ebp
mov r8d, ebx
mov r9d, edi
call fcn.14003e900
cmp ebx, 0x12
je 0x14007a889
cmp ebx, 0x11
je 0x14007a8fb
cmp ebx, 0x10
jne 0x14007a96f
cmp esi, 0x100
sete bl
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007a84e
cmp esi, 0x100
sete dl
mov ecx, 0x210
mov r8d, 0xa0
mov r9d, edi
call fcn.14007b040
cmp esi, 0x100
sete bl
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007a96f
cmp esi, 0x100
sete dl
mov ecx, 0x214
mov r8d, 0xa1
jmp 0x14007a967
cmp esi, 0x100
sete bl
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007a8c3
cmp esi, 0x100
sete dl
mov ecx, 0x211
mov r8d, 0xa4
mov r9d, edi
call fcn.14007b040
cmp esi, 0x100
sete bl
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007a96f
cmp esi, 0x100
sete dl
mov ecx, 0x215
mov r8d, 0xa5
jmp 0x14007a967
cmp esi, 0x100
sete bl
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007a935
cmp esi, 0x100
sete dl
mov ecx, 0x20f
mov r8d, 0xa2
mov r9d, edi
call fcn.14007b040
cmp esi, 0x100
sete bl
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
sets al
xor al, bl
jne 0x14007a96f
cmp esi, 0x100
sete dl
mov ecx, 0x213
mov r8d, 0xa3
mov r9d, edi
call fcn.14007b040
xor r12d, r12d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14011bef0
mov rax, r12
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret