Function at 0x140039d30
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x140
mov rax, qword [0x1401043b8]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, rcx
mov rcx, qword [rcx + 0x218]
lea rdx, str.Process_focus_restoration_in_the_RfbKeySym_class
call fcn.14006b210
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x14003a0d3
movzx r8d, byte [rsp + 0x41]
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x160], rsi
shr r8b, 7
lea rsi, [0x1400d11e0]
movzx eax, r8b
neg al
sbb cl, cl
xor ebx, ebx
and cl, 0x80
mov byte [rdi + 0x21], cl
movzx eax, byte [rdi + 0x1b2]
mov byte [rdi + 0x1b2], cl
shr al, 7
cmp r8b, al
je 0x140039de5
mov ecx, ebx
mov rax, rsi
nop
cmp byte [rax], 0xa2
je 0x140039dd6
inc ecx
add rax, 8
cmp ecx, 0x49
jb 0x140039dc0
mov edx, dword [rsp + 0x20]
jmp 0x140039ddc
mov eax, ecx
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0xd3]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0xb3], cl
movzx eax, byte [rdi + 0x1b3]
mov byte [rdi + 0x1b3], cl
shr al, 7
cmp r8b, al
je 0x140039e45
mov ecx, ebx
mov rax, rsi
nop dword [rax]
cmp byte [rax], 0xa3
je 0x140039e36
inc ecx
add rax, 8
cmp ecx, 0x49
jb 0x140039e20
mov edx, dword [rsp + 0x20]
jmp 0x140039e3c
mov eax, ecx
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0xd2]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0xb2], cl
movzx eax, byte [rdi + 0x1b2]
mov byte [rdi + 0x1b2], cl
shr al, 7
cmp r8b, al
je 0x140039ea3
mov eax, ebx
mov rcx, rsi
nop dword [rax]
cmp byte [rcx], 0xa2
je 0x140039e96
inc eax
add rcx, 8
cmp eax, 0x49
jb 0x140039e80
mov edx, dword [rsp + 0x20]
jmp 0x140039e9a
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0x42]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0x22], cl
movzx eax, byte [rdi + 0x1b4]
mov byte [rdi + 0x1b4], cl
shr al, 7
cmp r8b, al
je 0x140039efa
mov ecx, ebx
mov rax, rsi
cmp byte [rax], 0xa4
je 0x140039eeb
inc ecx
add rax, 8
cmp ecx, 0x49
jb 0x140039ed5
mov edx, dword [rsp + 0x20]
jmp 0x140039ef1
mov eax, ecx
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0xd4]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0xb4], cl
movzx eax, byte [rdi + 0x1b4]
mov byte [rdi + 0x1b4], cl
shr al, 7
cmp r8b, al
je 0x140039f55
mov eax, ebx
mov rcx, rsi
cmp byte [rcx], 0xa4
je 0x140039f48
inc eax
add rcx, 8
cmp eax, 0x49
jb 0x140039f32
mov edx, dword [rsp + 0x20]
jmp 0x140039f4c
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0xd5]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0xb5], cl
movzx eax, byte [rdi + 0x1b5]
mov byte [rdi + 0x1b5], cl
shr al, 7
cmp r8b, al
je 0x140039fb3
mov eax, ebx
mov rcx, rsi
nop dword [rax]
cmp byte [rcx], 0xa5
je 0x140039fa6
inc eax
add rcx, 8
cmp eax, 0x49
jb 0x140039f90
mov edx, dword [rsp + 0x20]
jmp 0x140039faa
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0x40]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0x20], cl
movzx eax, byte [rdi + 0x1b0]
mov byte [rdi + 0x1b0], cl
shr al, 7
cmp r8b, al
je 0x14003a00a
mov ecx, ebx
mov rax, rsi
cmp byte [rax], 0xa0
je 0x140039ffb
inc ecx
add rax, 8
cmp ecx, 0x49
jb 0x140039fe5
mov edx, dword [rsp + 0x20]
jmp 0x14003a001
mov eax, ecx
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0xd1]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0xb1], cl
movzx eax, byte [rdi + 0x1b1]
mov byte [rdi + 0x1b1], cl
shr al, 7
cmp r8b, al
je 0x14003a067
mov ecx, ebx
mov rax, rsi
cmp byte [rax], 0xa1
je 0x14003a058
inc ecx
add rax, 8
cmp ecx, 0x49
jb 0x14003a042
mov edx, dword [rsp + 0x20]
jmp 0x14003a05e
mov eax, ecx
mov edx, dword [rsi + rax*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
movzx r8d, byte [rsp + 0xd0]
shr r8b, 7
movzx eax, r8b
neg al
sbb cl, cl
and cl, 0x80
mov byte [rdi + 0xb0], cl
movzx eax, byte [rdi + 0x1b0]
mov byte [rdi + 0x1b0], cl
shr al, 7
cmp r8b, al
je 0x14003a0c3
mov rax, rsi
nop dword [rax]
cmp byte [rax], 0xa0
je 0x14003a0b6
inc ebx
add rax, 8
cmp ebx, 0x49
jb 0x14003a0a0
mov edx, dword [rsp + 0x20]
jmp 0x14003a0ba
mov edx, dword [rsi + rbx*8 + 4]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140078e40
add rsp, 0x140
pop rdi
ret