Function at 0x140079df0
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [rcx + 0x1b0]
test rcx, rcx
je 0x140079e3d
test byte [rdi + 0x156], 8
je 0x140079e3d
mov rsi, rdx
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x10
jb 0x140079e89
xor esi, esi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1401f08b0
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
lea rax, [0x140285cb0]
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
call fcn.1400b9c50
mov rcx, rdi
mov rdx, rsi
call fcn.14007a260
mov sil, 1
test al, al
jne 0x140079e3f
jmp 0x140079e3d
cmp dword [rsi + 8], 0x100
jne case.0x140079ee9.35
mov r14, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call r14
mov ebx, eax
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call r14
mov ebp, eax
mov rcx, qword [rsi]
mov edx, 0x87
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, rax
or eax, 3
test cl, 4
cmove eax, ecx
mov rcx, qword [rsi + 0x10]
lea rdx, [rcx - 0x21]
cmp rdx, 7
ja case.default.0x140079ee9
lea rcx, [0x1402e0db4]
movsxd rdx, dword [rcx + rdx*4]
add rdx, rcx
jmp rdx
test bx, bx
js case.0x140079ee9.35
and eax, 1
jne case.0x140079ee9.35
xor ebp, ebp
xor r15d, r15d
xor r14d, r14d
jmp 0x140079f6c
cmp rcx, 0xd
je 0x14007a029
cmp rcx, 9
jne case.0x140079ee9.35
movzx r15d, bx
shr r15d, 0xf
test bp, bp
setns r14b
mov bpl, 1
test bx, bx
js 0x140079f6c
and eax, 2
jne case.0x140079ee9.35
jmp 0x140079f6c
mov r14b, 1
jmp 0x140079f3d
xor r14d, r14d
xor ebp, ebp
mov r15b, 1
test bx, bx
js 0x140079f6c
and eax, 1
jne case.0x140079ee9.35
jmp 0x140079f6c
test bx, bx
js case.0x140079ee9.35
and eax, 1
jne case.0x140079ee9.35
xor ebp, ebp
mov r14b, 1
xor r15d, r15d
movaps xmm0, xmmword [0x1402825c0]
lea rbx, [rsp + 0x20]
movaps xmmword [rbx + 0x50], xmm0
movaps xmmword [rbx + 0x40], xmm0
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov r8d, dword [0x140331528]
mov rcx, rbx
xor edx, edx
call fcn.1400c8a50
lea rax, [0x14029a088]
mov qword [rbx], rax
mov qword [rbx + 0x58], 0
mov dword [rbx + 0x38], 0
movzx eax, r14b
and eax, 1
movzx ecx, r15b
and ecx, 1
lea eax, [rax + rcx*2]
add eax, 4
mov ecx, eax
and ecx, 3
test bpl, bpl
cmovne ecx, eax
mov dword [rbx + 0x50], ecx
mov qword [rbx + 0x10], rdi
mov rcx, rdi
mov rdx, rbx
call fcn.14009f1b0
test al, al
je 0x140079e61
mov rcx, qword [rdi + 0x1b0]
mov r8d, 0x10002
mov edx, 0x127
xor r9d, r9d
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [0x140285cb0]
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
call fcn.1400b9c50
mov sil, 1
jmp 0x140079e3f
test al, 0x10
je 0x14007a0f2
mov rcx, qword [rsi]
mov edx, 0xfffffff0
call qword [sym.imp.USER32.dll_GetWindowLongW]
not eax
test al, 0xb
jne case.0x140079ee9.35
mov r9, qword [0x14032f8a0]
test r9, r9
je case.0x140079ee9.35
mov rcx, qword [rsi]
mov rax, r9
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, r9
sub rax, rdx
movabs rdx, 0x3333333333333333
mov r8, rax
and r8, rdx
shr rax, 2
and rax, rdx
add rax, r8
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs r10, 0x101010101010101
imul r10, rax
shr r10, 0x38
cmp r10, 1
ja 0x14007a202
lea r8, [r9 - 1]
and r8, rcx
mov rax, qword [0x14032f898]
mov rax, qword [rax + r8*8]
test rax, rax
je case.0x140079ee9.35
mov r11, qword [rax]
test r11, r11
je case.0x140079ee9.35
lea rbx, [r9 - 1]
jmp 0x14007a1d7
mov r14, rdi
test bx, bx
js 0x14007a142
xor r14d, r14d
test rdi, rdi
je 0x14007a142
mov rbx, qword [sym.imp.USER32.dll_SendMessageW]
mov r15, rdi
test al, 4
jne 0x140079e3d
mov rax, qword [r15]
test byte [rax - 1], 1
jne 0x14007a13f
mov r15, qword [r15 + 0x80]
mov rcx, qword [r15 + 0x1b0]
mov edx, 0x87
xor r8d, r8d
xor r9d, r9d
call rbx
test r15, r15
jne 0x14007a10c
jmp 0x14007a142
mov r14, r15
mov rcx, r14
call fcn.1400a3140
test rax, rax
je case.0x140079ee9.35
mov rbx, rax
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, rbx
call qword [0x14030c820]
lea rdx, [0x140330410]
mov rcx, rax
call fcn.140080e50
test al, al
je case.0x140079ee9.35
xor eax, eax
cmp qword [rbx + 0x238], 0
setne al
shl eax, 5
mov rbx, qword [rbx + rax + 0x218]
test rbx, rbx
je case.0x140079ee9.35
mov rax, qword [rbx]
mov rax, qword [rax]
mov rcx, rbx
call qword [0x14030c820]
lea rdx, [0x140331a78]
mov rcx, rax
call fcn.140080e50
test al, al
je case.0x140079ee9.35
jmp 0x14007a227
cmp qword [r11 + 0x10], rcx
je 0x14007a21e
mov r11, qword [r11]
test r11, r11
je case.0x140079ee9.35
mov rax, qword [r11 + 8]
cmp rax, rcx
je 0x14007a1c5
cmp r10d, 1
ja 0x14007a1f3
and rax, rbx
cmp rax, r8
je 0x14007a1cb
jmp case.0x140079ee9.35
cmp rax, r9
jb 0x14007a1e9
xor edx, edx
div r9
mov rax, rdx
jmp 0x14007a1e9
mov r8, rcx
cmp r9, rcx
ja 0x14007a0c9
mov rax, rcx
xor edx, edx
div r9
mov r8, rdx
jmp 0x14007a0c9
mov rbx, qword [r11 + 0x18]
jmp 0x14007a194
mov rcx, rbx
call fcn.1400a0890
test al, al
je case.0x140079ee9.35
mov rcx, rbx
call fcn.1400a09b0
test al, al
je case.0x140079ee9.35
mov rcx, rbx
xor edx, edx
xor r8d, r8d
call fcn.1400980f0
jmp 0x14007a021