Function at 0x140034010
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov r15d, r9d
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x201
je 0x14003404e
cmp r8d, 0x204
jne 0x140034054
call qword [sym.imp.USER32.dll_SetFocus]
mov r14d, dword [rbp + 0x70]
mov eax, esi
mov byte [rbp + 0x60], 0
mov r12d, 1
sub eax, 0x201
je 0x14003424a
sub eax, r12d
je 0x140034235
cmp eax, 2
jne 0x14003408a
test byte [rdi + 0x40], al
je 0x140034094
mov rcx, rdi
call fcn.140035a60
test byte [rdi + 0x40], 2
jne 0x1400345c5
mov ebx, dword [rbp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, rdi
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x158], r13
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x60], 3
call fcn.1400376a0
mov r13d, dword [rsp + 0x64]
mov eax, r15d
and eax, 8
mov dword [rsp + 0x50], eax
mov eax, r15d
mov r15, qword [rsp + 0x68]
and eax, 4
mov dword [rsp + 0x40], eax
and r13d, 0x20
je 0x140034101
cmp esi, 0x201
jne 0x140034101
mov r8d, dword [r15]
mov rdx, r15
shr r8d, 2
mov rcx, rdi
not r8b
and r8b, r12b
call fcn.140037220
mov r8, qword [rsp + 0x70]
xor r12d, r12d
mov qword [rsp + 0x78], r8
test r13d, r13d
jne 0x1400344da
cmp esi, 0x201
je 0x14003412b
cmp esi, 0x204
jne 0x1400344da
mov rcx, qword [rdi + 0x38]
or ebx, 0xffffffff
test rcx, rcx
je 0x14003415f
xor r9d, r9d
xor r8d, r8d
mov edx, 0x41c
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rsp + 0x70]
mov dword [rdi + 0x160], ebx
mov dword [rdi + 0x164], ebx
mov dword [rdi + 0x190], ebx
mov eax, dword [rsp + 0x64]
mov ecx, eax
and ecx, 0x10
mov dword [rsp + 0x48], ecx
je 0x140034209
test byte [rdi + 0x4c], 1
mov ebx, r12d
mov qword [rdi + 0xa0], r15
je 0x1400341d5
test byte [r15], 2
jne 0x1400341d5
cmp byte [rbp + 0x60], bl
jne 0x1400341d5
mov edx, dword [r15 + 0x2c]
lea rax, [rbp - 0x70]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.140037340
test al, al
je 0x1400341d5
mov eax, dword [rbp - 0x70]
mov ebx, 1
test al, 4
je 0x1400341c0
cmp r14d, dword [rbp - 0x3c]
jl 0x1400341c0
cmp r14d, dword [rbp - 0x34]
cmovl ebx, r12d
and eax, 0x18
cmp al, 0x18
jne 0x1400341d5
cmp r14d, dword [rbp - 0x1c]
jl 0x1400341d5
cmp r14d, dword [rbp - 0x14]
cmovl ebx, r12d
mov r9d, dword [rsp + 0x40]
mov eax, r12d
mov r8d, dword [rsp + 0x50]
cmp esi, 0x204
mov rdx, r15
mov rcx, rdi
sete al
mov dword [rsp + 0x20], eax
call fcn.140037c50
test ebx, ebx
je 0x1400344d2
mov eax, dword [rsp + 0x64]
or ebx, 0xffffffff
xor r13b, r13b
mov byte [rsp + 0x44], r12b
test al, 0xf
jne 0x14003442c
cmp byte [rbp + 0x60], r12b
jne 0x14003442c
test r15, r15
je 0x1400342b7
mov r15d, dword [r15 + 0x2c]
jmp 0x1400342ba
test byte [rdi + 0x40], 2
je 0x140034094
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x14003408a
mov ecx, dword [rdi + 0x40]
test cl, 0x20
je 0x14003408a
mov edx, dword [rdi + 0x90]
lea eax, [rdx - 8]
cmp r14d, eax
jl 0x14003408a
lea eax, [rdx + 8]
cmp r14d, eax
jge 0x14003408a
or ecx, 2
mov byte [rbp + 0x60], r12b
mov dword [rdi + 0x40], ecx
mov rcx, rbx
mov dword [rdi + 0x124], r14d
mov dword [rdi + 0x128], edx
call qword [sym.imp.USER32.dll_SetCapture]
xor r9d, r9d
mov rdx, r12
mov rcx, rbx
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x140034094
mov r15d, ebx
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1400342c7
mov ebx, dword [rax + 4]
mov r8d, dword [rbp + 0x78]
lea rax, [rbp + 0x60]
mov edx, r14d
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.14003b060
or edx, 0xffffffff
movzx r8d, al
cmp r15d, edx
jne 0x1400342f0
mov r15, r12
jmp 0x14003430b
mov rax, qword [rdi + 0x130]
cmp r15d, dword [rax]
jae 0x1400345bd
mov rax, qword [rax + 8]
mov ecx, r15d
mov r15, qword [rax + rcx*8]
cmp ebx, edx
je 0x140034336
cmp ebx, dword [rdi + 0xdc]
jae 0x1400345bd
mov rax, qword [rdi + 0xd0]
mov ecx, ebx
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400345bd
test r8b, r8b
je 0x14003435a
mov bl, 1
cmp dword [rsp + 0x48], r12d
je 0x140034431
test byte [rdi + 0x4c], bl
je 0x140034431
mov edx, dword [r15 + 0x2c]
jmp 0x140034431
cmp esi, 0x201
jne 0x140034370
cmp dword [rbp + 0x60], 0x202
je 0x140034389
jmp 0x14003442f
cmp esi, 0x204
jne 0x14003442f
cmp dword [rbp + 0x60], 0x205
jne 0x14003442f
cmp dword [rsp + 0x48], r12d
je 0x1400343a9
movzx eax, byte [rdi + 0x4c]
mov ecx, dword [rsp + 0x44]
and al, 1
mov eax, 1
movzx ecx, cl
cmovne ecx, eax
mov dword [rsp + 0x44], ecx
mov rbx, qword [rdi]
call qword [sym.imp.USER32.dll_GetMessagePos]
movsx edx, ax
mov rcx, rbx
shr eax, 0x10
cwde
mov dword [rsp + 0x48], edx
lea rdx, [rsp + 0x48]
mov dword [rsp + 0x4c], eax
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [rsp + 0x48], r14d
jne 0x140034412
mov eax, dword [rbp + 0x78]
cmp dword [rsp + 0x4c], eax
jne 0x140034412
mov ecx, dword [rbp + 0x68]
cmp esi, 0x201
mov dword [rsp + 0x30], ecx
mov r9d, eax
mov rcx, qword [rsp + 0x78]
setne r12b
mov qword [rsp + 0x28], rcx
mov r8d, r14d
mov rcx, rdi
mov qword [rsp + 0x20], r15
lea edx, [r12 + 0xd]
call fcn.140035eb0
cmp esi, 0x204
movzx r13d, r13b
mov eax, 1
cmove r13d, eax
cmp byte [rsp + 0x44], 0
jne 0x1400344a7
or edx, 0xffffffff
xor bl, bl
cmp dword [rsp + 0x50], 0
jne 0x140034494
cmp dword [rsp + 0x40], 0
jne 0x140034494
lea rax, [rbp + 0x60]
mov r9d, 4
mov qword [rsp + 0x28], rax
mov r8d, edx
lea rax, [rsp + 0x40]
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400378d0
mov r8d, dword [rbp + 0x60]
lea rax, [rbp - 0x80]
mov edx, dword [rsp + 0x40]
mov r9b, 1
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400375e0
test al, al
je 0x140034494
mov rcx, qword [rbp + 0x50]
lea rdx, [rbp - 0x80]
xor r8d, r8d
call qword [sym.imp.USER32.dll_InvalidateRect]
test bl, bl
je 0x1400344a7
mov r8d, dword [rbp + 0x78]
mov edx, r14d
mov rcx, rdi
call fcn.14003b1b0
test r13b, r13b
je 0x1400345bd
mov rbx, qword [rdi]
call qword [sym.imp.USER32.dll_GetMessagePos]
mov r9d, eax
mov r8, rbx
mov edx, 0x7b
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400345bd
mov ebx, dword [rbp + 0x78]
mov r8, qword [rsp + 0x70]
or edx, 0xffffffff
cmp esi, 0x201
je 0x14003454d
cmp esi, 0x204
je 0x14003454d
cmp esi, 0x202
je 0x14003451b
cmp esi, 0x205
je 0x14003451b
cmp esi, 0x203
jne 0x14003450c
mov edx, 0xf
jmp 0x14003457c
cmp esi, 0x206
jne 0x14003457c
mov edx, 0x10
jmp 0x14003457c
mov eax, dword [rdi + 0xb0]
test eax, eax
je 0x140034544
cmp dword [rdi + 0xb4], r14d
jne 0x140034544
cmp dword [rdi + 0xb8], ebx
jne 0x140034544
cmp eax, 0x201
mov edx, r12d
setne dl
add edx, 0xd
mov dword [rdi + 0xb0], r12d
jmp 0x14003457c
mov eax, dword [rdi + 0xb0]
test eax, eax
je 0x140034569
cmp eax, esi
je 0x140034569
cmp eax, 0x201
mov edx, r12d
setne dl
add edx, 0xd
mov dword [rdi + 0xb0], esi
mov dword [rdi + 0xb4], r14d
mov dword [rdi + 0xb8], ebx
test r13d, r13d
jne 0x1400345bd
cmp edx, 0xffffffff
je 0x1400345bd
mov ecx, dword [rbp + 0x68]
xor r9d, r9d
mov rax, qword [rdi + 0xc8]
mov dword [rsp + 0x70], ecx
mov rcx, qword [rdi]
mov qword [rsp + 0x68], r8
lea r8, [rsp + 0x58]
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x5c], ebx
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [rdi + 0xc0]
mov r13, qword [rsp + 0x158]
add rsp, 0x110
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret