Function at 0x140051580
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, 0x1f
je 0x1400517ae
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov rdi, rcx
mov rcx, qword [rcx + 0x68]
mov ebx, edx
test rcx, rcx
je 0x140051712
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x140051712
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov r12d, ebx
mov r15d, 0xc0000001
and r12d, 1
mov r14d, 0x101
je 0x14005160c
test bl, 8
jne 0x14005160c
bt ebx, 0xb
jb 0x14005160c
movzx eax, byte [rdi + 0x71]
lea edx, [r14 + 4]
shl eax, 0x10
movsxd r9, eax
mov eax, 0xe0000001
or r9, rax
jmp 0x140051621
test r12d, r12d
je 0x140051631
movzx eax, byte [rdi + 0x71]
mov edx, r14d
shl eax, 0x10
movsxd r9, eax
or r9, r15
mov rcx, qword [rdi + 0x68]
mov r8d, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_PostMessageW]
mov r13d, ebx
and r13d, 8
je 0x14005165a
movzx eax, byte [rdi + 0x70]
mov rcx, qword [rdi + 0x68]
mov r8d, reloc.WSOCK32.dll_recvfrom
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov ebp, ebx
and ebp, 2
je 0x14005167f
movzx eax, byte [rdi + 0x73]
mov r8d, dword [rdi + 0x78]
mov rcx, qword [rdi + 0x68]
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov esi, ebx
and esi, 4
je 0x1400516a6
movzx eax, byte [rdi + 0x74]
mov rcx, qword [rdi + 0x68]
mov r8d, reloc.WSOCK32.dll_recv
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
and ebx, 0x10
je 0x1400516cb
movzx eax, byte [rdi + 0x75]
mov rcx, qword [rdi + 0x68]
mov r8d, 0x5b
shl eax, 0x10
mov edx, r14d
movsxd r9, eax
or r9, r15
call qword [sym.imp.USER32.dll_PostMessageW]
mov cl, 0x80
test ebx, ebx
je 0x1400516d5
xor byte [rsp + 0x7b], cl
test ebp, ebp
je 0x1400516e4
mov eax, dword [rdi + 0x78]
xor byte [rsp + 0x30], cl
xor byte [rsp + rax + 0x20], cl
test esi, esi
je 0x1400516f3
xor byte [rsp + 0x30], cl
xor byte [rsp + 0xc1], cl
test r13d, r13d
je 0x1400516fc
xor byte [rsp + 0x31], cl
test r12d, r12d
je 0x140051705
xor byte [rsp + 0x32], cl
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_SetKeyboardState]
jmp 0x140051786
mov esi, 2
test bl, 1
je 0x14005172d
mov dl, byte [rdi + 0x71]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_select
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 8
je 0x140051743
mov dl, byte [rdi + 0x70]
xor r9d, r9d
mov r8d, esi
mov cl, reloc.WSOCK32.dll_recvfrom
call qword [sym.imp.USER32.dll_keybd_event]
test sil, bl
je 0x14005175a
mov dl, byte [rdi + 0x73]
mov cl, byte [rdi + 0x78]
xor r9d, r9d
mov r8d, esi
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 4
je 0x140051770
mov dl, byte [rdi + 0x74]
xor r9d, r9d
mov r8d, esi
mov cl, RegisterTypeLib
call qword [sym.imp.USER32.dll_keybd_event]
test bl, 0x10
je 0x140051786
mov dl, byte [rdi + 0x75]
xor r9d, r9d
mov r8d, esi
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
mov rcx, rdi
call fcn.140043740
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret