Function at 0x1400487c8
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov esi, edx
mov rbx, rcx
call qword [rax + 0x338]
mov rcx, rbx
mov rdi, rax
xor eax, eax
mov dword [rsp + 0x50], eax
call fcn.14000f8e0
mov ebp, 1
and eax, 0x400000
lea ecx, [rbp + 0x24]
mov dword [rsp + 0x58], eax
je 0x14004884f
cmp esi, ecx
jne 0x140048849
lea esi, [rbp + 0x26]
mov eax, esi
sub eax, 0x26
je 0x14004887a
sub eax, ebp
je 0x1400489e7
cmp eax, ebp
je 0x1400489b3
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x7b0]
xor ecx, ecx
cmp eax, ecx
jne 0x140048be9
mov rcx, rbx
call fcn.140019084
jmp 0x140048be9
cmp esi, 0x27
cmove esi, ecx
cmp esi, ecx
ja 0x14004880d
je 0x140048963
cmp esi, 0xd
je 0x14004887e
cmp esi, 0x1b
je 0x140048959
cmp esi, 0x20
jbe 0x140048824
cmp esi, 0x22
jbe 0x140048935
cmp esi, 0x24
ja 0x140048824
mov dword [rsp + 0x50], ebp
xor r8d, r8d
cmp dword [0x140254ef8], r8d
jne 0x14004889b
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x7b0]
xor r8d, r8d
cmp dword [rsp + 0x50], r8d
je 0x140048be9
cmp dword [rbx + 0x1554], r8d
je 0x140048bce
mov edx, dword [rdi + 0x1038]
cmp edx, r8d
jl 0x140048bce
mov rcx, rdi
call fcn.14002aa40
mov rsi, rax
xor eax, eax
cmp rsi, rax
jne 0x1400488ec
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x660]
xor r8d, r8d
cmp eax, r8d
je 0x140048bce
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rdi + 0x125c]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsi + 0x64], eax
jge 0x140048af1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x660]
mov r11d, eax
mov eax, dword [rsi + 0x64]
sub eax, dword [rsp + 0x24]
cdq
idiv r11d
mov esi, eax
sub esi, ebp
jmp 0x140048b1c
xor eax, eax
cmp dword [rbx + 0x1558], eax
je 0x140048824
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x7b0]
xor r8d, r8d
jmp 0x1400488a6
mov dword [rbx + 0x17dc], ebp
mov edx, ebp
jmp 0x1400489a6
mov rcx, rbx
call fcn.140043c64
xor edi, edi
cmp rax, rdi
je 0x140048983
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x6e8]
jmp 0x140048be9
mov rcx, qword [rbx + 0x1e0]
cmp rcx, rdi
je 0x140048be9
mov rax, qword [rcx]
call qword [rax + 0xe0]
cmp eax, edi
je 0x140048be9
xor edx, edx
mov rcx, rbx
call fcn.1400456b0
jmp 0x140048be9
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14004887a
xor eax, eax
cmp dword [rdi + 0x1278], eax
jne 0x14004887a
mov rcx, rbx
call fcn.140048660
jmp 0x140048be9
mov esi, dword [0x140255ec0]
xor ebp, ebp
cmp esi, 0x3e7
jne 0x140048a12
cmp dword [0x1402567c8], ebp
je 0x140048a10
mov eax, dword [0x1402567cc]
neg eax
sbb esi, esi
neg esi
add esi, 2
jmp 0x140048a12
mov esi, ebp
mov rcx, rbx
mov dword [0x140255ec0], ebp
call fcn.140043c90
mov rdi, rax
cmp rax, rbp
je 0x140048a87
cmp dword [rax + 0x24], 0xffffffff
je 0x140048a43
cmp dword [rax + 0x24], ebp
je 0x140048a43
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x1b8]
cmp eax, ebp
je 0x140048a87
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x190]
cmp eax, ebp
je 0x140048a87
cmp qword [rdi + 0xb8], rbp
je 0x140048ae6
mov rcx, rbx
call fcn.140043c90
cmp rax, rdi
jne 0x140048ae6
mov rcx, qword [rdi + 0xb8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
call fcn.1400487c8
jmp 0x140048ae6
mov rcx, rbx
call fcn.140043c64
mov rdi, rax
cmp rax, rbp
je 0x140048ab8
lea rdx, str.CMFCPopupMenuBar
mov rcx, rax
call fcn.1400577c0
cmp eax, ebp
jne 0x140048ab8
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x6f0]
jmp 0x140048ae6
mov rcx, rbx
call fcn.140043c00
cmp rax, rbp
je 0x140048ae6
neg dword [rsp + 0x58]
mov rcx, qword [rax + 0x40]
mov edx, pe_nt_image_headers64
sbb r8, r8
xor r9d, r9d
and r8, 0xfffffffffffffffe
add r8, 0x27
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x140255ec0], esi
jmp 0x140048be9
mov eax, dword [rsp + 0x2c]
cmp dword [rsi + 0x6c], eax
jle 0x140048bcb
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x660]
mov r11d, eax
mov eax, dword [rsi + 0x6c]
sub eax, dword [rsp + 0x2c]
cdq
idiv r11d
lea esi, [rbp + rax]
xor r8d, r8d
cmp esi, r8d
je 0x140048bce
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x660]
mov r11d, eax
mov eax, dword [rbx + 0x1cc]
cdq
idiv r11d
mov edx, dword [rsp + 0x58]
add edx, esi
mov esi, dword [rdi + 0x1098]
sub eax, 2
sub esi, eax
xor eax, eax
dec esi
cmp edx, eax
cmovl edx, eax
cmp edx, esi
cmovl esi, edx
cmp dword [rdi + 0x125c], esi
je 0x140048b7a
mov rax, qword [rdi]
mov rcx, rdi
mov dword [rdi + 0x125c], esi
call qword [rax + 0x778]
xor edx, edx
mov rcx, rbx
call fcn.1400468a8
xor r8d, r8d
cmp dword [rbx + 0x1558], r8d
je 0x140048bbc
lea rcx, [rbx + 0x1590]
cmp rcx, r8
je 0x140048bbc
cmp qword [rcx + 0x40], r8
je 0x140048bbc
mov rcx, qword [rbx + 0x15d0]
mov r9d, ebp
mov r8d, esi
mov edx, 2
call qword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x140048bcb
cmp eax, r8d
je 0x140048bce
xor edx, edx
mov rcx, rbx
call fcn.1400468a8
xor r8d, r8d
cmp dword [rdi + 0x1290], r8d
je 0x140048be9
mov rax, qword [rbx]
mov edx, dword [rdi + 0x1038]
mov rcx, rbx
call qword [rax + 0x3b0]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret