Function at 0x14022ff60
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rsi, rcx
xor r14d, r14d
cmp byte [rcx + 0x408], r14b
je 0x14022ffa9
mov byte [rcx + 0x408], r14b
cmp dword [rcx + 0x4d4], r14d
je 0x14023046d
mov rax, qword [rcx]
mov rbx, qword [rax + 0x338]
mov rcx, rbx
call fcn.14029e28c
mov rcx, rsi
call rbx
mov rdx, rax
lea rcx, vtable.CGlobalUtils.0
call fcn.1401e8ce8
mov r13, rax
test rax, rax
jne 0x14022fff1
cmp dword [0x1403d7d78], r14d
je 0x140230499
mov edi, dword [rsi + 0x4d0]
mov r12d, dword [rsi + 0x4d4]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x718]
mov rcx, rbx
call fcn.14029e28c
mov rcx, rsi
call rbx
mov rcx, rsi
call fcn.14022ef00
mov r15, rax
cmp edi, r12d
jne 0x14023005d
mov ecx, r12d
mov edx, 8
sub ecx, edx
je 0x140230385
sub ecx, 1
je 0x14023013c
cmp ecx, 0xa
je 0x14023006a
mov rax, qword [rsi]
mov rbx, qword [rax + 0x6f8]
mov rcx, rbx
call fcn.14029e28c
mov edx, r12d
mov rcx, rsi
call rbx
mov rcx, rsi
call fcn.1400fdc1c
jmp 0x140230472
mov rbx, qword [0x1403fad08]
test rbx, rbx
jne 0x14023008a
mov rcx, rsi
call fcn.1400fe864
mov rbx, rax
test rax, rax
je 0x140230120
mov rdx, rbx
lea rcx, str.CMDIFrameWndEx
call fcn.1401082ec
mov rdi, rax
test rax, rax
je 0x1402300ad
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x430]
jmp 0x140230108
mov rdx, rbx
lea rcx, str.CFrameWndEx
call fcn.1401082ec
mov rdi, rax
test rax, rax
je 0x1402300d0
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x3f0]
jmp 0x140230108
mov rdx, rbx
lea rcx, str.COleIPFrameWndEx
call fcn.1401082ec
mov rdi, rax
test rax, rax
jne 0x1402300fe
mov rdx, rbx
lea rcx, str.COleDocIPFrameWndEx
call fcn.1401082ec
mov rdi, rax
test rax, rax
je 0x140230120
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x420]
mov rcx, rbx
call fcn.14029e28c
mov rdx, rsi
mov rcx, rdi
call rbx
test eax, eax
je 0x14023005d
mov rax, qword [rsi]
mov rbx, qword [rax + 0x5b8]
mov rcx, rbx
call fcn.14029e28c
mov rcx, rsi
call rbx
jmp 0x14023005d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1402302fb
mov rax, qword [rsi]
mov rbx, qword [rax + 0x680]
mov rcx, rbx
call fcn.14029e28c
mov rcx, rsi
call rbx
test eax, eax
je 0x1402302fb
mov rcx, qword [rsi + 0x110]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsi + 0x438], r14d
jne 0x14023024b
mov edx, 0xa
lea rcx, [rbp - 0x39]
call fcn.140133cd0
nop
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.140271bac
mov r12, qword [rbp - 0x31]
jmp 0x140230237
mov rdx, r12
test r12, r12
je 0x14023049f
mov r12, qword [r12]
mov rdx, qword [rdx + 0x10]
lea rcx, str.CDockablePane
call fcn.1401082ec
mov r13, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x680]
mov rcx, rbx
call fcn.14029e28c
mov rcx, r13
call rbx
test eax, eax
je 0x140230237
mov rdi, qword [r13]
mov rax, qword [r15]
mov rbx, qword [rax + 0x328]
mov rcx, rbx
call fcn.14029e28c
mov rcx, r15
call rbx
mov ebx, eax
mov rcx, qword [rdi + 0x6d0]
call fcn.14029e28c
mov dword [rsp + 0x20], r14d
xor r9d, r9d
mov r8d, ebx
lea edx, [r9 + 1]
mov rcx, r13
call qword [rdi + 0x6d0]
test r12, r12
jne 0x1402301b8
lea rcx, [rbp - 0x39]
call fcn.140133cf8
jmp 0x140230287
mov rdi, qword [rsi + 0x480]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x340]
mov rcx, rbx
call fcn.14029e28c
mov rcx, rdi
call rbx
mov rdx, rax
lea rcx, str.Py2_
call fcn.1401082ec
test rax, rax
je 0x140230287
xor edx, edx
mov rcx, rax
call fcn.1402768b4
mov rcx, qword [rsi + 0x110]
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rsi + 0x110]
lea rcx, str.CFrameWnd
call fcn.1401082ec
mov rdi, rax
test rax, rax
je 0x1402302da
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x2f0]
mov rcx, rbx
call fcn.14029e28c
mov edx, 1
mov rcx, rdi
call rbx
mov rcx, qword [rsi + 0x110]
mov r9d, 0x181
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x140230472
test r13, r13
je 0x140230472
test r15, r15
je 0x140230472
mov edi, dword [r13 + 0x1ec]
mov rax, qword [r15]
mov rbx, qword [rax + 0x328]
mov rcx, rbx
call fcn.14029e28c
mov rcx, r15
call rbx
test edi, eax
je 0x140230472
mov rdi, qword [rsi]
mov rax, qword [r15]
mov rbx, qword [rax + 0x328]
mov rcx, rbx
call fcn.14029e28c
mov rcx, r15
call rbx
mov ebx, eax
cmp dword [rsi + 0x438], r14d
sete r14b
mov rcx, qword [rdi + 0x6d0]
call fcn.14029e28c
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8d, ebx
mov edx, r14d
mov rcx, rsi
call qword [rdi + 0x6d0]
jmp 0x140230472
cmp dword [0x1403fb238], r14d
je 0x140230472
mov rcx, rsi
call fcn.14022ede4
mov r15, rax
test rax, rax
je 0x140230472
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x18]
mov rcx, rbx
call fcn.14029e28c
lea rdx, [rbp - 1]
mov rcx, r15
call rbx
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
lea rdx, [rbp + 0xf]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.1400fadd0
mov r8, qword [rbp + 0xf]
shr r8, 0x20
mov edx, dword [rbp + 0xf]
lea rcx, [rbp - 1]
call qword [sym.imp.USER32.dll_OffsetRect]
lea rdx, [rbp - 1]
mov rcx, rsi
call fcn.1400fa6c4
mov dword [r15 + 0x18], 1
mov ebx, dword [rbp - 1]
mov dword [rbp - 0x49], ebx
mov eax, dword [rbp + 0xb]
inc eax
mov dword [rbp - 0x45], eax
mov rcx, rsi
call fcn.1401057cc
bt eax, 0x16
jae 0x140230430
mov eax, dword [rbp + 7]
sub eax, dword [rbp - 1]
add ebx, eax
mov dword [rbp - 0x49], ebx
mov rdi, qword [rsi + 0x40]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x5c8]
mov rcx, rbx
call fcn.14029e28c
mov rdx, qword [rbp - 0x49]
mov rcx, rsi
call rbx
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140230472
mov dword [r15 + 0x18], r14d
mov rdx, r15
mov rcx, rsi
call fcn.140231ed8
jmp 0x140230472
call fcn.140158250
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14029d880
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400f91a0
nop
call fcn.1400f91a0
nop
int3