Function at 0x14014ef14
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov edi, edx
mov rbx, rcx
xor r15d, r15d
cmp qword [rcx + 0x500], r15
jne 0x14014ef4b
xor eax, eax
jmp 0x14014f81f
mov rcx, qword [rcx + 0x2a8]
cmp rcx, r15
je 0x14014ef6f
mov rax, qword [rcx]
call qword [rax + 0x320]
cmp eax, r15d
je 0x14014ef6f
mov eax, 1
jmp 0x14014f81f
cmp edi, 9
jne 0x14014ef89
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 0x80
neg al
sbb edi, edi
and edi, 0xfffffffe
add edi, 0x28
mov rbp, r15
mov ecx, dword [rbx + 0x20]
mov esi, 1
cmp ecx, r15d
jne 0x14014efaa
cmp dword [rbx + 0x30], r15d
je 0x14014efa5
cmp dword [rbx + 0x34], r15d
jne 0x14014efaa
mov eax, r15d
jmp 0x14014efac
mov eax, esi
mov r13d, r15d
mov dword [rsp + 0xa0], r15d
movsxd r9, eax
mov qword [rsp + 0x40], r9
mov eax, edi
sub eax, 0xd
je 0x14014f5da
sub eax, 0x13
je 0x14014f5da
mov r9d, 5
sub eax, r9d
je 0x14014f3ae
sub eax, esi
je 0x14014f207
sub eax, esi
je 0x14014f1ae
cmp eax, esi
je 0x14014f207
cmp ecx, r15d
je 0x14014f603
mov ecx, edi
call fcn.140097444
cmp eax, r15d
je 0x14014f018
mov ecx, edi
call fcn.140097500
mov edi, eax
mov r14d, r15d
cmp qword [rbx + 0x500], r15
jle 0x14014f600
cmp r13, r15
jl 0x14014f1a8
cmp r13, qword [rbx + 0x500]
jge 0x14014f1a8
mov rax, qword [rbx + 0x4f8]
mov r12, qword [rax + r13*8]
mov rax, qword [r12]
mov edx, edi
mov rcx, r12
call qword [rax + 0x278]
cmp eax, r15d
jne 0x14014f1a1
mov rdx, qword [r12 + 8]
lea rcx, [rsp + 0xb8]
call fcn.140005e60
nop
mov rax, qword [rsp + 0xb8]
cmp dword [rax - 0x10], r15d
jle 0x14014f10a
mov edx, 0x26
mov rcx, rax
call fcn.14018307c
mov r11, rax
cmp rax, r15
je 0x14014f102
mov rax, qword [rsp + 0xb8]
sub r11, rax
sar r11, 1
cmp r11d, r15d
jl 0x14014f10a
mov ecx, dword [rax - 0x10]
dec ecx
cmp r11d, ecx
jge 0x14014f10a
lea ecx, [r11 + 1]
cmp ecx, r15d
jl 0x14014f189
cmp ecx, dword [rax - 0x10]
jg 0x14014f189
movsxd rcx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + 0xb0], dx
mov word [rsp + 0xb2], r15w
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx r11d, word [rsp + 0xb0]
cmp r11d, edi
je 0x14014f13d
mov rax, qword [rsp + 0xb8]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x14014f126
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r14d, esi
add r13, rsi
movsxd rax, r14d
cmp rax, qword [rbx + 0x500]
jge 0x14014f194
jmp 0x14014f028
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x70]
cmp eax, r15d
jne 0x14014f154
mov rbp, r12
mov r13d, esi
jmp 0x14014f15c
mov r13d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x14014f603
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14014f603
mov ecx, 0x80070057
call fcn.140001f40
nop
mov r13d, dword [rsp + 0xa0]
jmp 0x14014f603
mov eax, esi
jmp 0x14014f81f
call fcn.1400124d4
int3
cmp ecx, r15d
je 0x14014f3ae
mov rcx, qword [rbx + 0x2a8]
cmp rcx, r15
je 0x14014f3ae
mov rax, qword [rcx]
call qword [rax + 0x130]
cmp eax, r15d
je 0x14014f3ae
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, r15d
jne 0x14014f3ae
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x138]
jmp 0x14014f603
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x14014f389
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x28
jne 0x14014f24f
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x38]
shr r12, 0x20
add r12d, esi
jmp 0x14014f265
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x30]
shr r12, 0x20
sub r12d, esi
mov ecx, 0xfffffffb
cmp edi, 0x28
cmove ecx, r9d
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xb8], r15d
cmp rbp, r15
jne 0x14014f5f1
mov r15d, eax
mov r14d, eax
mov esi, dword [rsp + 0xb0]
mov r13d, r12d
cmp r14d, dword [rbx + 0x70]
jge 0x14014f2a9
cmp r15d, dword [rbx + 0x78]
jg 0x14014f339
test rbp, rbp
jne 0x14014f32a
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x2c], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x14014f2f4
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x14014f309
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r13d, esi
cmp edi, 0x28
jne 0x14014f319
cmp r13d, dword [rbx + 0x7c]
jg 0x14014f324
jmp 0x14014f31f
cmp r13d, dword [rbx + 0x74]
jl 0x14014f324
test rbp, rbp
je 0x14014f2b3
mov r9d, 5
sub r14d, r9d
add r15d, r9d
test rbp, rbp
je 0x14014f296
mov eax, dword [rsp + 0xb8]
xor r15d, r15d
cmp eax, r15d
lea esi, [r15 + 1]
jne 0x14014f36b
cmp rbp, r15
jne 0x14014f36b
cmp qword [rsp + 0x40], r15
je 0x14014f5fb
cmp edi, 0x28
jne 0x14014f367
mov r12d, dword [rbx + 0x74]
jmp 0x14014f36b
mov r12d, dword [rbx + 0x7c]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x14014f280
mov r13d, r15d
jmp 0x14014f603
cmp edi, 0x28
jne 0x14014f39e
mov rcx, rbx
call fcn.14014a964
mov rbp, rax
jmp 0x14014f603
mov rcx, rbx
call fcn.14014a9e8
mov rbp, rax
jmp 0x14014f603
cmp dword [rbx + 0x20], r15d
je 0x14014f433
cmp edi, 0x25
jne 0x14014f433
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x14014f433
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001917c
mov rdx, rax
lea rcx, str.CMFCPopupMenu
call fcn.1400577f4
mov r12, rax
mov rcx, rax
call fcn.140043c00
cmp rax, r15
je 0x14014f433
mov rcx, qword [rbx + 0xc0]
call fcn.14013d99c
cmp rax, r15
je 0x14014f422
cmp qword [rax + 0xae0], rbx
jne 0x14014f422
mov r8d, esi
mov rdx, qword [rax + 0xad8]
mov rcx, rax
call fcn.1400d2b24
xor edx, edx
mov rcx, r12
call fcn.1400456b0
mov eax, esi
jmp 0x14014f81f
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x14014f5bb
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x38]
shr rax, 0x20
mov rcx, qword [rsp + 0x30]
shr rcx, 0x20
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x27
jne 0x14014f481
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x38]
inc r15d
jmp 0x14014f493
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x30]
dec r15d
mov ecx, 0xfffffffb
cmp edi, 0x27
lea edx, [rcx + 0xa]
cmove ecx, edx
mov dword [rsp + 0xb0], ecx
and dword [rsp + 0xb8], ebp
test rbp, rbp
jne 0x14014f5df
mov r14d, eax
mov r13d, eax
mov esi, dword [rsp + 0xb0]
lea eax, [rbp + 5]
mov r12d, r15d
cmp r13d, dword [rbx + 0x74]
jge 0x14014f4db
cmp r14d, dword [rbx + 0x7c]
jg 0x14014f56a
test rbp, rbp
jne 0x14014f55b
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r12d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x14014f526
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x2c], r14d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x14014f53b
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r12d, esi
cmp edi, 0x27
jne 0x14014f54b
cmp r12d, dword [rbx + 0x78]
jg 0x14014f556
jmp 0x14014f551
cmp r12d, dword [rbx + 0x70]
jl 0x14014f556
test rbp, rbp
je 0x14014f4e5
mov eax, 5
sub r13d, eax
add r14d, eax
test rbp, rbp
je 0x14014f4c8
mov eax, dword [rsp + 0xb8]
test eax, eax
mov esi, 1
jne 0x14014f598
test rbp, rbp
jne 0x14014f598
xor r15d, r15d
cmp qword [rsp + 0x40], r15
je 0x14014f5ec
cmp edi, 0x27
jne 0x14014f594
mov r15d, dword [rbx + 0x70]
jmp 0x14014f598
mov r15d, dword [rbx + 0x78]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x14014f4af
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x14014f603
cmp edi, 0x27
jne 0x14014f5cd
mov rcx, rbx
call fcn.14014a964
mov rbp, rax
jmp 0x14014f603
mov rcx, rbx
call fcn.14014a9e8
mov rbp, rax
jmp 0x14014f603
mov r13d, esi
jmp 0x14014f603
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x14014f603
mov r13d, r15d
jmp 0x14014f603
mov r13d, dword [rsp + 0xa0]
jmp 0x14014f603
mov r13d, r15d
jmp 0x14014f603
mov r13d, ebp
mov r12d, r15d
cmp rbp, r15
je 0x14014f77a
mov rax, qword [rbx + 0x2a8]
cmp rax, rbp
je 0x14014f777
cmp rax, r15
je 0x14014f662
mov dword [rax + 0xa4], r15d
mov rax, qword [rbx + 0x2a8]
mov dword [rax + 0xa8], r15d
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov qword [rbx + 0x2a8], r15
cmp dword [0x1402567d4], r15d
je 0x14014f6e1
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x14014f6e1
cmp dword [rbx + 0x20], r15d
je 0x14014f6e1
movdqu xmm0, xmmword [rbp + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], eax
shr rax, 0x20
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_ClientToScreen]
movzx ecx, word [rsp + 0x24]
shl ecx, 0x10
movzx eax, word [rsp + 0x20]
or rcx, rax
mov rdx, qword [rbx + 0xc0]
cmp rdx, r15
jne 0x14014f6c9
mov rdx, r15
jmp 0x14014f6cd
mov rdx, qword [rdx + 0x40]
mov r9d, ecx
mov ecx, 0x8005
mov r8d, 0xfffffffc
call qword [sym.imp.USER32.dll_NotifyWinEvent]
mov qword [rbx + 0x2a8], rbp
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2d8]
mov dword [rbp + 0xa4], esi
mov dword [rbp + 0xa8], esi
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x14014f777
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001917c
mov rdx, rax
lea rcx, str.CMFCRibbonPanelMenu
call fcn.1400577f4
cmp rax, r15
je 0x14014f777
mov rcx, qword [rax + 0x17e8]
cmp rcx, r15
je 0x14014f777
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2a8]
mov rdx, qword [rbx + 0xc0]
call qword [rax + 0x2a0]
mov r12d, esi
cmp r13d, r15d
je 0x14014f81c
mov rdx, qword [rbx + 0x2a8]
cmp rdx, r15
je 0x14014f81c
lea rcx, str.CMFCRibbonButton
call fcn.1400577f4
mov rdi, rax
cmp rax, r15
je 0x14014f81c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x130]
cmp eax, r15d
je 0x14014f7c6
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x138]
jmp 0x14014f819
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x70]
cmp eax, r15d
jne 0x14014f819
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x14014f7fd
call fcn.14013d99c
cmp rax, r15
je 0x14014f7fd
cmp qword [rax + 0xae0], rbx
jne 0x14014f7fd
mov edx, esi
mov rcx, rax
call fcn.1400d2804
movdqu xmm0, xmmword [rdi + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x358]
mov r12d, esi
mov eax, r12d
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret