Function at 0x14006d95c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov r15, r8
mov rsi, rdx
xor ebx, ebx
test rdx, rdx
jne 0x14006d98d
mov qword [rsp + 0x38], rbx
jmp 0x14006d996
mov rax, qword [rdx + 0x40]
mov qword [rsp + 0x38], rax
mov r14d, dword [r8 + 8]
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.140020f14
mov r13, rax
mov qword [rsp + 0x40], rax
mov r12d, pe_nt_image_headers64
cmp r14d, r12d
jb 0x14006d9c9
cmp r14d, 0x109
jbe 0x14006d9d9
lea eax, [r14 - 0x200]
cmp eax, 9
ja 0x14006dab7
test r13, r13
je 0x14006dab7
mov rdi, r13
cmp qword [rdi + 0xc8], rbx
jne 0x14006da1f
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140020f14
cmp rax, rsi
je 0x14006da1f
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140020f14
mov rdi, rax
test rax, rax
jne 0x14006d9e5
test rdi, rdi
je 0x14006da57
mov rax, qword [rdi + 0xc8]
test rax, rax
je 0x14006da57
cmp qword [rax + 0x90], rbx
je 0x14006da57
mov rcx, qword [rax + 0x90]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + reloc.ODBC32.dll_SQLColumns]
test eax, eax
jne 0x14006da57
mov eax, 1
jmp 0x14006df0c
cmp r14d, 0x101
je 0x14006da6e
cmp r14d, r12d
je 0x14006da6e
cmp r14d, 0x102
jne 0x14006dab7
test rdi, rdi
je 0x14006dab7
mov rax, qword [rdi + 0xc8]
test rax, rax
je 0x14006dab7
mov ecx, reloc.ODBC32.dll_SQLFetch
lea edi, [rcx - 0xc]
cmp word [r15 + 0x10], cx
jne 0x14006da97
test byte [rax + 0xcc], dil
jne 0x14006dab0
mov ecx, reloc.WLDAP32.dll_Ordinal_27
lea r12d, [rcx - 0x19]
cmp word [r15 + 0x10], cx
jne 0x14006dac2
test byte [rax + 0xcc], r12b
je 0x14006dac2
xor eax, eax
jmp 0x14006df0c
mov r12d, 2
lea edi, [r12 - 1]
mov rcx, qword [r15]
call fcn.140020f14
mov qword [rsp + 0x30], rax
mov edx, ebx
mov dword [rsp + 0xb0], ebx
mov ecx, r14d
sub ecx, 0x100
je 0x14006dbaa
sub ecx, r12d
je 0x14006db1e
cmp ecx, 4
jne 0x14006de6b
test r13, r13
jne 0x14006db12
lea ecx, [r13 + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14006de6b
mov rax, qword [rsp + 0x30]
cmp word [r15 + 0x10], 0x20
je 0x14006de6b
test rax, rax
jne 0x14006db27
mov ecx, ebx
jmp 0x14006db45
mov r9, r15
mov r8, qword [r15 + 0x10]
mov edx, 0x87
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rcx, rax
mov rax, qword [rsp + 0x30]
cmp r14d, 0x102
jne 0x14006db57
test cl, 0x84
jne 0x14006de6b
mov r8d, 9
cmp word [r15 + 0x10], r8w
jne 0x14006db6d
test r12b, cl
jne 0x14006de6b
cmp word [r15 + 0x10], 0x20
je 0x14006dab0
mov r8, r15
mov rdx, rax
mov rcx, rsi
call fcn.14006d818
test rax, rax
je 0x14006de6b
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14006de6b
mov rdx, r15
call fcn.140052478
jmp 0x14006deb7
test rax, rax
jne 0x14006dbb3
mov eax, ebx
jmp 0x14006dbcb
mov r9, r15
mov r8, qword [r15 + 0x10]
mov edx, 0x87
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, ebx
movzx ecx, word [r15 + 0x10]
cmp ecx, 3
je 0x14006de03
mov r8d, 9
cmp ecx, r8d
je 0x14006dd5c
cmp ecx, 0xd
je 0x14006dd1c
cmp ecx, 0x1b
je 0x14006de03
cmp ecx, 0x24
jle 0x14006de6b
cmp ecx, 0x26
jle 0x14006dc1b
cmp ecx, 0x28
jle 0x14006dc24
cmp ecx, 0x2b
je 0x14006dd1c
jmp 0x14006de6b
mov edx, edi
mov dword [rsp + 0xb0], edx
test r13, r13
jne 0x14006dc2d
mov eax, ebx
jmp 0x14006dc4a
mov r9, r15
mov r8, qword [r15 + 0x10]
mov edx, 0x87
mov rcx, qword [r13 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [rsp + 0xb0]
test dil, al
jne 0x14006de6b
mov rcx, rsi
test edx, edx
je 0x14006dc63
xor edx, edx
call fcn.1400268c4
jmp 0x14006dc6a
xor edx, edx
call fcn.140026928
mov r12, rax
test rax, rax
je 0x14006de6b
cmp dword [rax + 0x10], ebx
je 0x14006dc86
mov rdx, rax
mov rcx, rsi
call fcn.140026388
cmp qword [r12 + 8], rbx
je 0x14006dca3
mov rcx, qword [r12 + 8]
mov rax, qword [rcx]
mov rdx, r15
call qword [rax + 0x158]
jmp 0x14006deb7
cmp qword [r12], rbx
je 0x14006dcaf
mov rcx, qword [r12]
jmp 0x14006dcd0
test r13, r13
mov rdx, rbx
je 0x14006dcbb
mov rdx, qword [r13 + 0x40]
mov r8d, dword [rsp + 0xb0]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetNextDlgGroupItem]
mov rcx, rax
call fcn.140020f14
mov r14, rax
test rax, rax
je 0x14006de6b
mov rax, qword [rsi + 0xc0]
mov qword [rax + 0xd8], rbx
mov rcx, r14
call fcn.14006cfc0
cmp dword [r12 + 0x10], ebx
je 0x14006deb7
xor r9d, r9d
mov r8, rdi
mov edx, 0xf1
mov rcx, qword [r14 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageA]
jmp 0x14006deb7
test al, 4
jne 0x14006de6b
mov rcx, r13
call fcn.14006cf7c
test al, 0x10
je 0x14006dd4c
mov r14, r13
mov rcx, r13
call fcn.140025dfc
mov r12d, eax
test r13, r13
jne 0x14006de16
jmp 0x14006de03
mov rcx, rsi
call fcn.14006d498
mov r12d, eax
jmp 0x14006de03
test r12b, al
jne 0x14006de6b
mov ecx, reloc.ODBC32.dll_SQLFreeStmt
call qword [sym.imp.USER32.dll_GetKeyState]
mov r12d, ebx
test ax, ax
sets r12b
mov r8d, r12d
xor edx, edx
mov rcx, rsi
call fcn.1400261e0
test rax, rax
je 0x14006de6b
cmp qword [rax + 8], rbx
je 0x14006dd9f
mov rcx, qword [rax + 8]
jmp 0x14006dc92
cmp qword [rax], rbx
je 0x14006dda9
mov rcx, qword [rax]
jmp 0x14006ddcc
mov rdx, qword [rsp + 0x30]
test rdx, rdx
jne 0x14006ddb8
mov rdx, rbx
jmp 0x14006ddbc
mov rdx, qword [rdx + 0x40]
mov r8d, r12d
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rcx, rax
call fcn.140020f14
mov r12, rax
test rax, rax
je 0x14006deb7
mov rax, qword [rsi + 0xc0]
mov qword [rax + 0xd8], rbx
mov rcx, r12
call fcn.14006cfc0
mov rdx, r12
mov rcx, r13
call fcn.14006d24c
jmp 0x14006deb7
mov edx, r12d
mov rcx, rsi
call fcn.14006d30c
mov r14, rax
test rax, rax
je 0x14006de6b
mov rcx, r14
call fcn.140025ec4
test eax, eax
jne 0x14006de2c
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x14006de6b
cmp qword [r14 + 0xc8], rbx
je 0x14006de6b
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
movzx r9d, bx
movzx r8d, di
mov edx, 0xfffffdd9
mov rcx, r14
call fcn.140025f14
nop
jmp 0x14006deb7
test dword [rsi + 0xa0], 0x1000
jne 0x14006deb5
mov rdx, r15
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_IsDialogMessageA]
mov edi, eax
test eax, eax
je 0x14006deb7
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140020f14
cmp rax, r13
je 0x14006deb7
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140020f14
mov rcx, rax
call fcn.14006d1ac
jmp 0x14006deb7
mov edi, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14006df0a
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140020f14
mov rdx, rax
mov rcx, r13
call fcn.14006d24c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14006df0a
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140020f14
mov r8, rax
mov rdx, r13
mov rcx, rsi
call fcn.14006d4d4
mov eax, edi
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret