Function at 0x100001fd4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, rdx
mov rbp, rcx
cmp byte [rcx + 0x125], r14b
jne 0x10000df23
cmp byte [rcx + 0x126], r14b
jne 0x10001820f
cmp byte [rcx + 0x127], r14b
jne 0x1000307a4
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov rsi, qword [rcx + 0x100]
jmp 0x10000df2c
cmp rsi, r14
je 0x10000201a
cmp dword [rdx + 8], 0x100
jne 0x10000201a
mov eax, 9
cmp ax, word [rdx + 0x10]
jne 0x10000201a
jmp 0x1000307b0
mov rsi, qword [rcx + 0x108]
jmp 0x10000df2c
mov rsi, qword [rcx + 0x110]
jmp 0x10000df2c
lea ecx, [rax + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x50]
cmp ax, r14w
mov rax, qword [rsi]
mov rcx, rsi
mov r13d, r14d
setl r13b
call qword [rax + 0x50]
mov r11, qword [rsi]
mov rcx, rsi
call qword [r11 + 0x38]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
cmp eax, 6
jne 0x10003093d
lea r12d, [rax - 5]
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, rbx
je 0x100030827
mov rcx, qword [rdi]
mov rbx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, rbx
je 0x100030827
cmp r13d, r14d
je 0x10003086f
mov rcx, qword [rsp + 0x60]
jmp 0x100030874
cmp r13d, r14d
je 0x100030892
mov rax, qword [rsp + 0x50]
cmp qword [rdi], rax
je 0x1000308ed
mov rcx, qword [rsi + 0x430]
mov edx, 0xfa4
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp qword [rdi], rax
je 0x10003086f
mov rcx, qword [rsi + 0x438]
mov rbx, qword [rdi]
mov edx, 0xfa6
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
jne 0x10003091d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetFocus]
call fcn.100001bd8
lea rcx, [0x100073a58]
xor edx, edx
call fcn.1000253fc
jmp 0x100030935
mov rbx, qword [rdi]
mov rcx, qword [rsp + 0x50]
cmp rbx, rcx
jne 0x1000308e6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x147
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, r14
je 0x1000308cf
cmp rax, r12
jne 0x1000308c8
mov rcx, qword [rsi + 0x438]
mov edx, 0xfa6
jmp 0x1000308db
mov rax, qword [rsp + 0x50]
jmp 0x1000308e1
mov rcx, qword [rsi + 0x430]
mov edx, 0xfa4
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
jmp 0x100030874
cmp rbx, qword [rsp + 0x60]
jne 0x10003091d
mov rcx, qword [rbp + 0x190]
mov edx, reloc.OLEAUT32.dll_DllRegisterServer
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
call fcn.100001bd8
lea rcx, [0x100073a58]
xor edx, edx
call fcn.1000021a0
jmp 0x100030935
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.USER32.dll_IsDialogMessageW]
mov r12d, eax
mov eax, r12d
jmp 0x10000201c
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, rbx
jne 0x1000309a8
cmp r13d, r14d
je 0x100030969
mov rax, qword [rsp + 0x50]
cmp qword [rdi], rax
je 0x100030970
mov rcx, qword [rsi + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_IsDialogMessageW]
jmp 0x10000201c
mov rax, qword [rsp + 0x60]
jmp 0x100030952
mov rcx, qword [rbp + 0x190]
mov edx, reloc.OLEAUT32.dll_DllRegisterServer
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
call fcn.100001bd8
lea rcx, [0x100073a58]
xor edx, edx
call fcn.1000021a0
mov eax, 1
jmp 0x10000201c
mov rcx, qword [rsp + 0x60]
cmp r13d, r14d
jne 0x1000309b7
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.USER32.dll_SetFocus]
call fcn.100001bd8
lea rcx, [0x100073a58]
xor edx, edx
call fcn.1000253fc
jmp 0x10003099e