Function at 0x1401febb0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf8
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.USER32.dll_SetRectEmpty]
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x1401febf0
jmp 0x1401ff209
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
call fcn.1402131e0
mov rdx, qword [rsp + 0x118]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov r8, rax
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov r9d, 1
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x110]
call qword [rax + 0x38]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x1401fec8e
mov rdi, qword [rsp + 0x40]
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x128]
mov r8, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x40]
call qword [rdi + 0x340]
cmp qword [rsp + 0x40], 0
je 0x1401fecac
mov rcx, qword [rsp + 0x128]
call qword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x1401ff209
mov rax, qword [rsp + 0x110]
cmp qword [rax + 0x308], 0
je 0x1401fed6a
mov rax, qword [rsp + 0x110]
mov rax, qword [rax + 0x308]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
cmp dword [rax + 0xc], 0
je 0x1401fed02
mov rax, qword [rsp + 0xa8]
cmp dword [rax + 8], 0
je 0x1401fed02
mov dword [rsp + 0xc0], 1
jmp 0x1401fed0d
mov dword [rsp + 0xc0], 0
cmp dword [rsp + 0xc0], 0
je 0x1401fed6a
call fcn.1402131e0
mov rdx, qword [rsp + 0x118]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc8]
call qword [rax + CToolBarCtrl::~CToolBarCtrl]
mov rdi, rax
call fcn.14013f890
mov rdx, rdi
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0xd0], rax
jmp 0x1401fed76
mov qword [rsp + 0xd0], 0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rdi, qword [rsp + 0x110]
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
mov r9b, 1
mov r8d, dword [0x1404dfb10]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x110]
call qword [rdi + 0x30]
mov rdi, rax
call fcn.140271b40
mov rdx, rdi
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1401feeaa
mov rcx, qword [rsp + 0x58]
call fcn.14027bfe0
test rax, rax
je 0x1401feeaa
call fcn.1402131e0
mov rdx, rax
mov rcx, qword [rsp + 0x118]
call sub.mfc90u.dll_CWnd::GetTopLevelFrame
test eax, eax
je 0x1401fee51
call fcn.1402131e0
mov rdx, qword [rsp + 0x118]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
call qword [rax + CWinThread::CommonConstruct]
test eax, eax
jne 0x1401fee51
jmp 0x1401ff209
mov rcx, qword [rsp + 0x58]
call fcn.14027bfe0
mov qword [rsp + 0x60], rax
mov rdi, qword [rsp + 0x60]
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x128]
mov r8, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x118]
mov rcx, qword [rsp + 0x60]
call qword [rdi + 0x4f8]
jmp 0x1401ff209
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x48]
mov rdx, qword [rsp + 0x120]
mov rcx, qword [rsp + 0x110]
call fcn.1401fdc00
test eax, eax
je 0x1401ff1fa
mov rax, qword [rsp + 0x138]
mov qword [rax], 0
call fcn.1402131e0
mov rdx, rax
mov rcx, qword [rsp + 0x118]
call sub.mfc90u.dll_CWnd::GetTopLevelFrame
test eax, eax
je 0x1401fef81
call fcn.1402131e0
mov rdx, qword [rsp + 0x118]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
call qword [rax + CToolBarCtrl::~CToolBarCtrl]
mov rdi, rax
call fcn.140142bb0
mov rdx, rdi
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x1401fef7f
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
call qword [rax + CStatusBar::~CStatusBar]
and eax, dword [rsp + 0x48]
test eax, eax
jne 0x1401fef7f
jmp 0x1401ff209
jmp 0x1401fefdd
call fcn.140271b40
mov rdx, rax
mov rcx, qword [rsp + 0x118]
call sub.mfc90u.dll_CWnd::GetTopLevelFrame
test eax, eax
je 0x1401fefdd
call fcn.140271b40
mov rdx, qword [rsp + 0x118]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98]
call qword [rax + CStatusBar::~CStatusBar]
and eax, dword [rsp + 0x48]
test eax, eax
jne 0x1401fefdd
jmp 0x1401ff209
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x118]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [rsp + 0x4c], 0
je 0x1401ff013
mov rax, qword [rsp + 0x110]
add rax, 0x1d8
mov qword [rsp + 0xd8], rax
jmp 0x1401ff029
mov rax, qword [rsp + 0x110]
add rax, 0x1c8
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xa0], rax
lea rdi, [rsp + 0xb0]
mov rsi, qword [rsp + 0xa0]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
lea rsi, [rsp + 0xb0]
mov rdi, qword [rsp + 0x128]
mov ecx, reloc.WS2_32.dll_recv
rep movsb byte [rdi], byte [rsi]
mov rcx, qword [rsp + 0x110]
mov rcx, qword [rcx + 0x1b0]
call sub.mfc90u.dll_CRichEditView::GetContextMenu
and eax, 0x400000
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0xe0], eax
cmp dword [rsp + 0xe0], reloc.mfc90u.dll_CDaoTableDef::GetValidationRule
je 0x1401ff0d3
cmp dword [rsp + 0xe0], 0x2000
je 0x1401ff172
cmp dword [rsp + 0xe0], 0x4000
je 0x1401ff124
cmp dword [rsp + 0xe0], 0x8000
je 0x1401ff194
jmp 0x1401ff1b6
cmp dword [rsp + 0x80], 0
je 0x1401ff100
mov eax, dword [rsp + 0x70]
mov edx, dword [rsp + 0x78]
sub edx, eax
mov rax, qword [rsp + 0x128]
mov ecx, dword [rax + 8]
sub ecx, edx
mov rax, qword [rsp + 0x128]
mov dword [rax], ecx
jmp 0x1401ff11f
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x78]
sub ecx, eax
mov rax, qword [rsp + 0x128]
add ecx, dword [rax]
mov rax, qword [rsp + 0x128]
mov dword [rax + 8], ecx
jmp 0x1401ff1b6
cmp dword [rsp + 0x80], 0
je 0x1401ff14f
mov eax, dword [rsp + 0x70]
mov ecx, dword [rsp + 0x78]
sub ecx, eax
mov rax, qword [rsp + 0x128]
add ecx, dword [rax]
mov rax, qword [rsp + 0x128]
mov dword [rax + 8], ecx
jmp 0x1401ff170
mov eax, dword [rsp + 0x70]
mov edx, dword [rsp + 0x78]
sub edx, eax
mov rax, qword [rsp + 0x128]
mov ecx, dword [rax + 8]
sub ecx, edx
mov rax, qword [rsp + 0x128]
mov dword [rax], ecx
jmp 0x1401ff1b6
mov eax, dword [rsp + 0x74]
mov ecx, dword [rsp + 0x7c]
sub ecx, eax
mov rax, qword [rsp + 0x128]
add ecx, dword [rax + 4]
mov rax, qword [rsp + 0x128]
mov dword [rax + 0xc], ecx
jmp 0x1401ff1b6
mov eax, dword [rsp + 0x74]
mov edx, dword [rsp + 0x7c]
sub edx, eax
mov rax, qword [rsp + 0x128]
mov ecx, dword [rax + 0xc]
sub ecx, edx
mov rax, qword [rsp + 0x128]
mov dword [rax + 4], ecx
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov r8d, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x110]
call qword [rax + 0xc0]
mov rdx, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x110]
mov rcx, qword [rcx + 0x1b0]
call sub.mfc90u.dll_CDragListBox::CancelDrag
jmp 0x1401ff209
mov rax, qword [rsp + 0x138]
mov qword [rax], 0
add rsp, 0xf8
pop rdi
pop rsi
ret