Function at 0x14015b080
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x360
lea rbp, [rsp + 0x80]
mov eax, ecx
mov qword [rbp + 0x2f8], rdx
mov dword [rbp + 0x300], r8d
mov ecx, r9d
mov edx, dword [rbp + 0x310]
mov byte [rbp + 0x2f0], al
mov eax, ecx
mov word [rbp + 0x308], ax
mov eax, edx
mov byte [rbp - 0x44], al
movabs rax, 0x113084782de8c155
mov qword [rbp + 0x2c8], rax
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x248], rax
mov rax, qword [rbp + 0x248]
test rax, rax
je 0x14015b189
movabs rdx, 0x628986b1aedd87f2
cmp rax, rdx
jne 0x14015b5d7
movabs rdx, 0xcf77ce00c69ba620
mov rax, qword [rbp + 0x2f8]
add rax, rdx
mov qword [rbp + 0x248], rax
cmp dword [rbp + 0x300], 0x40372f68
je 0x14015b137
cmp dword [rbp + 0x300], 0x6d49d4f2
je 0x14015b15d
jmp 0x14015b5d7
mov ecx, 0xe8
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
mov word [rbp + 0x1ee], ax
mov edx, 0x14
mov ecx, 0xfe
call fcn.14015b610
jmp 0x14015b184
lea rdx, [rbp + 0x254]
mov rax, qword [rbp + 0x2c0]
mov r8, rdx
lea rdx, [fcn.14015b080]
mov rcx, rax
call sub.COMCTL32.dll_RemoveWindowSubclass
mov dword [rbp + 0x254], eax
nop
jmp 0x14015b5d7
cmp dword [rbp + 0x300], 0x1bd26883
jne 0x14015b22b
movabs rax, 0x4e4a4deb9220ce5a
and rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x248], rax
lea rax, [rbp + 0xf0]
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_GetSaveFileNameA]
call rax
mov dword [rbp + 0x2bc], eax
movabs rax, 0xeb863f305bf3c440
xor rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x248], rax
lea rax, [rbp + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_ReplaceTextA]
call rax
mov qword [rbp + 0x2b0], rax
movzx eax, byte [rbp - 0x44]
mov byte [rbp + 0x2f0], al
movzx eax, word [rbp + 0x308]
mov word [rbp + 0x1ee], ax
lea rax, [rbp + 0x190]
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_ReplaceTextA]
call rax
mov qword [rbp + 0x2a8], rax
mov rax, qword [rbp + 0x248]
mov rdx, qword [rbp + 0x2f8]
mov ecx, edx
shl rax, cl
mov qword [rbp + 0x2c8], rax
movzx eax, byte [rbp + 0x2f0]
mov edx, 0x9c
mov ecx, edx
sar eax, cl
mov edx, eax
movzx eax, byte [rbp - 0x44]
cmp edx, eax
jge 0x14015b28a
movzx eax, byte [rbp - 0x44]
movzx ecx, byte [rbp + 0x2f0]
movzx edx, byte [rbp + 0x2f0]
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
mov edx, 0x92
mov ecx, 0xa8
call fcn.140001450
lea rax, [rbp + 0x1ee]
mov qword [rbp + 0x2a0], rax
mov rax, qword [rbp + 0x248]
test rax, rax
je 0x14015b2b8
movabs rdx, 0xa87c77708d8888a6
cmp rax, rdx
je 0x14015b305
jmp 0x14015b3a6
mov dword [rbp + 0x2d4], 0x8e9d1624
mov rax, qword [rbp + 0x2f8]
mov qword [rbp + 0x2d8], rax
movzx eax, word [rbp + 0x1ee]
mov word [rbp + 0x2d2], ax
movzx eax, byte [rbp + 0x2f0]
mov byte [rbp + 0x247], al
mov rax, qword [rbp + 0x2f8]
or rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x248], rax
jmp 0x14015b3a6
mov rax, qword [rbp + 0x2a0]
movzx eax, word [rax]
mov word [rbp + 0x308], ax
cmp dword [rbp + 0x2d4], 0x4b3f1e02
jbe 0x14015b340
movzx eax, word [rbp + 0x1ee]
mov edx, eax
movzx eax, word [rbp + 0x2d2]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0x2a0]
mov word [rax], dx
movabs rax, 0x2b6eb4fb2e8ca095
cmp qword [rbp + 0x2d8], rax
je 0x14015b368
movabs rax, 0x4ff7c66f4a6919b7
cmp qword [rbp + 0x2d8], rax
je 0x14015b38b
jmp 0x14015b3a5
movzx eax, byte [rbp + 0x247]
movzx edx, al
movzx eax, word [rbp + 0x1ee]
cwde
mov r8d, edx
mov edx, 0x88
mov ecx, eax
call fcn.140001729
jmp 0x14015b3a5
lea rax, [rbp + 0x80]
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_ChooseFontA]
call rax
mov dword [rbp + 0x29c], eax
nop
nop
mov eax, dword [rbp + 0x2d4]
mov dword [rbp + 0x298], eax
lea rax, [rbp + 0x247]
mov qword [rbp + 0x290], rax
mov eax, dword [rbp + 0x298]
add eax, 0x719b8ae4
cmp dword [rbp + 0x2d4], eax
jae 0x14015b467
mov rax, qword [rbp + 0x2a0]
movzx eax, word [rax]
mov edx, eax
movzx eax, word [rbp + 0x2d2]
sub edx, eax
mov rax, qword [rbp + 0x2a0]
mov word [rax], dx
cmp dword [rbp + 0x2d4], 0x126f1389
jne 0x14015b43b
movzx eax, byte [rbp + 0x247]
movzx eax, al
movzx ecx, byte [rbp + 0x2f0]
movzx edx, byte [rbp + 0x247]
movzx edx, dl
mov dword [rsp + 0x20], eax
mov r9d, ecx
mov r8d, edx
mov edx, 0x90
mov ecx, 0x3a
call fcn.140001450
jmp 0x14015b53f
mov rdx, qword [rbp + 0x268]
mov rax, qword [rbp + 0x270]
mov r8d, 0x88
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_GetFileTitleA]
call rax
mov word [rbp + 0x28e], ax
jmp 0x14015b53f
mov rax, qword [rbp + 0x2a0]
movzx eax, word [rax]
cwde
cmp eax, 0x5eed
je 0x14015b4b4
cmp eax, 0x6f8f
jne 0x14015b523
movzx edx, byte [rbp + 0x247]
movzx eax, byte [rbp + 0x2f0]
add edx, eax
mov rax, qword [rbp + 0x290]
mov byte [rax], dl
mov rax, qword [rbp + 0x248]
xor rax, qword [rbp + 0x2d8]
mov qword [rbp + 0x2c8], rax
jmp 0x14015b523
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_ChooseFontA]
call rax
mov dword [rbp + 0x254], eax
mov rax, qword [rbp + 0x2a0]
movzx eax, word [rax]
movsx edx, ax
movsx eax, word [rbp + 0x28e]
mov ecx, eax
shl edx, cl
mov eax, edx
mov edx, eax
mov rax, qword [rbp + 0x2a0]
mov word [rax], dx
movzx edx, byte [rbp + 0x2f0]
movzx eax, byte [rbp - 0x44]
mov ecx, eax
sar edx, cl
mov eax, edx
mov byte [rbp + 0x247], al
mov rax, qword [rbp + 0x290]
movzx eax, byte [rax]
or al, byte [rbp + 0x2f0]
mov edx, eax
mov rax, qword [rbp + 0x290]
mov byte [rax], dl
nop
lea rax, [rbp + 0x247]
mov qword [rbp + 0x280], rax
lea rax, [rbp + 0x248]
mov qword [rbp + 0x278], rax
mov rax, qword [rbp + 0x290]
movzx eax, byte [rax]
and al, byte [rbp - 0x44]
mov byte [rbp + 0x247], al
movzx eax, byte [rbp + 0x247]
movzx eax, al
cmp eax, 0x1a
je 0x14015b568
cmp eax, 0xd9
jmp 0x14015b575
mov eax, dword [rbp + 0x298]
mov dword [rbp + 0x264], eax
nop
movzx edx, word [rbp + 0x308]
movzx eax, word [rbp + 0x2d2]
add eax, edx
mov edx, eax
mov rax, qword [rbp + 0x2a0]
mov word [rax], dx
lea rax, [rbp + 0x1f0]
mov rcx, rax
mov rax, qword [sym.imp.comdlg32.dll_FindTextA]
call rax
mov qword [rbp + 0x258], rax
movzx eax, word [rbp + 0x2d2]
movzx edx, word [rbp + 0x1ee]
sub eax, edx
mov edx, eax
mov rax, qword [rbp + 0x2a0]
mov word [rax], dx
mov rax, qword [sym.imp.comdlg32.dll_CommDlgExtendedError]
call rax
mov dword [rbp + 0x264], eax
nop
movabs rdx, 0xcc97a36669814e3e
mov rax, qword [rbp + 0x2f8]
add rax, rdx
mov qword [rbp + 0x248], rax
mov rax, qword [sym.imp.USER32.dll_GetCapture]
call rax
mov qword [rbp + 0x2a8], rax
mov eax, 0x1a
add rsp, 0x360
pop rbp
ret