Function at 0x14002a680
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140412700]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, r8
mov rdi, rcx
call fcn.1401c5834
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r15d, ax
mov ecx, reloc.COMCTL32.dll_InitCommonControls
shr r15d, 0xf
and r15b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
movzx r14d, ax
mov ecx, SafeArrayLock
shr r14d, 0xf
and r14b, 1
call qword [sym.imp.USER32.dll_GetKeyState]
or dword [rdi + 0x250], 0xffffffff
mov rcx, rdi
movzx r12d, ax
shr r12d, 0xf
and r12b, 1
call fcn.140024d30
mov rcx, rdi
cmp dword [rbp + 0x44], eax
jge 0x14002a869
mov edx, ebx
call fcn.140020c68
xor esi, esi
test eax, eax
js 0x14002a72f
mov dword [rdi + 0x250], eax
jmp 0x14002a82e
mov edx, ebx
mov rcx, rdi
call fcn.140020588
mov rcx, qword [rdi]
mov r14d, eax
mov qword [rbp - 0x28], rsi
mov dword [rbp - 0x30], esi
mov rax, qword [rcx + 0x370]
mov rcx, rdi
call qword [case.0x14001d845.0]
mov r15d, eax
mov ebx, esi
test eax, eax
jle 0x14002a7a5
mov rcx, qword [rdi]
mov edx, ebx
mov rax, qword [rcx + 0x3f0]
mov rcx, rdi
call qword [case.0x14001d845.0]
xor r9d, r9d
mov edx, ebx
mov r8d, eax
mov rcx, rdi
call fcn.140021494
cmp r14d, eax
jl 0x14002a792
inc ebx
cmp ebx, r15d
jl 0x14002a75f
jmp 0x14002a7a5
mov r8d, r14d
mov edx, ebx
mov rcx, rdi
call fcn.140021888
mov dword [rbp - 0x28], eax
mov dword [rbp - 0x24], ebx
lea ebx, [r15 - 1]
mov dword [rbp - 0x2c], ebx
test ebx, ebx
js 0x14002a7f4
mov rax, qword [rdi]
mov edx, ebx
mov rcx, rdi
mov rax, qword [rax + 0x3f0]
call qword [case.0x14001d845.0]
xor r9d, r9d
mov edx, ebx
mov r8d, eax
mov rcx, rdi
call fcn.140021494
cmp r14d, eax
jl 0x14002a7e1
sub ebx, 1
jns 0x14002a7b0
jmp 0x14002a7f4
mov r8d, r14d
mov edx, ebx
mov rcx, rdi
call fcn.140021888
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], ebx
mov rax, qword [rdi]
lea r8, [rbp - 0x30]
mov r9b, 1
mov dword [rdi + 0x24b], 0x1010000
lea rdx, [rbp - 0x28]
mov rcx, rdi
mov rax, qword [rax + 0x3a8]
call qword [case.0x14001d845.0]
mov rax, qword [rbp - 0x28]
mov qword [rdi + 0x174], rax
mov dword [rdi + 0x16c], r14d
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.1401c5d98
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x3e9
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rdi + 0x258], rax
mov byte [rdi + 0x24a], 1
jmp 0x14002abee
xor edx, edx
call fcn.140024d44
mov rcx, rdi
cmp ebx, eax
jge 0x14002aa45
lea rdx, [rbp + 0x40]
call fcn.1400213e0
xor esi, esi
mov rcx, rdi
test r14b, r14b
je 0x14002a898
call fcn.14002a5dc
jmp 0x14002abd0
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x30]
call fcn.1400205d4
mov rcx, rdi
mov rax, qword [rax]
mov qword [rdi + 0x274], rax
mov rax, qword [rdi]
mov rax, qword [rax + 0x3d8]
call qword [case.0x14001d845.0]
mov r8d, dword [rdi + 0x274]
lea r9, [rbp - 0x30]
mov edx, dword [rdi + 0x278]
mov rcx, rdi
mov r14d, eax
mov qword [rbp - 0x30], rsi
mov qword [rsp + 0x20], rsi
call fcn.14001da70
mov r8d, dword [rbp - 0x2c]
mov rcx, rdi
mov edx, dword [rdi + 0x278]
call fcn.14001e330
mov dword [rdi + 0x274], eax
test r15b, r15b
jne 0x14002a912
mov rax, qword [rdi + 0x274]
mov qword [rdi + 0x174], rax
mov r8d, dword [rdi + 0x174]
lea r9, [rbp - 0x30]
mov edx, dword [rdi + 0x178]
mov rcx, rdi
mov dword [rbp - 0x1c], esi
mov dword [rbp - 0x24], esi
mov qword [rsp + 0x20], rsi
call fcn.14001da70
mov rax, qword [rdi]
mov rcx, rdi
mov edx, dword [rdi + 0x178]
mov dword [rbp - 0x20], esi
mov dword [rbp - 0x1c], edx
mov rax, qword [rax + 0x3e0]
call qword [case.0x14001d845.0]
mov ebx, dword [rbp - 0x2c]
mov rcx, rdi
mov r10, qword [rdi]
lea edx, [rax + rbx]
lea eax, [r14 - 1]
cmp edx, eax
jl 0x14002a98a
mov rax, qword [r10 + 0x370]
call qword [case.0x14001d845.0]
mov r8d, ebx
mov rcx, rdi
dec eax
mov edx, eax
mov dword [rbp - 0x24], eax
call fcn.14001e1b0
jmp 0x14002a9b3
mov rax, qword [r10 + 0x3e8]
lea r9, [rbp - 0x30]
inc edx
lea r8, [rbp - 0x18]
call qword [case.0x14001d845.0]
mov edx, dword [rbp - 0x18]
mov rcx, rdi
mov r8d, dword [rbp - 0x30]
mov dword [rbp - 0x24], edx
call fcn.14001e330
mov dword [rbp - 0x28], eax
mov rcx, rdi
mov rax, qword [rdi]
mov rdx, qword [rbp - 0x28]
mov qword [rdi + 0x274], rdx
mov rax, qword [rax + 0x570]
call qword [case.0x14001d845.0]
mov rax, qword [rdi]
lea r8, [rbp - 0x28]
mov r9b, 1
lea rdx, [rbp - 0x20]
mov rcx, rdi
mov rax, qword [rax + 0x3a8]
call qword [case.0x14001d845.0]
mov rcx, rdi
call fcn.14001d6b4
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.1401c5d98
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x3e9
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rdi + 0x258], rax
mov word [rdi + 0x24a], 1
mov word [rdi + 0x24d], si
mov byte [rdi + 0x24c], 1
jmp 0x14002abd0
lea r8, [rbp + 0x40]
lea rdx, [rbp - 0x20]
call fcn.1400205d4
mov rcx, rdi
call fcn.14001cf1c
mov rdx, qword [rbp - 0x20]
mov rcx, rdi
call fcn.14001ce78
xor esi, esi
test al, al
je 0x14002aa81
cmp byte [rdi + reloc.SHELL32.dll_CDefFolderMenu_Create2], sil
jne 0x14002aa81
mov byte [rdi + 0x248], 1
jmp 0x14002abd0
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.1400213e0
lea r8, [rbp + 0x40]
mov rcx, rdi
lea rdx, [rbp - 0x20]
call fcn.1400205d4
mov rdx, qword [rax]
mov qword [rdi + 0x274], rdx
test r15b, r15b
jne 0x14002aab3
mov qword [rdi + 0x174], rdx
mov qword [rbp - 0x28], rsi
test r14b, r14b
je 0x14002ab28
mov eax, dword [rdi + 0x278]
cmp eax, dword [rdi + 0x178]
jl 0x14002aaf6
jne 0x14002aada
mov eax, dword [rdi + 0x174]
cmp dword [rdi + 0x274], eax
jl 0x14002aaf6
mov r8, qword [rdi + 0x174]
lea rdx, [rbp - 0x20]
mov rcx, rdi
call fcn.14002a4fc
mov r8, qword [rdi + 0x274]
jmp 0x14002ab0c
mov r8, rdx
mov rcx, rdi
lea rdx, [rbp - 0x20]
call fcn.14002a4fc
mov r8, qword [rdi + 0x174]
mov rcx, qword [rax]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x30], rcx
mov rcx, rdi
call fcn.14002a454
mov rdx, qword [rax]
mov rax, qword [rbp - 0x30]
jmp 0x14002ab33
mov rax, qword [rdi + 0x174]
mov qword [rbp - 0x30], rax
mov qword [rdi + 0x174], rax
mov rcx, rdi
mov rax, qword [rdi]
mov qword [rbp - 0x28], rdx
mov qword [rdi + 0x274], rdx
mov rax, qword [rax + 0x570]
call qword [case.0x14001d845.0]
mov rax, qword [rdi]
lea r8, [rbp - 0x28]
mov r9b, 1
lea rdx, [rbp - 0x30]
mov rcx, rdi
mov rax, qword [rax + 0x3a8]
call qword [case.0x14001d845.0]
mov rcx, rdi
call fcn.14001d6b4
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.1401c5d98
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x3e9
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rdi + 0x258], rax
mov byte [rdi + 0x24a], 1
mov byte [rdi + 0x24e], sil
mov byte [rdi + 0x24d], r12b
mov byte [rdi + 0x24b], r14b
mov byte [rdi + 0x24c], sil
mov r8d, dword [rdi + 0x274]
xor r9d, r9d
mov edx, dword [rdi + 0x278]
mov rcx, rdi
call fcn.140021494
mov dword [rdi + 0x16c], eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402194b0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret