Function at 0x140149dc0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x258
movabs rax, 0x60a273c8043a79c5
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0x30], 0x29
mov eax, 0x5b1
mov word [rsp + 0x34], ax
movsx eax, byte [rsp + 0x30]
add eax, 6
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 0x23
je 0x140149eb7
cmp byte [rsp + 0x68], 0x66
je 0x140149e14
jmp 0x140149eda
call fcn.14014a530
movzx eax, word [rsp + 0x34]
sub eax, 0x9d3
mov word [rsp + 0x34], ax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0xa0], al
cmp byte [rsp + 0xa0], 0xc
je 0x140149e40
jmp 0x140149ea1
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0xe3
mov r9d, 0xe5
mov r8d, 0xcf
mov edx, 0x79
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.USER32.dll_MoveWindow]
mov dword [rsp + 0x7c], eax
movzx eax, word [rsp + 0x34]
and eax, 0x75e
mov word [rsp + 0x34], ax
mov r8d, 0xc6
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.USER32.dll_InternalGetWindowText]
mov dword [rsp + 0x58], eax
jmp 0x140149eb5
movsx eax, byte [rsp + 0x30]
xor eax, 0x52
mov byte [rsp + 0x30], al
mov dword [rsp + 0x58], 0x1fe67e13
jmp 0x140149eda
mov word [rsp + 0x20], 8
mov r9d, 0x5b
movzx r8d, word [rsp + 0x34]
movzx edx, word [rsp + 0x34]
mov ecx, ILFree
call fcn.14014af40
nop
movabs rax, 0x52ecf40ffc2afeb3
mov qword [rsp + 0x80], rax
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0x6c], eax
cmp dword [rsp + 0x6c], 0x4c1
je 0x140149f46
cmp dword [rsp + 0x6c], 0x5b1
je 0x140149f0e
jmp 0x140149ffd
lea rax, [rsp + 0x34]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x5c], eax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xa8], rax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x3d], al
mov dword [rsp + 0x40], 0x23dfd8e8
jmp 0x140149ffd
mov ecx, 0xa8
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x50], ax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0x121e1263
je 0x140149f77
cmp dword [rsp + 0x70], 0x99f3ba57
je 0x140149fd5
jmp 0x140149ffd
mov eax, dword [rsp + 0x40]
or eax, 0x54cd4f87
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
shl eax, cl
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
sar eax, 0xa
mov word [rsp + 0x34], ax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectory]
mov dword [rsp + 0x64], eax
jmp 0x140149ffd
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x20], ax
mov r9d, dword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
movzx r8d, word [rax]
movzx edx, word [rsp + 0x34]
mov ecx, 0xb1
call fcn.14014af40
nop
cmp dword [rsp + 0x40], 0xd4022887
jne 0x14014a0a1
movabs rax, 0x47c84da4075dbfae
mov rcx, qword [rsp + 0x80]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0xa8], rax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x74], al
cmp byte [rsp + 0x74], 0x32
je 0x14014a08c
cmp byte [rsp + 0x74], 0x4b
je 0x14014a044
jmp 0x14014a0a1
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_MenuItemFromPoint]
mov dword [rsp + 0x60], eax
movzx eax, word [rsp + 0x34]
and eax, 0x58a
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
add eax, 0x2dd
mov word [rsp + 0x34], ax
jmp 0x14014a0a1
lea rcx, [rsp + 0xb8]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x58], eax
movzx eax, word [rsp + 0x34]
mov dword [rsp + 0xa4], eax
cmp dword [rsp + 0xa4], 0x5b1
je 0x14014a0c4
jmp 0x14014a0e3
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x54], ax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x3c], al
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x38], ax
jmp 0x14014a155
call fcn.14014a530
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
sub eax, ecx
mov word [rsp + 0x38], ax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xf8]
mov r8d, 5
mov edx, 0x82
mov rcx, qword [rsp + 0x100]
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov dword [rsp + 0x9c], eax
mov eax, dword [rsp + 0x40]
add eax, 0x459daa5b
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xa8]
movzx ecx, al
mov rax, qword [rsp + 0x80]
shl rax, cl
mov qword [rsp + 0xd0], rax
movzx eax, word [rsp + 0x38]
mov dword [rsp + 0x78], eax
cmp dword [rsp + 0x78], 0x5b1
je 0x14014a199
cmp dword [rsp + 0x78], 0xbfa
je 0x14014a414
jmp 0x14014a496
movsx eax, word [rsp + 0x54]
mov dword [rsp + 0x88], eax
cmp dword [rsp + 0x88], 0x1f09
je 0x14014a1b7
jmp 0x14014a260
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x64]
or ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x60]
mov edx, dword [rsp + 0x5c]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jge 0x14014a1f9
mov r9d, 0xcc
mov r8d, 0xf7
mov rdx, qword [rsp + 0x108]
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.USER32.dll_CreateCaret]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x38]
shl eax, cl
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
movsx eax, byte [rsp + 0x3d]
movsx ecx, byte [rsp + 0x30]
xor eax, ecx
mov byte [rsp + 0x3c], al
mov dword [rsp + 0x20], SHDoDragDrop
mov r9d, 0xd6
mov r8d, 0x8a
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x110]
call qword [sym.imp.USER32.dll_DlgDirListW]
mov dword [rsp + 0x5c], eax
mov eax, dword [rsp + 0x40]
and eax, 0x6c461838
mov dword [rsp + 0x40], eax
jmp 0x14014a3b4
lea rax, [rsp + 0x50]
mov qword [rsp + 0xb0], rax
movsx eax, byte [rsp + 0x3c]
movsx ecx, byte [rsp + 0x3d]
imul eax, ecx
movsx ecx, byte [rsp + 0x30]
cmp eax, ecx
je 0x14014a3a0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x8c], eax
cmp dword [rsp + 0x8c], 0x23dfd8e8
je 0x14014a2a4
jmp 0x14014a38a
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0x58c
je 0x14014a2c5
jmp 0x14014a388
mov rax, qword [rsp + 0xb0]
movsx eax, word [rax]
movsx ecx, word [rsp + 0x54]
add eax, ecx
mov rcx, qword [rsp + 0xb0]
mov word [rcx], ax
mov r9d, 0x4e
mov r8d, 0xe8
mov edx, 0x3d
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov qword [rsp + 0x118], rax
movzx eax, word [rsp + 0x38]
movzx ecx, word [rsp + 0x34]
add eax, ecx
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx]
cmp eax, ecx
je 0x14014a380
mov eax, dword [rsp + 0x40]
add eax, 0xda5b6b2e
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
and eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xa7
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0xc0]
mov edx, 0xc9
mov ecx, 0x8c
call qword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [rsp + 0x64], eax
jmp 0x14014a388
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x60], eax
jmp 0x14014a39e
movzx eax, word [rsp + 0x34]
movzx ecx, word [rsp + 0x38]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
jmp 0x14014a3b4
movzx eax, word [rsp + 0x34]
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx]
add eax, ecx
mov word [rsp + 0x38], ax
call fcn.140149dc0
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
sub eax, ecx
mov word [rsp + 0x38], ax
movzx eax, word [rsp + 0x34]
movzx ecx, word [rsp + 0x38]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.USER32.dll_IsChild]
mov dword [rsp + 0x7c], eax
call fcn.14014a530
movsx eax, word [rsp + 0x50]
add eax, 0x493f
mov word [rsp + 0x54], ax
jmp 0x14014a496
mov eax, dword [rsp + 0x5c]
mov ecx, dword [rsp + 0x64]
sub ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x60]
mov edx, dword [rsp + 0x58]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jne 0x14014a432
jmp 0x14014a47f
movsx eax, byte [rsp + 0x30]
movsx ecx, byte [rsp + 0x3c]
and eax, ecx
mov byte [rsp + 0x3d], al
lea r8, [rsp + 0x170]
mov edx, 0xd1
lea rcx, str.controllers_thyroids
call qword [sym.imp.USER32.dll_EnumDisplaySettingsW]
mov dword [rsp + 0x94], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x64], eax
movzx eax, word [rsp + 0x38]
movzx ecx, word [rsp + 0x34]
add eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x48]
movzx eax, word [rax]
movzx ecx, word [rsp + 0x34]
sub eax, ecx
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
mov rax, qword [rsp + 0x80]
mov rcx, qword [rsp + 0xd0]
xor rcx, rax
mov rax, rcx
cmp rax, qword [rsp + 0xa8]
jae 0x14014a4b8
jmp 0x14014a4c7
movsx eax, word [rsp + 0x50]
and eax, 0x4e5d
mov word [rsp + 0x54], ax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x98], eax
cmp dword [rsp + 0x98], 0xa5203c51
je 0x14014a4e1
jmp 0x14014a4f7
movzx eax, word [rsp + 0x34]
movzx ecx, word [rsp + 0x38]
sar eax, cl
mov rcx, qword [rsp + 0x48]
mov word [rcx], ax
jmp 0x14014a511
call fcn.140149dc0
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.USER32.dll_IsZoomed]
mov dword [rsp + 0x9c], eax
mov eax, 0xed
add rsp, 0x258
ret