Function at 0x1400b08dc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r12, r8
mov rsi, rdx
xor edi, edi
test rdx, rdx
jne 0x1400b0904
mov qword [rsp + 0x38], rdi
jmp 0x1400b090d
mov rax, qword [rdx + 0x40]
mov qword [rsp + 0x38], rax
mov r14d, dword [r8 + 8]
mov dword [rsp + 0xb0], r14d
call qword [sym.imp.USER32.dll_GetFocus]
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.140064e04
mov r15, rax
mov qword [rsp + 0x40], rax
lea ecx, [r14 - 0x100]
mov eax, 9
cmp ecx, eax
jbe 0x1400b0953
lea ecx, [r14 - 0x200]
cmp ecx, eax
ja 0x1400b0a2b
test r15, r15
je 0x1400b0a2b
mov rbx, r15
cmp qword [rbx + 0xd0], rdi
jne 0x1400b099e
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140064e04
cmp rax, rsi
je 0x1400b0999
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140064e04
mov rbx, rax
test rax, rax
jne 0x1400b095f
test rbx, rbx
je 0x1400b09d4
mov rax, qword [rbx + 0xd0]
test rax, rax
je 0x1400b09d4
mov rcx, qword [rax + 0x90]
test rcx, rcx
je 0x1400b09d4
mov rax, qword [rcx]
mov rdx, r12
mov rax, qword [rax + 0x28]
call qword [case.0x14013d21d.0]
test eax, eax
jne 0x1400b09d4
mov eax, 1
jmp 0x1400b0e86
lea eax, [r14 - 0x100]
mov r13d, 2
cmp eax, r13d
ja 0x1400b0a31
test rbx, rbx
je 0x1400b0a31
mov rax, qword [rbx + 0xd0]
test rax, rax
je 0x1400b0a31
cmp word [r12 + 0x10], 0xd
jne 0x1400b0a13
lea r14d, [r13 - 1]
test byte [rax + 0xcc], r14b
jne 0x1400b0add
jmp 0x1400b0a37
cmp word [r12 + 0x10], 0x1b
jne 0x1400b0a31
test byte [rax + 0xcc], r13b
jne 0x1400b0add
jmp 0x1400b0a31
mov r13d, 2
mov r14d, 1
mov rcx, qword [r12]
call fcn.140064e04
mov rbx, rax
mov ecx, dword [rsp + 0xb0]
sub ecx, 0x100
je 0x1400b0b0d
sub ecx, r13d
je 0x1400b0a89
cmp ecx, 4
jne 0x1400b0b74
test r15, r15
jne 0x1400b0a7c
lea ecx, [r15 + 0x12]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1400b0b74
cmp word [r12 + 0x10], 0x20
je 0x1400b0b74
test rbx, rbx
jne 0x1400b0a92
mov eax, edi
jmp 0x1400b0aa9
mov r9, r12
mov r8, qword [r12 + 0x10]
mov edx, 0x87
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsp + 0xb0], 0x102
jne 0x1400b0abe
test al, 0x84
jne 0x1400b0b74
mov ecx, 9
cmp word [r12 + 0x10], cx
jne 0x1400b0ad4
test r13b, al
jne 0x1400b0b74
cmp word [r12 + 0x10], 0x20
jne 0x1400b0ae4
xor eax, eax
jmp 0x1400b0e86
mov r8, r12
mov rdx, rbx
mov rcx, rsi
call fcn.1400b158c
test rax, rax
je 0x1400b0b74
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400b0b74
mov rdx, r12
call fcn.1400ae75c
jmp 0x1400b0e2a
test rbx, rbx
jne 0x1400b0b16
mov eax, edi
jmp 0x1400b0b2d
mov r9, r12
mov r8, qword [r12 + 0x10]
mov edx, 0x87
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx edx, word [r12 + 0x10]
sub edx, 3
je 0x1400b0d12
sub edx, 6
je 0x1400b0d53
sub edx, 4
je 0x1400b0ceb
sub edx, 0xe
je 0x1400b0d12
sub edx, 0xa
je 0x1400b0bcd
sub edx, 1
je 0x1400b0bcd
sub edx, 1
je 0x1400b0bd2
sub edx, 1
je 0x1400b0bd2
cmp edx, 3
je 0x1400b0ceb
test dword [rsi + 0xa8], 0x1000
jne 0x1400b0e2f
mov rdx, r12
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
mov ebx, eax
test eax, eax
je 0x1400b0e31
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140064e04
cmp rax, r15
je 0x1400b0e31
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140064e04
mov rcx, rax
call fcn.1400b0f90
jmp 0x1400b0e31
mov r13d, r14d
jmp 0x1400b0bd5
mov r13d, edi
test r15, r15
je 0x1400b0bfa
mov r9, r12
mov r8, qword [r12 + 0x10]
mov edx, 0x87
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test r14b, al
jne 0x1400b0b74
xor edx, edx
mov rcx, rsi
test r13d, r13d
je 0x1400b0c0b
call fcn.1400a5c58
jmp 0x1400b0c10
call fcn.1400a59e0
mov rbx, rax
test rax, rax
je 0x1400b0b74
cmp dword [rax + 0x10], edi
je 0x1400b0c2c
mov rdx, rax
mov rcx, rsi
call fcn.1400a6220
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400b0c4d
mov rax, qword [rcx]
mov rdx, r12
mov rax, qword [rax + 0x158]
call qword [case.0x14013d21d.0]
jmp 0x1400b0e2a
mov rax, qword [rbx]
test rax, rax
jne 0x1400b0c6e
test r15, r15
mov rdx, rdi
je 0x1400b0c61
mov rdx, qword [r15 + 0x40]
mov r8d, r13d
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetNextDlgGroupItem]
mov rcx, rax
call fcn.140064e04
mov r13, rax
test rax, rax
je 0x1400b0b74
mov rcx, qword [rsi + 0xc8]
mov qword [rcx + 0xd8], rdi
mov rcx, rax
call fcn.1400b122c
cmp dword [rbx + 0x10], edi
je 0x1400b0e2a
mov edx, 0xfffffff4
mov rcx, qword [r13 + 0x40]
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, eax
xor r9d, r9d
mov r8, r14
mov edx, 0xf1
mov rcx, qword [r13 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
movzx r8d, bx
mov r9, qword [r13 + 0x40]
mov edx, 0x111
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r13
call fcn.1400b122c
jmp 0x1400b0e2a
test al, 4
jne 0x1400b0b74
mov rcx, r15
call fcn.1400b0898
test al, 0x10
je 0x1400b0d46
mov rbx, r15
mov rcx, r15
call fcn.1400a5900
mov r13d, eax
test r15, r15
jne 0x1400b0d29
mov edx, r13d
mov rcx, rsi
call fcn.1400b1278
mov rbx, rax
test rax, rax
je 0x1400b0b74
mov rcx, rbx
call fcn.1400a5f10
test eax, eax
jne 0x1400b0de8
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1400b0b74
mov rcx, rsi
call fcn.1400b17f8
mov r13d, eax
jmp 0x1400b0d12
test r13b, al
jne 0x1400b0b74
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetKeyState]
mov r13d, edi
test ax, ax
sets r13b
mov r8d, r13d
xor edx, edx
mov rcx, rsi
call fcn.1400a5a54
test rax, rax
je 0x1400b0b74
mov rcx, qword [rax + 8]
test rcx, rcx
jne 0x1400b0c35
mov rax, qword [rax]
test rax, rax
jne 0x1400b0db5
test rbx, rbx
mov rdx, rdi
je 0x1400b0da8
mov rdx, qword [rbx + 0x40]
mov r8d, r13d
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
mov rcx, rax
call fcn.140064e04
mov rbx, rax
test rax, rax
je 0x1400b0e2a
mov rcx, qword [rsi + 0xc8]
mov qword [rcx + 0xd8], rdi
mov rcx, rax
call fcn.1400b122c
mov rdx, rbx
mov rcx, r15
call fcn.1400b1038
jmp 0x1400b0e2a
cmp qword [rbx + 0xd0], rdi
je 0x1400b0b74
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
movzx r9d, di
movzx r8d, r14w
mov edx, 0xfffffdd9
mov rcx, rbx
call fcn.1400a5e6c
nop
jmp 0x1400b0e2a
mov ebx, r14d
jmp 0x1400b0e31
mov ebx, edi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b0e84
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140064e04
mov rdx, rax
mov rcx, r15
call fcn.1400b1038
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1400b0e84
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140064e04
mov r8, rax
mov rdx, r15
mov rcx, rsi
call fcn.1400b1104
mov eax, ebx
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret