Function at 0x140126970
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x220
mov rax, qword [rsp + 0x230]
cmp qword [rax + 0x118], 0
je 0x140126a31
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x118]
mov qword [rsp + 0x138], rax
mov rcx, qword [rsp + 0x138]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140126a31
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x118]
mov qword [rsp + 0x140], rax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x140]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsp + 0x240]
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_PtInRect]
mov dword [rsp + 0x148], eax
mov edx, dword [rsp + 0x148]
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x118]
call fcn.14029e840
cmp dword [rsp + 0x238], reloc.mfc90u.dll_COleTemplateServer::COleTemplateServer
jne 0x140126c0f
cmp dword [0x1404e6674], 0
jne 0x140126a64
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x140126c0f
lea rax, [0x1404e66f8]
mov rax, qword [rax + 8]
mov qword [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu], rax
mov rax, qword [rsp + reloc.mfc90u.dll_CChevronOwnerDrawMenu::CChevronOwnerDrawMenu]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x140126c0f
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
jne 0x140126aad
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x158]
add rax, 0x10
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0x160]
mov rax, qword [rax]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x40]
call sub.mfc90u.dll_CWnd::ExecuteDlgInit
test rax, rax
je 0x140126c0a
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0x60]
mov rax, qword [rax]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [rax + CIPAddressCtrl::CreateEx]
mov dword [rsp + 0x70], eax
cmp dword [rsp + 0x70], 0
jl 0x140126c0a
mov edx, dword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
call fcn.140110eb0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x80]
test rax, rax
je 0x140126c08
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x78]
call qword [rax + 0x80]
cmp rax, qword [rsp + 0x248]
jne 0x140126c08
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x104], rax
mov rcx, qword [rsp + 0x78]
add rcx, 0x48
mov rdx, qword [rsp + 0x104]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140126c08
movsxd rax, dword [rsp + 0x6c]
and rax, 0xffff
movzx ecx, ax
shl ecx, 0x10
movsxd rax, dword [rsp + 0x68]
and rax, 0xffff
movzx eax, ax
or eax, ecx
mov eax, eax
mov qword [rsp + 0x168], rax
mov r9, qword [rsp + 0x168]
xor r8d, r8d
mov edx, reloc.mfc90u.dll_COleTemplateServer::COleTemplateServer
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov eax, 1
jmp 0x1401275a8
jmp 0x140126c0f
jmp 0x140126a84
mov dword [rsp + 0x40], 0
cmp dword [0x1404e6674], 0
jne 0x1401271e5
cmp qword [0x1404e7670], 0
je 0x1401271e5
mov rcx, qword [0x1404e7670]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401271e5
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x10c], rax
lea rdx, [rsp + 0x10c]
mov rcx, qword [0x1404e7670]
call fcn.14013af00
mov dword [rsp + 0x80], eax
cmp dword [rsp + 0x80], 4
jne 0x140127187
call fcn.14013e320
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
je 0x140126d69
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + reloc.mfc90u.dll_CDaoQueryDef::SetParamValue]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140126d69
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + reloc.mfc90u.dll_CDaoQueryDef::SetParamValue]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsp + 0x240]
lea rcx, [rsp + 0xa8]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140126d69
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + reloc.mfc90u.dll_CDaoQueryDef::SetParamValue]
call sub.mfc90u.dll_CWnd::ExecuteDlgInit
mov rbx, rax
call fcn.1401316b0
mov rdx, rbx
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0x88]
mov qword [rax + reloc.mfc90u.dll_CDaoQueryDef::SetParamValue], 0
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rsp + 0xb8]
mov qword [0x1404e7670], rax
xor eax, eax
jmp 0x1401275a8
mov rax, qword [0x1404e7670]
mov rax, qword [rax]
lea rdx, [rsp + 0x98]
mov rcx, qword [0x1404e7670]
call qword [rax + 0x360]
mov qword [rsp + 0x90], rax
cmp qword [rsp + 0x90], 0
je 0x140127018
call fcn.1401cee10
mov rdx, qword [rsp + 0x90]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0xc8], rax
lea rdx, [rsp + 0xc8]
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x114], rax
mov rdx, qword [rsp + 0x114]
lea rcx, [rsp + 0x98]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x140126ed1
cmp qword [rsp + 0xc0], 0
je 0x140126e3c
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax + 0x860]
test eax, eax
je 0x140126e85
mov rax, qword [0x1404e7670]
mov rax, qword [rax]
mov rcx, qword [0x1404e7670]
call qword [rax + class CArchive & __stdcall operator>>]
test eax, eax
jne 0x140126e85
mov rax, qword [0x1404e7670]
mov qword [rsp + 0x170], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x170]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140126ec7
cmp dword [rsp + 0x238], 0x204
je 0x140126e9f
cmp dword [rsp + 0x238], 0x205
jne 0x140126ec7
mov rax, qword [0x1404e7670]
mov rax, qword [rax + reloc.mfc90u.dll_CStatusBar::SetPaneInfo]
mov qword [rsp + reloc.mfc90u.dll_CDialog::CDialog], rax
cmp qword [rsp + reloc.mfc90u.dll_CDialog::CDialog], 0
je 0x140126ec7
xor eax, eax
jmp 0x1401275a8
mov eax, 1
jmp 0x1401275a8
cmp qword [rsp + 0xc0], 0
je 0x140127018
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax + 0x860]
test eax, eax
jne 0x140127018
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0xc0]
call qword [rax + CWinApp::DelRegTree]
mov rcx, qword [rsp + 0xc0]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov qword [rsp + 0x180], rax
call fcn.1401316b0
mov rdx, qword [rsp + 0x180]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0xd0], 0
je 0x140127018
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x11c], rax
lea rdx, [rsp + 0x11c]
mov rcx, qword [rsp + 0xd0]
call fcn.14013af00
mov dword [rsp + 0xd8], eax
mov eax, dword [rsp + 0xd8]
mov dword [rsp + 0x1d8], eax
cmp dword [rsp + 0x1d8], 0
je 0x140126fd6
cmp dword [rsp + 0x1d8], 0
jle 0x140127018
cmp dword [rsp + 0x1d8], 2
jle 0x140126fdd
cmp dword [rsp + 0x1d8], 3
je 0x140126fd6
cmp dword [rsp + 0x1d8], 5
je 0x140126fd6
jmp 0x140127018
xor eax, eax
jmp 0x1401275a8
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0xd0]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x98]
call sub.mfc90u.dll_CDHtmlDialog::ResizeBorder
mov eax, 1
jmp 0x1401275a8
mov rax, qword [0x1404e7670]
mov rax, qword [rax]
mov rcx, qword [0x1404e7670]
call qword [rax + class CArchive & __stdcall operator>>]
test eax, eax
jne 0x140127185
mov rax, qword [0x1404e7670]
mov rax, qword [rax]
mov rcx, qword [0x1404e7670]
call qword [rax + 0x370]
test eax, eax
jne 0x14012705f
mov dword [rsp + 0x1dc], 1
jmp 0x14012706a
mov dword [rsp + 0x1dc], 0
mov eax, dword [rsp + 0x1dc]
mov dword [rsp + 0x40], eax
mov rax, qword [0x1404e7670]
mov qword [rsp + reloc.mfc90u.dll_CDynLinkLibrary::CDynLinkLibrary], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + reloc.mfc90u.dll_CDynLinkLibrary::CDynLinkLibrary]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov qword [rsp + 0xe0], rax
cmp qword [rsp + 0xe0], 0
je 0x1401270ef
call fcn.14010c100
mov rdx, rax
mov rcx, qword [rsp + 0xe0]
call sub.mfc90u.dll_CWnd::GetTopLevelFrame
test eax, eax
je 0x1401270ef
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x98]
call sub.mfc90u.dll_CDHtmlDialog::ResizeBorder
cmp dword [rsp + 0x80], 4
je 0x140127103
mov eax, 1
jmp 0x1401275a8
cmp dword [rsp + 0x40], 0
je 0x140127185
mov rcx, qword [rsp + 0x240]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov qword [rsp + 0x190], rax
call sub.mfc90u.dll_CWnd::GetScrollRange
mov rdx, qword [rsp + 0x190]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0xe8], rax
cmp qword [rsp + 0xe8], 0
jne 0x14012715e
mov qword [rsp + 0x1e0], 0
jmp 0x140127172
mov rax, qword [rsp + 0xe8]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x1e0], rax
cmp qword [rsp + 0x1e0], 0
jne 0x140127185
mov dword [rsp + 0x40], 0
jmp 0x1401271e5
cmp dword [rsp + 0x80], 1
je 0x14012719b
cmp dword [rsp + 0x80], 2
jne 0x1401271e5
mov rax, qword [0x1404e7670]
mov qword [rsp + 0x198], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x198]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x98]
call sub.mfc90u.dll_CDHtmlDialog::ResizeBorder
mov eax, 1
jmp 0x1401275a8
cmp dword [rsp + 0x238], 0xa5
jne 0x1401275a4
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x1a0], rax
cmp qword [rsp + 0x1a0], 0
jne 0x140127226
mov qword [rsp + 0x1e8], 0
jmp 0x14012723a
mov rax, qword [rsp + 0x1a0]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
cmp qword [rsp + 0x248], rax
jne 0x1401275a4
call fcn.140001270
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0x1f0]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x1f0]
call qword [rax + 0x6a8]
test eax, eax
je 0x140127298
mov rax, qword [rsp + 0x230]
cmp dword [rax + reloc.mfc90u.dll_CDynLinkLibrary::CDynLinkLibrary], 0
jne 0x140127298
mov dword [rsp + 0x1f8], 1
jmp 0x1401272a3
mov dword [rsp + 0x1f8], 0
cmp dword [rsp + 0x1f8], 0
je 0x1401275a4
lea rax, [rsp + 0x128]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x130]
mov rax, qword [rsp + 0x240]
mov qword [rcx], rax
mov rdx, qword [rsp + 0x130]
mov rdx, qword [rdx]
mov rcx, qword [rsp + 0x230]
call fcn.14012ad90
mov dword [rsp + 0xf0], eax
cmp dword [rsp + 0xf0], 2
je 0x140127329
cmp dword [rsp + 0xf0], 3
je 0x140127329
cmp dword [rsp + 0xf0], 8
je 0x140127329
cmp dword [rsp + 0xf0], 9
je 0x140127329
cmp dword [rsp + 0xf0], 0x14
jne 0x1401275a4
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x1b8], rax
xor edx, edx
mov rcx, qword [rsp + 0x1b8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov rcx, rax
call sub.mfc90u.dll_CHtmlEditView::ExecHandler
mov qword [rsp + 0xf8], rax
cmp qword [rsp + 0xf8], 0
jne 0x14012737d
mov qword [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], 0
jmp 0x140127391
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 8]
mov qword [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], rax
cmp qword [rsp + reloc.mfc90u.dll_COleStreamFile::COleStreamFile], 0
je 0x1401275a4
cmp qword [rsp + 0xf8], 0
jne 0x1401273b9
mov qword [rsp + 0x208], 0
jmp 0x1401273cd
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x208], rax
mov rcx, qword [rsp + 0x208]
call qword [sym.imp.USER32.dll_IsMenu]
test eax, eax
je 0x1401275a4
xor r8d, r8d
mov edx, 0xf030
mov rcx, qword [rsp + 0xf8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor r8d, r8d
mov edx, 0xf120
mov rcx, qword [rsp + 0xf8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rcx, qword [rsp + 0x230]
mov rcx, qword [rcx + 0x98]
call sub.mfc90u.dll_CCheckListBox::GetRuntimeClass
and eax, 0x1000000
cmp eax, 0x1000000
jne 0x140127456
mov r8d, 3
mov edx, 0xf030
mov rcx, qword [rsp + 0xf8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x1401274a0
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x1c0], rax
mov rcx, qword [rsp + 0x1c0]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x1401274a0
mov r8d, 3
mov edx, 0xf120
mov rcx, qword [rsp + 0xf8]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EnableMenuItem]
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x1c8], rax
cmp qword [rsp + 0x1c8], 0
jne 0x1401274d0
mov qword [rsp + 0x210], 0
jmp 0x1401274e4
mov rax, qword [rsp + 0x1c8]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0x210], rax
cmp qword [rsp + 0xf8], 0
jne 0x1401274fd
mov qword [rsp + 0x218], 0
jmp 0x140127511
mov rax, qword [rsp + 0xf8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x244]
mov r8d, dword [rsp + 0x240]
mov edx, HashKey<wchar_t const *>
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov dword [rsp + 0x100], eax
cmp dword [rsp + 0x100], 0
je 0x1401275a4
mov rax, qword [rsp + 0x230]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x1d0], rax
mov r8d, dword [rsp + 0x100]
xor r9d, r9d
mov edx, ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > >
mov rcx, qword [rsp + 0x1d0]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rsp + 0x40], 1
mov eax, dword [rsp + 0x40]
add rsp, 0x220
pop rbx
ret