Function at 0x14014f858
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov edi, edx
mov rbx, rcx
xor r15d, r15d
cmp qword [rcx + 0x500], r15
jne 0x14014f88f
xor eax, eax
jmp 0x140150163
mov rcx, qword [rcx + 0x2a8]
cmp rcx, r15
je 0x14014f8b3
mov rax, qword [rcx]
call qword [rax + 0x320]
cmp eax, r15d
je 0x14014f8b3
mov eax, 1
jmp 0x140150163
cmp edi, 9
jne 0x14014f8cd
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 0x80
neg al
sbb edi, edi
and edi, 0xfffffffe
add edi, 0x28
mov rbp, r15
mov ecx, dword [rbx + 0x20]
mov esi, 1
cmp ecx, r15d
jne 0x14014f8ee
cmp dword [rbx + 0x30], r15d
je 0x14014f8e9
cmp dword [rbx + 0x34], r15d
jne 0x14014f8ee
mov eax, r15d
jmp 0x14014f8f0
mov eax, esi
mov r13d, r15d
mov dword [rsp + 0xa0], r15d
movsxd r9, eax
mov qword [rsp + 0x40], r9
mov eax, edi
sub eax, 0xd
je 0x14014ff1e
sub eax, 0x13
je 0x14014ff1e
mov r9d, 5
sub eax, r9d
je 0x14014fcf2
sub eax, esi
je 0x14014fb4b
sub eax, esi
je 0x14014faf2
cmp eax, esi
je 0x14014fb4b
cmp ecx, r15d
je 0x14014ff47
mov ecx, edi
call fcn.140097c78
cmp eax, r15d
je 0x14014f95c
mov ecx, edi
call fcn.140097d34
mov edi, eax
mov r14d, r15d
cmp qword [rbx + 0x500], r15
jle 0x14014ff44
cmp r13, r15
jl 0x14014faec
cmp r13, qword [rbx + 0x500]
jge 0x14014faec
mov rax, qword [rbx + 0x4f8]
mov r12, qword [rax + r13*8]
mov rax, qword [r12]
mov edx, edi
mov rcx, r12
call qword [rax + 0x278]
cmp eax, r15d
jne 0x14014fae5
mov rdx, qword [r12 + 8]
lea rcx, [rsp + 0xb8]
call fcn.140006480
nop
mov rax, qword [rsp + 0xb8]
cmp dword [rax - 0x10], r15d
jle 0x14014fa4e
mov edx, 0x26
mov rcx, rax
call fcn.14018369c
mov r11, rax
cmp rax, r15
je 0x14014fa46
mov rax, qword [rsp + 0xb8]
sub r11, rax
sar r11, 1
cmp r11d, r15d
jl 0x14014fa4e
mov ecx, dword [rax - 0x10]
dec ecx
cmp r11d, ecx
jge 0x14014fa4e
lea ecx, [r11 + 1]
cmp ecx, r15d
jl 0x14014facd
cmp ecx, dword [rax - 0x10]
jg 0x14014facd
movsxd rcx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + 0xb0], dx
mov word [rsp + 0xb2], r15w
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx r11d, word [rsp + 0xb0]
cmp r11d, edi
je 0x14014fa81
mov rax, qword [rsp + 0xb8]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x14014fa6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r14d, esi
add r13, rsi
movsxd rax, r14d
cmp rax, qword [rbx + 0x500]
jge 0x14014fad8
jmp 0x14014f96c
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x70]
cmp eax, r15d
jne 0x14014fa98
mov rbp, r12
mov r13d, esi
jmp 0x14014faa0
mov r13d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x14014ff47
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14014ff47
mov ecx, 0x80070057
call fcn.140001f40
nop
mov r13d, dword [rsp + 0xa0]
jmp 0x14014ff47
mov eax, esi
jmp 0x140150163
call fcn.1400129dc
int3
cmp ecx, r15d
je 0x14014fcf2
mov rcx, qword [rbx + 0x2a8]
cmp rcx, r15
je 0x14014fcf2
mov rax, qword [rcx]
call qword [rax + 0x130]
cmp eax, r15d
je 0x14014fcf2
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, r15d
jne 0x14014fcf2
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x138]
jmp 0x14014ff47
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x14014fccd
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x28
jne 0x14014fb93
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x38]
shr r12, 0x20
add r12d, esi
jmp 0x14014fba9
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x30]
shr r12, 0x20
sub r12d, esi
mov ecx, 0xfffffffb
cmp edi, 0x28
cmove ecx, r9d
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xb8], r15d
cmp rbp, r15
jne 0x14014ff35
mov r15d, eax
mov r14d, eax
mov esi, dword [rsp + 0xb0]
mov r13d, r12d
cmp r14d, dword [rbx + 0x70]
jge 0x14014fbed
cmp r15d, dword [rbx + 0x78]
jg 0x14014fc7d
test rbp, rbp
jne 0x14014fc6e
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x2c], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x14014fc38
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x14014fc4d
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r13d, esi
cmp edi, 0x28
jne 0x14014fc5d
cmp r13d, dword [rbx + 0x7c]
jg 0x14014fc68
jmp 0x14014fc63
cmp r13d, dword [rbx + 0x74]
jl 0x14014fc68
test rbp, rbp
je 0x14014fbf7
mov r9d, 5
sub r14d, r9d
add r15d, r9d
test rbp, rbp
je 0x14014fbda
mov eax, dword [rsp + 0xb8]
xor r15d, r15d
cmp eax, r15d
lea esi, [r15 + 1]
jne 0x14014fcaf
cmp rbp, r15
jne 0x14014fcaf
cmp qword [rsp + 0x40], r15
je 0x14014ff3f
cmp edi, 0x28
jne 0x14014fcab
mov r12d, dword [rbx + 0x74]
jmp 0x14014fcaf
mov r12d, dword [rbx + 0x7c]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x14014fbc4
mov r13d, r15d
jmp 0x14014ff47
cmp edi, 0x28
jne 0x14014fce2
mov rcx, rbx
call fcn.14014b2a8
mov rbp, rax
jmp 0x14014ff47
mov rcx, rbx
call fcn.14014b32c
mov rbp, rax
jmp 0x14014ff47
cmp dword [rbx + 0x20], r15d
je 0x14014fd77
cmp edi, 0x25
jne 0x14014fd77
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x14014fd77
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
mov rdx, rax
lea rcx, str.CMFCPopupMenu
call fcn.1400580b0
mov r12, rax
mov rcx, rax
call fcn.1400444c8
cmp rax, r15
je 0x14014fd77
mov rcx, qword [rbx + 0xc0]
call fcn.14013e3b0
cmp rax, r15
je 0x14014fd66
cmp qword [rax + 0xae0], rbx
jne 0x14014fd66
mov r8d, esi
mov rdx, qword [rax + 0xad8]
mov rcx, rax
call fcn.1400d3408
xor edx, edx
mov rcx, r12
call fcn.140045f88
mov eax, esi
jmp 0x140150163
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x14014feff
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x38]
shr rax, 0x20
mov rcx, qword [rsp + 0x30]
shr rcx, 0x20
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x27
jne 0x14014fdc5
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x38]
inc r15d
jmp 0x14014fdd7
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x30]
dec r15d
mov ecx, 0xfffffffb
cmp edi, 0x27
lea edx, [rcx + 0xa]
cmove ecx, edx
mov dword [rsp + 0xb0], ecx
and dword [rsp + 0xb8], ebp
test rbp, rbp
jne 0x14014ff23
mov r14d, eax
mov r13d, eax
mov esi, dword [rsp + 0xb0]
lea eax, [rbp + 5]
mov r12d, r15d
cmp r13d, dword [rbx + 0x74]
jge 0x14014fe1f
cmp r14d, dword [rbx + 0x7c]
jg 0x14014feae
test rbp, rbp
jne 0x14014fe9f
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r12d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x14014fe6a
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x2c], r14d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x14014fe7f
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r12d, esi
cmp edi, 0x27
jne 0x14014fe8f
cmp r12d, dword [rbx + 0x78]
jg 0x14014fe9a
jmp 0x14014fe95
cmp r12d, dword [rbx + 0x70]
jl 0x14014fe9a
test rbp, rbp
je 0x14014fe29
mov eax, 5
sub r13d, eax
add r14d, eax
test rbp, rbp
je 0x14014fe0c
mov eax, dword [rsp + 0xb8]
test eax, eax
mov esi, 1
jne 0x14014fedc
test rbp, rbp
jne 0x14014fedc
xor r15d, r15d
cmp qword [rsp + 0x40], r15
je 0x14014ff30
cmp edi, 0x27
jne 0x14014fed8
mov r15d, dword [rbx + 0x70]
jmp 0x14014fedc
mov r15d, dword [rbx + 0x78]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x14014fdf3
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x14014ff47
cmp edi, 0x27
jne 0x14014ff11
mov rcx, rbx
call fcn.14014b2a8
mov rbp, rax
jmp 0x14014ff47
mov rcx, rbx
call fcn.14014b32c
mov rbp, rax
jmp 0x14014ff47
mov r13d, esi
jmp 0x14014ff47
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x14014ff47
mov r13d, r15d
jmp 0x14014ff47
mov r13d, dword [rsp + 0xa0]
jmp 0x14014ff47
mov r13d, r15d
jmp 0x14014ff47
mov r13d, ebp
mov r12d, r15d
cmp rbp, r15
je 0x1401500be
mov rax, qword [rbx + 0x2a8]
cmp rax, rbp
je 0x1401500bb
cmp rax, r15
je 0x14014ffa6
mov dword [rax + 0xa4], r15d
mov rax, qword [rbx + 0x2a8]
mov dword [rax + 0xa8], r15d
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov qword [rbx + 0x2a8], r15
cmp dword [0x1402567d4], r15d
je 0x140150025
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x140150025
cmp dword [rbx + 0x20], r15d
je 0x140150025
movdqu xmm0, xmmword [rbp + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], eax
shr rax, 0x20
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_ClientToScreen]
movzx ecx, word [rsp + 0x24]
shl ecx, 0x10
movzx eax, word [rsp + 0x20]
or rcx, rax
mov rdx, qword [rbx + 0xc0]
cmp rdx, r15
jne 0x14015000d
mov rdx, r15
jmp 0x140150011
mov rdx, qword [rdx + 0x40]
mov r9d, ecx
mov ecx, 0x8005
mov r8d, 0xfffffffc
call qword [sym.imp.USER32.dll_NotifyWinEvent]
mov qword [rbx + 0x2a8], rbp
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2d8]
mov dword [rbp + 0xa4], esi
mov dword [rbp + 0xa8], esi
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x1401500bb
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
mov rdx, rax
lea rcx, str.CMFCRibbonPanelMenu
call fcn.1400580b0
cmp rax, r15
je 0x1401500bb
mov rcx, qword [rax + 0x17e8]
cmp rcx, r15
je 0x1401500bb
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2a8]
mov rdx, qword [rbx + 0xc0]
call qword [rax + 0x2a0]
mov r12d, esi
cmp r13d, r15d
je 0x140150160
mov rdx, qword [rbx + 0x2a8]
cmp rdx, r15
je 0x140150160
lea rcx, str.CMFCRibbonButton
call fcn.1400580b0
mov rdi, rax
cmp rax, r15
je 0x140150160
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x130]
cmp eax, r15d
je 0x14015010a
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x138]
jmp 0x14015015d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x70]
cmp eax, r15d
jne 0x14015015d
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x140150141
call fcn.14013e3b0
cmp rax, r15
je 0x140150141
cmp qword [rax + 0xae0], rbx
jne 0x140150141
mov edx, esi
mov rcx, rax
call fcn.1400d30e8
movdqu xmm0, xmmword [rdi + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x358]
mov r12d, esi
mov eax, r12d
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret