Function at 0x140151b28
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov edi, edx
mov rbx, rcx
xor r15d, r15d
cmp qword [rcx + 0x500], r15
jne 0x140151b5f
xor eax, eax
jmp 0x140152433
mov rcx, qword [rcx + 0x2a8]
cmp rcx, r15
je 0x140151b83
mov rax, qword [rcx]
call qword [rax + 0x320]
cmp eax, r15d
je 0x140151b83
mov eax, 1
jmp 0x140152433
cmp edi, 9
jne 0x140151b9d
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 0x80
neg al
sbb edi, edi
and edi, 0xfffffffe
add edi, 0x28
mov rbp, r15
mov ecx, dword [rbx + 0x20]
mov esi, 1
cmp ecx, r15d
jne 0x140151bbe
cmp dword [rbx + 0x30], r15d
je 0x140151bb9
cmp dword [rbx + 0x34], r15d
jne 0x140151bbe
mov eax, r15d
jmp 0x140151bc0
mov eax, esi
mov r13d, r15d
mov dword [rsp + 0xa0], r15d
movsxd r9, eax
mov qword [rsp + 0x40], r9
mov eax, edi
sub eax, 0xd
je 0x1401521ee
sub eax, 0x13
je 0x1401521ee
mov r9d, 5
sub eax, r9d
je 0x140151fc2
sub eax, esi
je 0x140151e1b
sub eax, esi
je 0x140151dc2
cmp eax, esi
je 0x140151e1b
cmp ecx, r15d
je 0x140152217
mov ecx, edi
call fcn.140099eac
cmp eax, r15d
je 0x140151c2c
mov ecx, edi
call fcn.140099f68
mov edi, eax
mov r14d, r15d
cmp qword [rbx + 0x500], r15
jle 0x140152214
cmp r13, r15
jl 0x140151dbc
cmp r13, qword [rbx + 0x500]
jge 0x140151dbc
mov rax, qword [rbx + 0x4f8]
mov r12, qword [rax + r13*8]
mov rax, qword [r12]
mov edx, edi
mov rcx, r12
call qword [rax + 0x278]
cmp eax, r15d
jne 0x140151db5
mov rdx, qword [r12 + 8]
lea rcx, [rsp + 0xb8]
call fcn.140008700
nop
mov rax, qword [rsp + 0xb8]
cmp dword [rax - 0x10], r15d
jle 0x140151d1e
mov edx, 0x26
mov rcx, rax
call fcn.140185d6c
mov r11, rax
cmp rax, r15
je 0x140151d16
mov rax, qword [rsp + 0xb8]
sub r11, rax
sar r11, 1
cmp r11d, r15d
jl 0x140151d1e
mov ecx, dword [rax - 0x10]
dec ecx
cmp r11d, ecx
jge 0x140151d1e
lea ecx, [r11 + 1]
cmp ecx, r15d
jl 0x140151d9d
cmp ecx, dword [rax - 0x10]
jg 0x140151d9d
movsxd rcx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + 0xb0], dx
mov word [rsp + 0xb2], r15w
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx r11d, word [rsp + 0xb0]
cmp r11d, edi
je 0x140151d51
mov rax, qword [rsp + 0xb8]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x140151d3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r14d, esi
add r13, rsi
movsxd rax, r14d
cmp rax, qword [rbx + 0x500]
jge 0x140151da8
jmp 0x140151c3c
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x70]
cmp eax, r15d
jne 0x140151d68
mov rbp, r12
mov r13d, esi
jmp 0x140151d70
mov r13d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x140152217
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140152217
mov ecx, 0x80070057
call fcn.140001f40
nop
mov r13d, dword [rsp + 0xa0]
jmp 0x140152217
mov eax, esi
jmp 0x140152433
call fcn.14001501c
int3
cmp ecx, r15d
je 0x140151fc2
mov rcx, qword [rbx + 0x2a8]
cmp rcx, r15
je 0x140151fc2
mov rax, qword [rcx]
call qword [rax + 0x130]
cmp eax, r15d
je 0x140151fc2
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, r15d
jne 0x140151fc2
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x138]
jmp 0x140152217
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x140151f9d
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x28
jne 0x140151e63
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x38]
shr r12, 0x20
add r12d, esi
jmp 0x140151e79
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x30]
shr r12, 0x20
sub r12d, esi
mov ecx, 0xfffffffb
cmp edi, 0x28
cmove ecx, r9d
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xb8], r15d
cmp rbp, r15
jne 0x140152205
mov r15d, eax
mov r14d, eax
mov esi, dword [rsp + 0xb0]
mov r13d, r12d
cmp r14d, dword [rbx + 0x70]
jge 0x140151ebd
cmp r15d, dword [rbx + 0x78]
jg 0x140151f4d
test rbp, rbp
jne 0x140151f3e
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x2c], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x140151f08
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x140151f1d
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r13d, esi
cmp edi, 0x28
jne 0x140151f2d
cmp r13d, dword [rbx + 0x7c]
jg 0x140151f38
jmp 0x140151f33
cmp r13d, dword [rbx + 0x74]
jl 0x140151f38
test rbp, rbp
je 0x140151ec7
mov r9d, 5
sub r14d, r9d
add r15d, r9d
test rbp, rbp
je 0x140151eaa
mov eax, dword [rsp + 0xb8]
xor r15d, r15d
cmp eax, r15d
lea esi, [r15 + 1]
jne 0x140151f7f
cmp rbp, r15
jne 0x140151f7f
cmp qword [rsp + 0x40], r15
je 0x14015220f
cmp edi, 0x28
jne 0x140151f7b
mov r12d, dword [rbx + 0x74]
jmp 0x140151f7f
mov r12d, dword [rbx + 0x7c]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x140151e94
mov r13d, r15d
jmp 0x140152217
cmp edi, 0x28
jne 0x140151fb2
mov rcx, rbx
call fcn.14014d578
mov rbp, rax
jmp 0x140152217
mov rcx, rbx
call fcn.14014d5fc
mov rbp, rax
jmp 0x140152217
cmp dword [rbx + 0x20], r15d
je 0x140152047
cmp edi, 0x25
jne 0x140152047
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x140152047
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf8
mov rdx, rax
lea rcx, str.CMFCPopupMenu
call fcn.14005a468
mov r12, rax
mov rcx, rax
call fcn.140046648
cmp rax, r15
je 0x140152047
mov rcx, qword [rbx + 0xc0]
call fcn.1401405e0
cmp rax, r15
je 0x140152036
cmp qword [rax + 0xae0], rbx
jne 0x140152036
mov r8d, esi
mov rdx, qword [rax + 0xad8]
mov rcx, rax
call fcn.1400d5694
xor edx, edx
mov rcx, r12
call fcn.1400480f8
mov eax, esi
jmp 0x140152433
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x1401521cf
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x38]
shr rax, 0x20
mov rcx, qword [rsp + 0x30]
shr rcx, 0x20
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x27
jne 0x140152095
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x38]
inc r15d
jmp 0x1401520a7
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x30]
dec r15d
mov ecx, 0xfffffffb
cmp edi, 0x27
lea edx, [rcx + 0xa]
cmove ecx, edx
mov dword [rsp + 0xb0], ecx
and dword [rsp + 0xb8], ebp
test rbp, rbp
jne 0x1401521f3
mov r14d, eax
mov r13d, eax
mov esi, dword [rsp + 0xb0]
lea eax, [rbp + 5]
mov r12d, r15d
cmp r13d, dword [rbx + 0x74]
jge 0x1401520ef
cmp r14d, dword [rbx + 0x7c]
jg 0x14015217e
test rbp, rbp
jne 0x14015216f
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r12d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x14015213a
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x2c], r14d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x14015214f
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r12d, esi
cmp edi, 0x27
jne 0x14015215f
cmp r12d, dword [rbx + 0x78]
jg 0x14015216a
jmp 0x140152165
cmp r12d, dword [rbx + 0x70]
jl 0x14015216a
test rbp, rbp
je 0x1401520f9
mov eax, 5
sub r13d, eax
add r14d, eax
test rbp, rbp
je 0x1401520dc
mov eax, dword [rsp + 0xb8]
test eax, eax
mov esi, 1
jne 0x1401521ac
test rbp, rbp
jne 0x1401521ac
xor r15d, r15d
cmp qword [rsp + 0x40], r15
je 0x140152200
cmp edi, 0x27
jne 0x1401521a8
mov r15d, dword [rbx + 0x70]
jmp 0x1401521ac
mov r15d, dword [rbx + 0x78]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x1401520c3
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x140152217
cmp edi, 0x27
jne 0x1401521e1
mov rcx, rbx
call fcn.14014d578
mov rbp, rax
jmp 0x140152217
mov rcx, rbx
call fcn.14014d5fc
mov rbp, rax
jmp 0x140152217
mov r13d, esi
jmp 0x140152217
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x140152217
mov r13d, r15d
jmp 0x140152217
mov r13d, dword [rsp + 0xa0]
jmp 0x140152217
mov r13d, r15d
jmp 0x140152217
mov r13d, ebp
mov r12d, r15d
cmp rbp, r15
je 0x14015238e
mov rax, qword [rbx + 0x2a8]
cmp rax, rbp
je 0x14015238b
cmp rax, r15
je 0x140152276
mov dword [rax + 0xa4], r15d
mov rax, qword [rbx + 0x2a8]
mov dword [rax + 0xa8], r15d
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov qword [rbx + 0x2a8], r15
cmp dword [0x14025a894], r15d
je 0x1401522f5
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x1401522f5
cmp dword [rbx + 0x20], r15d
je 0x1401522f5
movdqu xmm0, xmmword [rbp + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], eax
shr rax, 0x20
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_ClientToScreen]
movzx ecx, word [rsp + 0x24]
shl ecx, 0x10
movzx eax, word [rsp + 0x20]
or rcx, rax
mov rdx, qword [rbx + 0xc0]
cmp rdx, r15
jne 0x1401522dd
mov rdx, r15
jmp 0x1401522e1
mov rdx, qword [rdx + 0x40]
mov r9d, ecx
mov ecx, 0x8005
mov r8d, 0xfffffffc
call qword [sym.imp.USER32.dll_NotifyWinEvent]
mov qword [rbx + 0x2a8], rbp
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2d8]
mov dword [rbp + 0xa4], esi
mov dword [rbp + 0xa8], esi
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x14015238b
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf8
mov rdx, rax
lea rcx, str.CMFCRibbonPanelMenu
call fcn.14005a468
cmp rax, r15
je 0x14015238b
mov rcx, qword [rax + 0x17e8]
cmp rcx, r15
je 0x14015238b
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2a8]
mov rdx, qword [rbx + 0xc0]
call qword [rax + 0x2a0]
mov r12d, esi
cmp r13d, r15d
je 0x140152430
mov rdx, qword [rbx + 0x2a8]
cmp rdx, r15
je 0x140152430
lea rcx, str.CMFCRibbonButton
call fcn.14005a468
mov rdi, rax
cmp rax, r15
je 0x140152430
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x130]
cmp eax, r15d
je 0x1401523da
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x138]
jmp 0x14015242d
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x70]
cmp eax, r15d
jne 0x14015242d
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x140152411
call fcn.1401405e0
cmp rax, r15
je 0x140152411
cmp qword [rax + 0xae0], rbx
jne 0x140152411
mov edx, esi
mov rcx, rax
call fcn.1400d5374
movdqu xmm0, xmmword [rdi + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x358]
mov r12d, esi
mov eax, r12d
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret