Function at 0x14005c160
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402a6808]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov r15, r8
mov rsi, rcx
mov eax, edx
sub eax, 0x14
je 0x14005c840
sub eax, 0xfd
je 0x14005c218
cmp eax, 0x22
je 0x14005c1bc
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x14005c8b5
mov ecx, dword [0x1402be238]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1402bbc00], eax
jg 0x14005c8db
cmp dword [rsi + 0x40], 1
je 0x14005c1f0
xor eax, eax
jmp 0x14005c8b5
mov edx, 0xffffff
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetTextColor]
mov edx, 0x6666ff
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetBkColor]
mov rax, qword [0x1402bbbf8]
jmp 0x14005c8b5
xor bl, bl
mov r12b, 1
xor r13b, r13b
movzx edi, r15w
cmp edi, 0x695
ja 0x14005c379
je 0x14005c36a
cmp edi, 1
je 0x14005c25b
cmp edi, 2
je 0x14005c325
cmp edi, 0x692
je 0x14005c2b3
lea eax, [rdi - 0x693]
cmp eax, 1
ja 0x14005c3a1
mov bl, 1
mov eax, 0x694
cmp di, ax
je 0x14005c406
mov eax, 0xa7fa
cmp di, ax
je 0x14005c406
mov eax, 0xa803
cmp di, ax
je 0x14005c406
cmp edi, 1
jne 0x14005c2a3
lea ecx, [rdi + 0xf]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14005c406
xor r12b, r12b
mov eax, 2
xor r15b, r15b
jmp 0x14005c41e
mov rax, r15
shr rax, 0x10
mov ecx, 0x300
cmp ax, cx
jne 0x14005c3a1
mov bl, 1
mov edx, 0x69a
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 1
sete r13b
mov edx, 0x695
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 1
sete r15b
jmp 0x14005c419
mov rax, qword [rcx + 0x38]
mov rcx, qword [rax + 0xd0]
mov edx, 0x1c
mov rcx, qword [rcx]
call fcn.140050c00
mov rax, qword [rsi + 0x38]
mov rdx, qword [rax + 0xd0]
mov rcx, qword [rdx]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + 0x18]
mov eax, 1
jmp 0x14005c8b5
mov bl, 1
movzx r15d, bl
movzx r13d, bl
jmp 0x14005c419
mov ecx, edi
sub ecx, 0x69a
je 0x14005c413
sub ecx, 0xa160
je 0x14005c25b
sub ecx, 8
je 0x14005c25b
cmp ecx, 1
je 0x14005c3b5
mov edx, 0x111
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x14005c8b5
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rbx
je 0x14005c25b
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x27]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
jmp 0x14005c8b5
mov r12b, 1
mov eax, 2
xor r15b, r15b
jmp 0x14005c41e
mov r13b, 1
xor r15b, r15b
mov eax, 1
mov dword [rbp - 0x50], 0x1010101
xor r14d, r14d
mov qword [rbp - 0x4c], r14
mov word [rbp - 0x44], r14w
mov byte [rbp - 0x42], r14b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmm1, xmmword [0x1401e3030]
movdqa xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x40], r14w
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r14w
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x10], xmm1
mov word [rbp], r14w
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmmword [rbp + 0x30], xmm1
mov word [rbp + 0x20], r14w
mov dword [rbp + 0x40], 0x1000001
mov byte [rbp - 0x50], r14b
mov dword [rbp - 0x4c], eax
mov byte [rbp - 0x4d], r12b
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 0x695
mov r8d, 0xf0
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 1
sete byte [rbp - 0x4f]
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140057810
nop
test bl, bl
je 0x14005c77a
mov dword [rsp + 0x48], r14d
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x50]
mov rcx, qword [rsi + 0x38]
call fcn.140058ec0
mov byte [rsp + 0x40], al
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
lea rcx, [rbp - 0x40]
call fcn.140006d60
mov r12, qword [rsi + 0x38]
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [r12 + 0xd0]
mov rbx, qword [rax]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x85f
mov rcx, rbx
call fcn.14000fa00
mov rdi, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x861
mov rcx, rbx
call fcn.14000fa00
mov rbx, rax
mov rcx, qword [r12 + 0xd0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7d6
mov rcx, qword [rcx]
call fcn.14000fa00
mov edx, ebx
movzx ecx, byte [rbp - 0x4d]
test cl, cl
cmovne edx, eax
mov r8d, r14d
cmovne r8d, edi
cmp byte [rbp - 0x42], r14b
jne 0x14005c5cc
cmp byte [rbp - 0x4e], r14b
jne 0x14005c5c7
mov edi, r8d
mov ebx, edx
jmp 0x14005c5cc
mov edi, r14d
mov ebx, eax
mov rax, qword [rsp + 0x50]
mov qword [rbp - 0x78], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x70], rax
mov dword [rbp - 0x68], edi
mov dword [rbp - 0x64], ebx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xffffffff
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x78]
lea edx, [r9 + 2]
mov rcx, r12
call fcn.140059a70
test eax, eax
jg 0x14005c61e
mov word [0x1402bbc10], r14w
jmp 0x14005c6c0
cmp eax, 1
jne 0x14005c63f
mov r8d, eax
lea rdx, str._d_match.
lea rcx, [0x1402bbc10]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14005c6c0
movsxd rdx, eax
lea rcx, [rbp - 0x78]
call fcn.1400283f0
nop
cmp qword [rax + 0x18], 8
jb 0x14005c656
mov rax, qword [rax]
mov r8, rax
lea rdx, str._s_matches.
lea rcx, [0x1402bbc10]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x14005c6ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c6a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c917
call fcn.14017f5e4
movdqa xmm0, xmmword [0x1401e3030]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r14w
movsxd rbx, dword [rsp + 0x48]
test ebx, ebx
js 0x14005c715
cmp ebx, 4
jae 0x14005c715
mov dword [rsi + 0x40], ebx
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.USER32.dll_InvalidateRect]
lea rcx, [0x1401f75a0]
mov rax, qword [rcx + rbx*8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov edx, 0x699
lea r8d, [r9 + 0xc]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
test r15b, r15b
je 0x14005c77a
cmp byte [rsp + 0x40], 0
jne 0x14005c77a
mov rax, qword [rsi + 0x38]
mov rcx, qword [rax + 0xd0]
mov rdi, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x85f
mov rcx, rdi
call fcn.14000fa00
mov rbx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x861
mov rcx, rdi
call fcn.14000fa00
movsxd r9, ebx
mov rax, qword [rsi + 0x38]
mov rcx, qword [rax + 0xd0]
mov edx, 0x870
mov r8, 0xffffffffffffffff
mov rcx, qword [rcx]
call fcn.14000fa00
test r13b, r13b
je 0x14005c7be
cmp qword [rsp + 0x78], 0
je 0x14005c7af
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 0x69a
mov r8d, 0xf0
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 1
jne 0x14005c7af
movzx edx, al
jmp 0x14005c7b1
xor dl, dl
lea r8, [rbp - 0x50]
mov rcx, rsi
call fcn.140058220
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14005c7ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c7fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c8d5
call fcn.14017f5e4
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
lea rcx, [rbp + 0x20]
call fcn.1400068c0
nop
lea rcx, [rbp]
call fcn.1400068c0
nop
lea rcx, [rbp - 0x20]
call fcn.1400068c0
nop
lea rcx, [rbp - 0x40]
call fcn.1400068c0
mov eax, 1
jmp 0x14005c8b5
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
lea r9d, [r14 + 1]
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
xor r9d, r9d
mov r8, r15
lea edx, [r14 + 0x14]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
xor r9d, r9d
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetWindowOrgEx]
movsxd rax, ebx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.14017f700
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401a10ac
nop
lea rcx, [0x1402bbc00]
call fcn.14017fc1c
cmp dword [0x1402bbc00], 0xffffffff
jne 0x14005c1e3
mov ecx, 0x6666ff
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [0x1402bbbf8], rax
lea rcx, [0x1402bbc00]
call fcn.14017fbbc
jmp 0x14005c1e3
call fcn.1401a10ac
int3