Function at 0x14004bc64
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbp, r8
movsxd r15, edx
lea r14d, [rdi + 1]
mov r13, rcx
cmp r8, rdi
je 0x14004bc97
mov dword [r8], r14d
mov rcx, qword [0x140255ec8]
cmp rcx, rdi
je 0x14004bde5
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, edi
je 0x14004bde5
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.140019768
mov rcx, qword [0x140255ec8]
mov rdx, qword [rcx]
mov rbx, rax
call qword [rdx + 0x3b8]
cmp eax, edi
je 0x14004bd40
cmp rbx, rdi
je 0x14004bd20
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004bd20
mov rcx, qword [0x140255ec8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004bf86
mov rcx, qword [0x140255ec8]
cmp rcx, rdi
je 0x14004bd15
mov rdi, qword [rcx + 0x40]
cmp qword [rbx + 0x40], rdi
jne 0x14004bd27
jmp 0x14004bf86
mov rcx, qword [0x140255ec8]
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14004bf86
cmp rbx, rdi
je 0x14004bd67
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004bd67
mov rcx, qword [0x140255ec8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004bf86
mov rcx, qword [0x140255ec8]
mov rdx, qword [rcx]
call qword [rdx + 0x338]
mov rcx, qword [0x140255ec8]
mov r8, r15
mov rcx, qword [rcx + 0x40]
mov ebx, dword [rax + 0x1290]
xor r9d, r9d
mov edx, pe_nt_image_headers64
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, edi
jne 0x14004bda5
mov eax, r14d
jmp 0x14004bf88
mov rdx, qword [0x140255ec8]
lea rcx, str.CMFCDropDownListBox
call fcn.1400580b0
cmp rax, rdi
je 0x14004bddb
mov rax, qword [rax + 0x1810]
mov rbx, rdi
cmp rax, rdi
je 0x14004bdd0
mov rbx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rbx, rax
je 0x14004bdde
mov edi, r14d
mov eax, edi
jmp 0x14004bf88
mov rcx, qword [r13 + 0x118]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, edi
jne 0x14004bd9d
cmp dword [0x140254ef8], edi
jne 0x14004bf86
mov rsi, qword [0x140254f80]
mov r12d, edi
cmp rsi, rdi
je 0x14004be7c
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
cmp rbx, rdi
je 0x14004bf5b
mov rcx, qword [rbx + 0x40]
call fcn.1400197ac
cmp rax, rdi
je 0x14004be77
mov rcx, rbx
mov r14d, edi
call fcn.14002bad4
cmp eax, edi
jle 0x14004be71
mov edx, r14d
mov rcx, rbx
call fcn.14002b280
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x148]
cmp eax, edi
jne 0x14004bf4d
mov rcx, rbx
inc r14d
call fcn.14002bad4
cmp r14d, eax
jl 0x14004be42
mov r14d, 1
cmp r12d, edi
je 0x14004be10
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
movzx ebx, dil
test si, ax
mov eax, 8
lea ecx, [rax + 0xa]
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004beac
or bl, 0x10
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004bebf
or bl, 4
cmp r12d, edi
jne 0x14004bf0e
mov r8, qword [r13 + 0x118]
mov sil, bl
mov r9d, r14d
or sil, r14b
movzx ecx, r15w
mov dl, sil
call fcn.140097e84
cmp eax, edi
jne 0x14004bf86
mov rcx, qword [r13 + 0x118]
mov rax, qword [rcx]
call qword [rax + 0x290]
xor r9d, r9d
mov dl, sil
mov r8, rax
movzx ecx, r15w
call fcn.140097e84
cmp eax, edi
jne 0x14004bf86
mov rcx, qword [r13 + 0x180]
cmp rcx, rdi
je 0x14004bf61
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, edi
je 0x14004bf61
cmp bl, 8
jne 0x14004bf61
cmp r15d, 0x70
jne 0x14004bf79
mov rcx, qword [r13 + 0x180]
cmp qword [rcx + 0x9d8], rdi
je 0x14004bf79
call fcn.1400d2238
jmp 0x14004bd9d
mov r14d, 1
mov r12d, r14d
jmp 0x14004be77
call fcn.1400129dc
int3
cmp bl, 0x10
jne 0x14004bf79
mov edx, r15d
mov rcx, r13
call fcn.14004b130
cmp eax, edi
jne 0x14004bd9d
cmp r12d, edi
je 0x14004bf86
cmp rbp, rdi
je 0x14004bf86
mov dword [rbp], edi
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret