Function at 0x14012dd80
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov word [rsp + 8], cx
sub rsp, 0x2e8
mov byte [rsp + 0x44], 0x65
mov byte [rsp + 0x30], 0x27
mov dword [rsp + 0x3c], 0xa5e980d7
movsx eax, byte [rsp + 0x2f8]
sub eax, 0x3a
mov byte [rsp + 0x30], al
cmp dword [rsp + 0x300], 0x51b054c8
jge 0x14012e316
movzx eax, byte [section..data]
cmp eax, 0x35
jne 0x14012de33
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_GetComboBoxInfo]
mov dword [rsp + 0xc0], eax
mov eax, dword [rsp + 0x40]
add eax, 0x32db2bb2
mov dword [rsp + 0x3c], eax
mov r9d, 0x18
mov r8d, 0xe7
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_HiliteMenuItem]
mov dword [rsp + 0x70], eax
mov edx, 4
mov ecx, 0x43
call fcn.14012d3c0
nop
cmp dword [rsp + 0x300], 0x7cfbf08f
jne 0x14012de9d
mov eax, dword [rsp + 0x40]
and eax, 0xc7baad51
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x20], 0x5f
mov r9d, 0x2d
mov r8d, 0xa8
lea rdx, [rsp + 0x148]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.USER32.dll_DlgDirListComboBoxW]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x300]
mov dword [rsp + 0x48], eax
call qword [sym.imp.USER32.dll_GetKBCodePage]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x300]
mov dword [rsp + 0x48], eax
jmp 0x14012dee9
movsx eax, byte [rsp + 0x30]
sub eax, 0x43
movsx ecx, byte [rsp + 0x2f8]
cmp eax, ecx
je 0x14012dee9
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x54], eax
movzx eax, word [rsp + 0x2f0]
mov word [rsp + 0x34], ax
movabs rax, 0xbe463a67b911f4d1
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x50], eax
movzx eax, byte [rsp + 0x2f8]
mov byte [rsp + 0x32], al
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0xa0], eax
cmp dword [rsp + 0xa0], 0x2c959892
je 0x14012df03
jmp 0x14012df68
mov ecx, 0x6e
call qword [sym.imp.USER32.dll_GetKeyState]
mov word [rsp + 0x38], ax
movabs rax, 0x6224e21c46b753d9
mov rcx, qword [rsp + 0x58]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x300], eax
mov dword [rsp + 0x20], 0x78
mov r9d, 0xb2
mov r8d, 0x2f
mov edx, 0x19
lea rcx, [rsp + 0x148]
call qword [sym.imp.USER32.dll_SetRect]
mov dword [rsp + 0x98], eax
jmp 0x14012dfb0
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x14012df83
cmp dword [rsp + 0x60], 0x2d9d6725
je 0x14012dfa8
jmp 0x14012dfb0
movzx eax, byte [section..data]
mov byte [rsp + 0x31], al
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x88], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
jmp 0x14012dfb0
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xb0], rax
movabs rax, 0x33e99122878a2ace
cmp qword [rsp + 0xb0], rax
je 0x14012e0c6
movabs rax, 0xbe463a67b911f4d1
cmp qword [rsp + 0xb0], rax
je 0x14012dfee
jmp 0x14012e0d1
movsx eax, word [rsp + 0x34]
movsx ecx, word [rsp + 0x2f0]
sub eax, ecx
movsx ecx, word [rsp + 0x38]
cmp eax, ecx
je 0x14012e0c4
movsx eax, word [rsp + 0x34]
movsx ecx, word [rsp + 0x2f0]
add eax, ecx
movsx ecx, word [rsp + 0x38]
cmp eax, ecx
jne 0x14012e0a6
mov r8d, dword [rsp + 0x300]
movzx edx, byte [rsp + 0x32]
movzx ecx, word [rsp + 0x34]
call fcn.14012dd80
nop
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0xc8], rax
movabs rax, 0x77a4c4a1aaf5ffd2
cmp qword [rsp + 0xc8], rax
je 0x14012e064
jmp 0x14012e093
movsx eax, byte [rsp + 0x32]
movsx ecx, byte [rsp + 0x2f8]
xor eax, ecx
mov byte [rsp + 0x30], al
lea rdx, [rsp + 0x148]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x3c], eax
jmp 0x14012e0a4
mov rax, qword [rsp + 0x80]
shl rax, 0x1f
mov qword [rsp + 0x58], rax
jmp 0x14012e0c4
mov rdx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_ChildWindowFromPoint]
mov qword [rsp + 0xb8], rax
jmp 0x14012e0d1
mov ecx, 0xd0
call fcn.14012e8b0
nop
mov eax, dword [rsp + 0x54]
movzx ecx, al
mov eax, dword [rsp + 0x3c]
shr eax, cl
mov ecx, dword [rsp + 0x40]
mov edx, dword [rsp + 0x88]
or edx, ecx
mov ecx, edx
cmp eax, ecx
jb 0x14012e2a0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x4c], al
lea rax, [rsp + 0x31]
mov qword [rsp + 0x78], rax
movzx eax, byte [rsp + 0x31]
movzx ecx, byte [section..data]
and eax, ecx
mov rcx, qword [rsp + 0x78]
movzx ecx, byte [rcx]
cmp eax, ecx
jl 0x14012e2a0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0xa8], rax
movzx eax, byte [rsp + 0x32]
mov byte [rsp + 0x9c], al
cmp byte [rsp + 0x9c], 0
je 0x14012e15e
jmp 0x14012e282
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [rsp + 0xd8], rax
movabs rax, 0x23bdd237602fc094
cmp qword [rsp + 0xd8], rax
je 0x14012e18a
jmp 0x14012e20f
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
mov byte [rsp + 0x8c], al
cmp byte [rsp + 0x8c], 1
je 0x14012e1a5
jmp 0x14012e1c2
mov rax, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rax]
sub rax, rcx
mov qword [rsp + 0x58], rax
jmp 0x14012e20d
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
movzx ecx, byte [rsp + 0x31]
add eax, ecx
mov rcx, qword [rsp + 0x78]
mov byte [rcx], al
mov qword [rsp + 0x20], 0x40
mov r9, qword [rsp + 0x110]
mov r8, qword [rsp + 0x118]
lea rdx, str.Crackle_infinitesimally_Inconsistencies_enforceability
mov rcx, qword [rsp + 0x120]
call qword [sym.imp.USER32.dll_DialogBoxParamW]
mov dword [rsp + 0x90], eax
jmp 0x14012e280
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x90], eax
movzx eax, byte [rsp + 0x2f8]
mov byte [rsp + 0x64], al
cmp byte [rsp + 0x64], 0
je 0x14012e24d
cmp byte [rsp + 0x64], 0x58
je 0x14012e236
jmp 0x14012e280
movzx eax, byte [section..data]
mov rcx, qword [rsp + 0x78]
movzx ecx, byte [rcx]
sub eax, ecx
mov byte [rsp + 0x31], al
jmp 0x14012e280
lea rax, [rsp + 0x2f8]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x128], rax
mov rax, qword [rsp + 0xe0]
movsx eax, byte [rax]
movsx ecx, byte [rsp + 0x32]
add eax, ecx
mov byte [rsp + 0x44], al
jmp 0x14012e2a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x80]
and rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rcx], rax
movzx eax, word [rsp + 0x34]
mov word [rsp + 0x2f0], ax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x68], al
cmp byte [rsp + 0x68], 0xa
je 0x14012e2f1
cmp byte [rsp + 0x68], 0x5e
je 0x14012e2c6
jmp 0x14012e311
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_ArrangeIconicWindows]
mov dword [rsp + 0x3c], eax
movzx eax, word [rsp + 0x38]
mov word [rsp + 0x2f0], ax
mov cx, 0xfa
call fcn.14012e470
nop
jmp 0x14012e311
mov r8d, 1
mov rdx, qword [rsp + 0x130]
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.USER32.dll_UserHandleGrantAccess]
mov dword [rsp + 0x70], eax
jmp 0x14012e3c2
mov eax, dword [rsp + 0x300]
add eax, 0x27a8e307
cmp eax, 0x6b2197c6
jle 0x14012e3c2
mov dword [rsp + 0x300], 0x3eb85cce
mov eax, dword [rsp + 0x3c]
shr eax, 0xfd
cmp eax, dword [rsp + 0x40]
jb 0x14012e353
mov dx, 2
mov ecx, dword [rsp + 0x40]
call fcn.14012d9e0
nop
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x6c], al
cmp byte [rsp + 0x6c], 0x45
je 0x14012e3b6
cmp byte [rsp + 0x6c], 0x47
je 0x14012e36c
jmp 0x14012e3c2
mov r8d, dword [rsp + 0x300]
movzx edx, byte [rsp + 0x30]
movzx ecx, word [rsp + 0x2f0]
call fcn.14012dd80
mov eax, dword [rsp + 0x40]
shl eax, 3
mov dword [rsp + 0x3c], eax
lea rcx, [rsp + 0x180]
call qword [sym.imp.COMDLG32.dll_ReplaceTextW]
mov qword [rsp + 0x140], rax
mov eax, dword [rsp + 0x40]
xor eax, 0xba1498ee
mov dword [rsp + 0x3c], eax
jmp 0x14012e3c2
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x2f8], al
mov eax, dword [rsp + 0x300]
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 0x3e18de24
je 0x14012e3e1
jmp 0x14012e3f3
lea rcx, [rsp + 0x1d0]
call qword [sym.imp.COMDLG32.dll_ChooseFontW]
mov dword [rsp + 0x70], eax
movsx eax, byte [rsp + 0x2f8]
and eax, 0x51
mov byte [rsp + 0x30], al
call qword [sym.imp.COMDLG32.dll_CommDlgExtendedError]
mov dword [rsp + 0x40], eax
mov r8d, dword [rsp + 0x300]
movzx edx, byte [rsp + 0x30]
movzx ecx, word [rsp + 0x2f0]
call fcn.14012dd80
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x240]
call qword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [rsp + 0x98], eax
movsx eax, byte [rsp + 0x2f8]
or eax, 0x32
mov byte [rsp + 0x30], al
mov eax, 0x42
add rsp, 0x2e8
ret