Function at 0x140194d40
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rbp, r9
mov r13, r8
mov ebx, edx
mov rsi, rcx
cmp edx, 0x200
ja 0x140194f6a
cmp edx, 0x200
je 0x140194ec5
mov eax, edx
sub eax, 1
je 0x140194e9a
sub eax, 9
je 0x140194e24
cmp eax, 0x44
jne 0x140194f7c
lea rax, [rcx + 0x3e8]
test rax, rax
je 0x140194f7c
cmp qword [rax + 0x40], 0
je 0x140194f7c
test r9, r9
je 0x140194f7c
xor edi, edi
test rax, rax
jne 0x140194dd8
mov rcx, rdi
jmp 0x140194ddc
mov rcx, qword [rax + 0x40]
cmp qword [r9], rcx
jne 0x140194f7c
cmp dword [r9 + 0x10], 0xfffffdf7
jne 0x140194f7c
test rax, rax
jne 0x140194dfd
mov rcx, rdi
jmp 0x140194e01
mov rcx, qword [rax + 0x40]
mov dword [rsp + 0x30], 0x13
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x140194f7c
xor edi, edi
test rcx, rcx
jne 0x140194e30
mov rcx, rdi
jmp 0x140194e34
mov rcx, qword [rcx + 0x40]
mov edx, 5
call qword [sym.imp.USER32.dll_GetWindow]
mov r12, rax
test rax, rax
je 0x140194f7c
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x140194f7c
mov edx, 1
mov rcx, r12
call qword [sym.imp.USER32.dll_EnableWindow]
test r13, r13
sete dil
xor r9d, r9d
mov r8, rdi
mov edx, 0xcf
mov rcx, r12
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140194f7c
mov edx, 1
call fcn.14000f868
mov rbx, rax
mov rdx, qword [rsi]
mov rcx, rsi
call qword [rdx + 0x2b8]
test al, al
jne 0x140194ebd
call fcn.14000939c
int3
mov rax, rbx
jmp 0x140195497
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0x8000
test di, ax
jne 0x140194f7c
mov ecx, 2
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x140194f7c
mov ecx, 4
call qword [sym.imp.USER32.dll_GetKeyState]
test di, ax
jne 0x140194f7c
cmp dword [rsi + 0x528], 0
je 0x140194f7c
test byte [rsi + 0x538], 1
je 0x140194f7c
mov rax, qword [rsi + 0x530]
cmp dword [rax - 0x10], 0
je 0x140194f7c
call fcn.1400794f0
test eax, eax
jne 0x140194f7c
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x2c0]
mov rdi, rax
test rax, rax
je 0x140194f7c
lea rdx, [rsp + 0x80]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r11, qword [rsi]
lea r8, [rsp + 0x80]
mov rdx, rdi
mov rcx, rsi
call qword [r11 + 0x2c8]
jmp 0x140194f7c
mov eax, edx
sub eax, 0x47b
je 0x1401953c1
cmp eax, 1
je 0x140194f91
mov r9, rbp
mov r8, r13
mov edx, ebx
mov rcx, rsi
call fcn.14000f868
jmp 0x140195497
test r8, r8
setne byte [rsp + 0xc8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x140
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15, rax
mov qword [rsp + 0x68], rax
shr eax, 0x10
mov dword [rsp + 0x40], eax
call fcn.140008c24
mov r11, rax
xor edi, edi
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x140194fe1
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140014290
mov r9, qword [rsp + 0x50]
mov r14d, dword [r9 - 0x10]
or r12, 0xffffffffffffffff
mov r8, r12
mov edx, 0x14c
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbp, rax
test byte [rsi + 0x1d8], 2
je 0x1401951e1
test eax, eax
js 0x1401951e1
call fcn.140008c24
mov r11, rax
mov ecx, edi
test rax, rax
setne cl
test ecx, ecx
jne 0x140195056
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x146
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r15, rax
test ebp, ebp
js 0x1401951b2
nop dword [rax + rax]
cmp ebp, r15d
jge 0x1401951a9
lea r8, [rsp + 0x48]
mov edx, ebp
mov rcx, rsi
call fcn.140024a70
mov r11, qword [rsp + 0x48]
mov eax, dword [r11 - 0x10]
cmp eax, r14d
jl 0x140195194
cmp eax, r14d
jle 0x140195156
mov r8d, r14d
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140001620
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x48]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x140195136
cmp dword [rbx + 0x10], 0
jl 0x140195127
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x140195127
call fcn.1400049b0
mov r13, rax
mov ecx, r12d
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14019511c
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r13 + 0x18]
mov qword [rsp + 0x48], rax
jmp 0x140195136
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.140005080
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140195156
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov ecx, edi
mov rax, qword [rsp + 0x48]
test rax, rax
setne cl
test ecx, ecx
je 0x14019519e
mov rcx, qword [rsp + 0x50]
sub rax, rcx
nop
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x140195186
add rcx, 2
test dx, dx
jne 0x140195170
mov eax, edi
jmp 0x14019518b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
jne 0x1401951a9
add ebp, 1
js 0x1401951b2
jmp 0x140195090
mov ecx, 0x80004005
call fcn.1400052e0
int3
test ebp, ebp
js 0x1401951b2
cmp ebp, r15d
jl 0x1401951b5
mov ebp, r12d
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401951dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x68]
jmp 0x1401951e1
mov r15, qword [rsp + 0x68]
mov rcx, rsi
call fcn.14011e270
mov rbx, rax
test rax, rax
je 0x140195205
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0xb]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r8, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [r8 + 0x2b0]
mov r13, rax
test rax, rax
je 0x14019524b
movsxd r8, ebp
xor r9d, r9d
mov edx, 0x186
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x14019524b
xor r9d, r9d
xor r8d, r8d
mov edx, 0x197
mov rcx, qword [r13 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.140008c24
mov rcx, rax
test rax, rax
setne dil
test edi, edi
jne 0x140195269
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
test ebp, ebp
js 0x1401952bb
lea r8, [rsp + 0x60]
mov edx, ebp
mov rcx, rsi
call fcn.140024a70
cmp byte [rsp + 0xc8], 0
jne 0x1401952a8
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call fcn.14000a68c
mov edi, dword [rsp + 0x40]
jmp 0x1401952f9
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.14000a68c
mov edi, dword [rsp + 0x40]
jmp 0x1401952f9
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call fcn.14000a68c
cmp r15d, 0xffffffff
je 0x1401952f5
mov edi, dword [rsp + 0x40]
movzx ecx, di
shl ecx, 0x10
movzx eax, r15w
or ecx, eax
movsxd r9, ecx
xor r8d, r8d
mov edx, 0x142
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1401952f9
mov edi, dword [rsp + 0x40]
movzx ecx, di
cmp ecx, r14d
jge 0x140195327
cmp r15d, 0xffffffff
je 0x140195327
shl ecx, 0x10
movzx eax, r15w
or ecx, eax
movsxd r9, ecx
xor r8d, r8d
mov edx, 0x142
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140195344
movzx r9d, r14w
or r9, 0xffffffffffff0000
xor r8d, r8d
mov edx, 0x142
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test rbx, rbx
je 0x140195379
xor r9d, r9d
lea edx, [r9 + 0xb]
lea r8d, [r9 + 1]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14019539a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x1401953ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140195497
call fcn.140008c24
mov rcx, rax
xor edi, edi
test rax, rax
setne dil
test edi, edi
jne 0x1401953e1
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.140014290
mov r9, qword [rsp + 0x58]
or r12, 0xffffffffffffffff
mov r8, r12
mov edx, 0x158
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x140195475
mov edx, eax
mov rcx, rsi
call fcn.14018da00
test al, al
jne 0x140195475
mov rdx, qword [rsi + 0x3c0]
mov rcx, rsi
call fcn.14000a68c
mov rdi, qword [rsi + 0x40]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001256c
mov rbx, rax
mov rcx, rsi
call fcn.14000a6fc
movzx r8d, ax
bts r8, 0x10
mov r9, rdi
mov edx, 0x111
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x140195495
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret