Function at 0x140015f70
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push r14
push r15
sub rsp, 0x38
lea r14, [rcx + 0x244]
mov ebp, edx
mov rdx, r14
mov r15d, r9d
mov rdi, rcx
call fcn.140014a80
test eax, eax
jne 0x140015fa8
mov rcx, rdi
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rbp
jmp sub.mfc140.dll_Ordinal_3705
mov qword [rsp + 0x68], rbx
mov ecx, sendto
mov rbx, qword [r14]
mov qword [rsp + 0x70], rsi
mov rsi, rbx
shr rsi, 0x20
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x60], rbx
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1400160be
lea eax, [rbp - 0x23]
cmp eax, 5
ja case.default.0x140015ff9
lea rdx, [0x140000000]
mov eax, dword [rdx + rax*4 + 0x164b4]
add rax, rdx
jmp rax
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x115
lea r8d, [r9 + 6]
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [rdi + 0x134]
mov dword [rsp + 0x60], eax
jmp case.default.0x140015ff9
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
lea r8d, [r9 + 7]
jmp 0x1400163e8
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x115
lea r8d, [r9 + 6]
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [rdi + 0x134]
mov dword [rsp + 0x60], eax
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
lea r8d, [r9 + 6]
mov edx, 0x114
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [rdi + reloc.mfc140.dll_Ordinal_316]
mov dword [rsp + 0x64], eax
jmp case.default.0x140015ff9
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x115
lea r8d, [r9 + 7]
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [rdi + 0x130]
dec eax
mov dword [rsp + 0x60], eax
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
lea r8d, [r9 + 7]
mov edx, 0x114
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [rdi + 0x138]
dec eax
mov dword [rsp + 0x64], eax
jmp case.default.0x140015ff9
add ebp, 0xfffffff7
cmp ebp, 0x25
ja case.0x1400160e3.10
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbp + 0x164fc]
mov ecx, dword [rdx + rax*4 + 0x164cc]
add rcx, rdx
jmp rcx
mov r8d, dword [rdi + 0x248]
mov rcx, rdi
mov edx, dword [r14]
call fcn.140013770
test al, 8
jne case.default.0x140015ff9
mov r8d, dword [rdi + 0x248]
lea r9, [0x140084486]
mov edx, dword [r14]
mov rcx, rdi
call fcn.14001ae10
mov r8d, dword [r14 + 4]
xor r9d, r9d
mov edx, dword [r14]
mov rcx, rdi
call fcn.1400190c0
mov r8d, dword [rdi + 0x248]
mov r9d, 0xffffff96
mov edx, dword [r14]
mov rcx, rdi
mov dword [rdi + 0x11c], 1
call fcn.140019d10
jmp case.default.0x140015ff9
cmp dword [rdi + 0x384], 0
mov ecx, reloc.WSOCK32.dll_recv
je 0x1400161f6
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1400161b2
mov eax, dword [rdi + reloc.mfc140.dll_Ordinal_316]
cmp esi, eax
jle 0x140016183
dec dword [rsp + 0x64]
jmp case.default.0x140015ff9
cmp dword [rsp + 0x64], eax
jne case.0x1400160e3.10
mov ebx, dword [rsp + 0x60]
cmp ebx, dword [rdi + 0x134]
jle case.0x1400160e3.10
dec dword [rsp + 0x60]
mov eax, dword [rdi + 0x138]
dec eax
mov dword [rsp + 0x64], eax
jmp case.default.0x140015ff9
mov eax, dword [rdi + 0x138]
dec eax
cmp esi, eax
jge 0x1400161c7
inc dword [rsp + 0x64]
jmp case.default.0x140015ff9
cmp dword [rsp + 0x64], eax
jne case.0x1400160e3.10
mov eax, dword [rdi + 0x130]
dec eax
cmp dword [rsp + 0x60], eax
jge case.0x1400160e3.10
mov eax, dword [rdi + reloc.mfc140.dll_Ordinal_316]
inc dword [rsp + 0x60]
mov dword [rsp + 0x64], eax
jmp case.default.0x140015ff9
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x140016245
mov eax, dword [rdi + 0x134]
cmp ebx, eax
jle 0x140016216
dec dword [rsp + 0x60]
jmp case.default.0x140015ff9
cmp dword [rsp + 0x60], eax
jne case.0x1400160e3.10
mov ecx, dword [rsp + 0x64]
cmp ecx, dword [rdi + reloc.mfc140.dll_Ordinal_316]
jle case.0x1400160e3.10
dec dword [rsp + 0x64]
mov eax, dword [rdi + 0x130]
dec eax
mov dword [rsp + 0x60], eax
jmp case.default.0x140015ff9
mov eax, dword [rdi + 0x130]
dec eax
cmp ebx, eax
jge 0x14001625a
inc dword [rsp + 0x60]
jmp case.default.0x140015ff9
cmp dword [rsp + 0x60], eax
jne case.0x1400160e3.10
mov eax, dword [rdi + 0x138]
dec eax
cmp dword [rsp + 0x64], eax
jge case.0x1400160e3.10
mov eax, dword [rdi + 0x134]
inc dword [rsp + 0x64]
mov dword [rsp + 0x60], eax
jmp case.default.0x140015ff9
mov eax, dword [rdi + 0x130]
dec eax
cmp ebx, eax
jge case.default.0x140015ff9
lea eax, [rbx + 1]
mov dword [rsp + 0x60], eax
jmp case.default.0x140015ff9
cmp ebx, dword [rdi + 0x134]
jle case.default.0x140015ff9
lea eax, [rbx - 1]
mov dword [rsp + 0x60], eax
jmp case.default.0x140015ff9
mov eax, dword [rdi + 0x138]
dec eax
cmp esi, eax
jge case.default.0x140015ff9
lea eax, [rsi + 1]
mov dword [rsp + 0x64], eax
jmp case.default.0x140015ff9
cmp esi, dword [rdi + reloc.mfc140.dll_Ordinal_316]
jle case.default.0x140015ff9
lea eax, [rsi - 1]
mov dword [rsp + 0x64], eax
jmp case.default.0x140015ff9
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140013e00
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x115
lea r8d, [r9 + 3]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140013e00
mov ecx, dword [rdi + 0x130]
mov eax, dword [rsp + 0x20]
dec ecx
sub eax, dword [rsp + 0x28]
je 0x140016341
add eax, ebx
mov dword [rsp + 0x60], eax
cmp eax, ecx
jle case.default.0x140015ff9
mov dword [rsp + 0x60], ecx
jmp case.default.0x140015ff9
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140013e00
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
mov edx, 0x115
lea r8d, [r9 + 2]
call qword [sym.imp.USER32.dll_SendMessageA]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140013e00
mov eax, dword [rsp + 0x28]
mov ecx, dword [rdi + 0x134]
sub eax, dword [rsp + 0x20]
je 0x140016341
add eax, ebx
mov dword [rsp + 0x60], eax
cmp eax, ecx
jge case.default.0x140015ff9
mov dword [rsp + 0x60], ecx
jmp case.default.0x140015ff9
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
lea r8d, [r9 + 6]
cmp dword [rdi + 0x384], r9d
jne 0x14001605b
mov edx, 0x115
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [rdi + 0x134]
mov dword [rsp + 0x60], eax
jmp case.default.0x140015ff9
mov rcx, qword [rdi + 0x40]
xor r9d, r9d
lea r8d, [r9 + 7]
cmp dword [rdi + 0x384], r9d
jne 0x1400160a2
mov edx, 0x115
call qword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [rdi + 0x130]
dec eax
mov dword [rsp + 0x60], eax
jmp case.default.0x140015ff9
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call sub.mfc140.dll_Ordinal_4715
xor r9d, r9d
mov edx, 0x100
mov rcx, qword [rax + 0x40]
lea r8d, [r9 + 0x1b]
call qword [sym.imp.USER32.dll_PostMessageA]
jmp case.default.0x140015ff9
mov rcx, rdi
call sub.mfc140.dll_Ordinal_3705
mov eax, dword [r14]
mov r12, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x70]
cmp dword [rsp + 0x60], eax
jne 0x140016450
mov eax, dword [r14 + 4]
cmp dword [rsp + 0x64], eax
je 0x1400164a4
mov rbx, qword [rsp + 0x60]
lea rdx, [rsp + 0x28]
mov r8, rbx
mov rcx, rdi
call fcn.14001a380
shr rbx, 0x20
mov rcx, rdi
mov r8d, ebx
mov ebx, dword [rsp + 0x60]
mov edx, ebx
call fcn.1400148c0
test eax, eax
jne 0x14001648d
mov r8d, dword [rsp + 0x64]
mov edx, ebx
mov rcx, rdi
call fcn.1400123c0
bt r15d, 0xe
jb 0x1400164a4
mov rcx, qword [rdi + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rbx, qword [rsp + 0x68]
add rsp, 0x38
pop r15
pop r14
pop rdi
pop rbp
ret