Function at 0x140038b50
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x350
mov rax, qword [0x1400db800]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov eax, dword [r8 + 0x10]
mov rdi, r8
mov rbp, rcx
mov esi, 1
cmp eax, 0xffffff65
ja 0x140038ecc
je 0x140038e12
cmp eax, 0xfffffe64
ja 0x140038db8
je 0x140038e12
cmp eax, 0xfffffcc1
je 0x140038cf7
cmp eax, 0xfffffe38
je case.0x140038ef1.109
cmp eax, 0xfffffe3d
jne case.0x140038ef1.107
lea edx, [rsi - 0x16]
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r14, rax
cmp dword [rax + 0xa8], 0
jne 0x14003902c
xor ebx, ebx
mov qword [rsp + 0x388], r15
mov word [rsp + 0x40], bx
lea r10, [rsp + 0x40]
cmp dword [rax + 0x4f0], ebx
je 0x140038c94
mov rcx, qword [rdi + 0x88]
mov qword [rax + 0xc8], rcx
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x140038c1e
mov rcx, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140038c12
mov qword [r14 + 0xc0], rcx
lea rdx, [rsp + 0x40]
mov rax, qword [rdi + 0x60]
mov r8d, 0x180
mov qword [r14 + 0x4d0], rax
mov qword [r14 + 0x4f4], rsi
call fcn.14002f010
lea r9, [0x1400c94a8]
mov r10, rax
sub r9, rax
mov r8d, 4
mov rdx, rax
nop dword [rax]
lea rcx, [r8 + 0x7ffffffa]
test rcx, rcx
je 0x140038c82
movzx ecx, word [r9 + rdx]
test cx, cx
je 0x140038c82
mov word [rdx], cx
add rdx, 2
sub r8, rsi
jne 0x140038c60
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
add r10, 6
mov word [rax], bx
mov rcx, qword [0x1400e1228]
mov r9d, 0x40
mov r8, r10
lea edx, [r9 + 0x28]
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov rdx, qword [r14 + 0xc8]
mov rcx, r14
call fcn.140030a90
xor r9d, r9d
mov edx, 0x1502
mov rcx, rbp
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov r15, qword [rsp + 0x388]
mov qword [r14 + 0x88], rax
mov rax, rsi
jmp 0x1400391a2
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
test rax, rax
je 0x14003902c
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x14003902c
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rsp + 0x3c]
sub eax, dword [rsp + 0x34]
cmp eax, dword [rbx + 0xa0]
je 0x14003902c
mov edx, 0xffffffeb
mov dword [rbx + 0xa0], eax
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rdi, rax
test rax, rax
je 0x14003902c
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140038d6e
mov r8d, esi
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [rdi + 0x48]
test rcx, rcx
je 0x140038d82
mov r8d, esi
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [rdi + 0xa4]
xor ebx, ebx
mov eax, dword [rdi + 0xa0]
mov dword [0x1400e33a4], ecx
mov rcx, rdi
mov dword [0x1400e339c], eax
mov dword [0x1400e3398], ebx
mov dword [0x1400e33a0], ebx
call fcn.14002fa40
mov rax, rsi
jmp 0x1400391a2
cmp eax, 0xffffff50
je 0x140038e03
cmp eax, 0xffffff51
jne case.0x140038ef1.107
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rcx, qword [rdi + 0x40]
test rcx, rcx
je 0x140038de5
cmp qword [rcx + 0x18], 0
jne 0x140038dfb
mov rax, qword [rax + 0xc0]
test rax, rax
je 0x140038dfb
test byte [rax + 0x44], 0x44
jne 0x140038dfb
xor ebx, ebx
mov esi, ebx
mov rax, rsi
jmp 0x1400391a2
mov rdx, rdi
call fcn.140037f90
cdqe
jmp 0x1400391a2
movzx eax, word [r8 + 0x18]
cmp ax, 8
je 0x140038e70
cmp ax, 0xd
je 0x140038e51
cmp ax, 0x2e
je 0x140038e32
xor ebx, ebx
mov eax, ebx
jmp 0x1400391a2
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9c51
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rsi
mov rax, rbx
jmp 0x1400391a2
xor r9d, r9d
mov edx, 0x111
mov r8d, 0x9c49
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rsi
mov rax, rbx
jmp 0x1400391a2
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov rbx, rax
mov rcx, qword [rax + 0x48]
cmp qword [rax + 0x58], rcx
jne 0x140038ec1
mov r9, qword [rax + 0x4d0]
mov edx, 0x110a
mov rcx, qword [rax + 0x40]
mov r8d, 3
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
je 0x140038ec1
mov rcx, qword [rbx + 0x40]
mov r9, rax
mov edx, 0x110b
mov r8d, 9
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rsi
mov rax, rbx
jmp 0x1400391a2
add eax, 0x6d
cmp eax, 0x6a
ja case.0x140038ef1.107
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x391dc]
mov ecx, dword [rdx + rax*4 + 0x391c0]
add rcx, rdx
jmp rcx
mov edx, 0xffffffeb
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov edx, 0x9c4e
lea rcx, [0x1400e2fd8]
mov rbp, rax
call fcn.140027210
test rax, rax
je 0x140038f40
mov r9, qword [rax]
test r9, r9
je 0x140038f40
mov edx, dword [rax + 0x30]
movzx r8d, sil
mov rcx, qword [0x1400e2fc0]
call r9
cmp eax, esi
jne 0x140038f40
xor ebx, ebx
mov eax, ebx
jmp 0x1400391a2
mov rax, qword [rdi]
cmp rax, qword [rbp + 0x40]
je 0x140038f4f
cmp rax, qword [rbp + 0x48]
jne 0x140038f37
xor ebx, ebx
cmp dword [rdi + 0x10], 0xfffffe38
jne 0x140038f60
mov rax, qword [rdi + 0x60]
jmp 0x140038f63
mov rax, rbx
mov qword [rbp + 0x4d8], rax
lea rcx, [0x1400309d0]
mov r8, qword [rdi]
xor r9d, r9d
mov rdx, rbp
mov qword [rsp + 0x20], rbx
call fcn.140022c50
mov qword [rbp + 0x4d8], rbx
mov rbx, rsi
mov rax, rbx
jmp 0x1400391a2
mov edx, 0xffffffeb
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov ecx, dword [rdi + 0x1c]
cmp ecx, dword [rax + 0xac]
je 0x140038fbb
mov dword [rax + 0xac], ecx
movzx ecx, sil
jmp 0x140038fc5
cmp byte [rax + 0xb0], 0
sete cl
mov byte [rax + 0xb0], cl
lea r9, [0x14002eaf0]
mov rcx, qword [rax + 0x48]
mov r8, rax
mov edx, 0x1030
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, rsi
jmp 0x1400391a2
mov edx, 0xffffffeb
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov ecx, dword [rdi + 0x24]
mov rbx, rax
cmp dword [rdi + 0x20], ecx
je 0x14003902c
xor r9d, r9d
mov qword [rax + 0x4f4], 0xffffffffffffffff
mov edx, 0x1502
mov rcx, rbp
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [rbx + 0x88], rax
mov rax, rsi
jmp 0x1400391a2
mov edx, 0xffffffeb
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
mov r14, rax
mov rcx, qword [rax + 0x58]
cmp qword [rdi], rcx
je 0x140038dfb
mov ecx, dword [rax + 0x4ec]
btr ecx, 0x18
mov dword [rax + 0x4ec], ecx
mov rax, qword [rdi]
cmp rax, qword [r14 + 0x40]
jne 0x14003909d
mov qword [r14 + 0x4f4], rsi
mov rax, qword [rdi]
xor r9d, r9d
mov qword [r14 + 0x58], rax
mov edx, 0x1502
mov rcx, rbp
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov qword [r14 + 0x88], rax
mov rax, rsi
jmp 0x1400391a2
cmp rax, qword [r14 + 0x48]
jne 0x140038df7
mov qword [r14 + 0x4f4], 0xffffffffffffffff
bts ecx, 0x18
mov rax, qword [rdi]
mov dword [r14 + 0x4ec], ecx
jmp 0x140039075
cmp qword [r8 + 8], 0x2716
jne case.0x140038ef1.107
mov eax, dword [r8 + 0x18]
mov rbx, qword [r8]
cmp eax, esi
jne 0x1400390e7
mov ebx, 0x20
mov eax, ebx
jmp 0x1400391a2
cmp eax, 0x10001
jne 0x14003916d
mov rax, qword [r8 + 0x48]
test rax, rax
je 0x14003916d
mov ecx, dword [rax + 0x44]
test cl, 3
je 0x14003916d
test cl, 2
je 0x14003910c
mov dword [r8 + 0x50], 0x8080
test byte [rax + 0x44], sil
je 0x14003911a
mov dword [r8 + 0x50], 0xff
mov r8, qword [r8 + 0x38]
mov r9d, 2
mov edx, 0x102c
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
test al, 2
je 0x14003915f
call qword [sym.imp.USER32.dll_GetFocus]
mov ecx, SafeArrayGetDim
mov edx, SafeArrayGetDim
cmp rax, rbx
cmove ecx, edx
call qword [sym.imp.USER32.dll_GetSysColor]
and dword [rdi + 0x40], 0xfffffffe
xor ebx, ebx
mov dword [rdi + 0x54], eax
mov eax, ebx
jmp 0x1400391a2
mov ecx, 5
call qword [sym.imp.USER32.dll_GetSysColor]
mov dword [rdi + 0x54], eax
xor ebx, ebx
mov eax, ebx
jmp 0x1400391a2
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
xor r9d, r9d
and eax, esi
mov edx, 0x111
mov rcx, rbp
lea r8d, [rax + 0x9c49]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, rsi
jmp 0x1400391a2
xor eax, eax
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140094850
add rsp, 0x350
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret