Function at 0x1400490a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx]
mov esi, edx
mov rbx, rcx
call qword [rax + 0x338]
mov rcx, rbx
mov rdi, rax
xor eax, eax
mov dword [rsp + 0x50], eax
call fcn.14000fdf4
mov ebp, 1
and eax, 0x400000
lea ecx, [rbp + 0x24]
mov dword [rsp + 0x58], eax
je 0x140049127
cmp esi, ecx
jne 0x140049121
lea esi, [rbp + 0x26]
mov eax, esi
sub eax, 0x26
je 0x140049152
sub eax, ebp
je 0x1400492bf
cmp eax, ebp
je 0x14004928b
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x7b0]
xor ecx, ecx
cmp eax, ecx
jne 0x1400494c1
mov rcx, rbx
call fcn.140019670
jmp 0x1400494c1
cmp esi, 0x27
cmove esi, ecx
cmp esi, ecx
ja 0x1400490e5
je 0x14004923b
cmp esi, 0xd
je 0x140049156
cmp esi, 0x1b
je 0x140049231
cmp esi, 0x20
jbe 0x1400490fc
cmp esi, 0x22
jbe 0x14004920d
cmp esi, 0x24
ja 0x1400490fc
mov dword [rsp + 0x50], ebp
xor r8d, r8d
cmp dword [0x140254ef8], r8d
jne 0x140049173
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x7b0]
xor r8d, r8d
cmp dword [rsp + 0x50], r8d
je 0x1400494c1
cmp dword [rbx + 0x1554], r8d
je 0x1400494a6
mov edx, dword [rdi + 0x1038]
cmp edx, r8d
jl 0x1400494a6
mov rcx, rdi
call fcn.14002b280
mov rsi, rax
xor eax, eax
cmp rsi, rax
jne 0x1400491c4
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x660]
xor r8d, r8d
cmp eax, r8d
je 0x1400494a6
mov rcx, qword [rdi + 0x40]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rdi + 0x125c]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x24]
cmp dword [rsi + 0x64], eax
jge 0x1400493c9
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x660]
mov r11d, eax
mov eax, dword [rsi + 0x64]
sub eax, dword [rsp + 0x24]
cdq
idiv r11d
mov esi, eax
sub esi, ebp
jmp 0x1400493f4
xor eax, eax
cmp dword [rbx + 0x1558], eax
je 0x1400490fc
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x7b0]
xor r8d, r8d
jmp 0x14004917e
mov dword [rbx + 0x17dc], ebp
mov edx, ebp
jmp 0x14004927e
mov rcx, rbx
call fcn.14004452c
xor edi, edi
cmp rax, rdi
je 0x14004925b
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x6e8]
jmp 0x1400494c1
mov rcx, qword [rbx + 0x1e0]
cmp rcx, rdi
je 0x1400494c1
mov rax, qword [rcx]
call qword [rax + 0xe0]
cmp eax, edi
je 0x1400494c1
xor edx, edx
mov rcx, rbx
call fcn.140045f88
jmp 0x1400494c1
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140049152
xor eax, eax
cmp dword [rdi + 0x1278], eax
jne 0x140049152
mov rcx, rbx
call fcn.140048f38
jmp 0x1400494c1
mov esi, dword [0x140255ec0]
xor ebp, ebp
cmp esi, 0x3e7
jne 0x1400492ea
cmp dword [0x1402567c8], ebp
je 0x1400492e8
mov eax, dword [0x1402567cc]
neg eax
sbb esi, esi
neg esi
add esi, 2
jmp 0x1400492ea
mov esi, ebp
mov rcx, rbx
mov dword [0x140255ec0], ebp
call fcn.140044558
mov rdi, rax
cmp rax, rbp
je 0x14004935f
cmp dword [rax + 0x24], 0xffffffff
je 0x14004931b
cmp dword [rax + 0x24], ebp
je 0x14004931b
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x1b8]
cmp eax, ebp
je 0x14004935f
mov rax, qword [rdi]
xor edx, edx
mov rcx, rdi
call qword [rax + 0x190]
cmp eax, ebp
je 0x14004935f
cmp qword [rdi + 0xb8], rbp
je 0x1400493be
mov rcx, rbx
call fcn.140044558
cmp rax, rdi
jne 0x1400493be
mov rcx, qword [rdi + 0xb8]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
call fcn.1400490a0
jmp 0x1400493be
mov rcx, rbx
call fcn.14004452c
mov rdi, rax
cmp rax, rbp
je 0x140049390
lea rdx, str.CMFCPopupMenuBar
mov rcx, rax
call fcn.14005807c
cmp eax, ebp
jne 0x140049390
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x6f0]
jmp 0x1400493be
mov rcx, rbx
call fcn.1400444c8
cmp rax, rbp
je 0x1400493be
neg dword [rsp + 0x58]
mov rcx, qword [rax + 0x40]
mov edx, pe_nt_image_headers64
sbb r8, r8
xor r9d, r9d
and r8, 0xfffffffffffffffe
add r8, 0x27
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [0x140255ec0], esi
jmp 0x1400494c1
mov eax, dword [rsp + 0x2c]
cmp dword [rsi + 0x6c], eax
jle 0x1400494a3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x660]
mov r11d, eax
mov eax, dword [rsi + 0x6c]
sub eax, dword [rsp + 0x2c]
cdq
idiv r11d
lea esi, [rbp + rax]
xor r8d, r8d
cmp esi, r8d
je 0x1400494a6
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x660]
mov r11d, eax
mov eax, dword [rbx + 0x1cc]
cdq
idiv r11d
mov edx, dword [rsp + 0x58]
add edx, esi
mov esi, dword [rdi + 0x1098]
sub eax, 2
sub esi, eax
xor eax, eax
dec esi
cmp edx, eax
cmovl edx, eax
cmp edx, esi
cmovl esi, edx
cmp dword [rdi + 0x125c], esi
je 0x140049452
mov rax, qword [rdi]
mov rcx, rdi
mov dword [rdi + 0x125c], esi
call qword [rax + 0x778]
xor edx, edx
mov rcx, rbx
call fcn.140047180
xor r8d, r8d
cmp dword [rbx + 0x1558], r8d
je 0x140049494
lea rcx, [rbx + 0x1590]
cmp rcx, r8
je 0x140049494
cmp qword [rcx + 0x40], r8
je 0x140049494
mov rcx, qword [rbx + 0x15d0]
mov r9d, ebp
mov r8d, esi
mov edx, 2
call qword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x1400494a3
cmp eax, r8d
je 0x1400494a6
xor edx, edx
mov rcx, rbx
call fcn.140047180
xor r8d, r8d
cmp dword [rdi + 0x1290], r8d
je 0x1400494c1
mov rax, qword [rbx]
mov edx, dword [rdi + 0x1038]
mov rcx, rbx
call qword [rax + 0x3b0]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret