Function at 0x1400330d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r12d, edx
mov rdi, rcx
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x6d8]
mov esi, eax
or r14d, 0xffffffff
xor r13d, r13d
mov rcx, qword [0x140257fd0]
cmp rcx, rdi
je 0x140033144
cmp dword [0x140257f98], r13d
je 0x14003314d
mov qword [0x140257fd0], rdi
cmp rcx, r13
je 0x140033144
mov edx, dword [rcx + 0x103c]
mov dword [rcx + 0x103c], r14d
call fcn.14002fde4
cmp dword [0x140257f98], r13d
jne 0x14003318d
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
mov rdx, rax
lea rcx, str.CPane
call fcn.14005a7e4
cmp rax, r13
je 0x14003318d
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
mov rcx, rax
call fcn.1400126b0
cmp esi, r13d
jge 0x140033218
mov dword [rdi + 0x1034], r14d
cmp dword [0x140257f98], r13d
je 0x1400331e2
cmp dword [rdi + 0xfb8], r13d
jne 0x1400331e2
mov edx, dword [rdi + 0x103c]
mov dword [rdi + 0x103c], r14d
cmp edx, r14d
je 0x1400331d3
mov rcx, rdi
call fcn.14002fde4
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [rdi]
mov edx, r14d
mov rcx, rdi
call qword [rax + 0x718]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x348]
cmp eax, r13d
je 0x140033200
mov rcx, qword [0x140259760]
call qword [sym.imp.USER32.dll_SetCursor]
mov r8, qword [rsp + 0xf0]
mov edx, r12d
mov rcx, rdi
call fcn.1400d1424
jmp 0x140033832
mov edx, esi
mov rcx, rdi
call fcn.14002d8d0
mov rbx, rax
cmp rax, r13
je 0x140033832
mov r8, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [r8 + 0x468]
mov dword [0x140257f9c], r13d
mov r15d, 1
cmp dword [0x140257fbc], r13d
je 0x14003329c
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x7f0]
cmp eax, r13d
je 0x14003329c
cmp dword [0x140257f98], r13d
jne 0x1400332b2
lea ecx, [r15 + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14003329c
mov dword [0x140257f9c], r15d
mov dword [rdi + 0x103c], esi
mov dword [rdi + 0x1038], r14d
mov qword [0x140257fd0], rdi
cmp dword [0x140257f98], r13d
jne 0x1400332b2
cmp dword [0x140257f9c], r13d
je 0x140033722
cmp dword [rdi + 0xfb8], r13d
jne 0x140033722
cmp dword [rdi + 0xff8], r13d
jne 0x140033722
mov ebp, dword [rdi + 0x103c]
mov dword [rdi + 0x103c], esi
mov rax, qword [rdi]
lea r8, [rsp + 0x28]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x690]
cmp ebp, r14d
je 0x1400332fa
mov edx, ebp
mov rcx, rdi
call fcn.14002fde4
mov edx, dword [rdi + 0x103c]
mov rcx, rdi
call fcn.14002d8d0
mov r11, rax
mov qword [rdi + 0x11e8], rax
mov ecx, r13d
cmp rax, r13
setne cl
cmp ecx, r13d
jne 0x140033326
call fcn.14001505c
int3
and r12d, 8
mov dword [rdi + 0xfe0], r12d
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0xc0]
cmp eax, r13d
jne 0x140033368
mov dword [rdi + 0x103c], r14d
mov qword [rdi + 0x11e8], r13
cmp ebp, r14d
je 0x140033832
mov edx, ebp
mov rcx, rdi
call fcn.14002fde4
jmp 0x140033832
mov edx, esi
mov rcx, rdi
call fcn.14002fde4
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
call qword [rax + 0x78]
cmp eax, r13d
je 0x140033416
mov ecx, dword [rsp + 0xf0]
sub ecx, dword [rsp + 0x30]
call fcn.1401878d8
cmp eax, 6
jg 0x140033416
cmp dword [0x140257f9c], r13d
jne 0x140033416
mov dword [rdi + 0xfe4], r15d
mov rcx, qword [rdi + 0x11e8]
movdqu xmm0, xmmword [rcx + 0x60]
movdqu xmmword [rdi + 0x11a8], xmm0
mov rax, qword [rcx]
call qword [rax + 0x70]
cmp rax, r13
je 0x1400333eb
mov edx, 2
mov r8d, edx
lea rcx, [rdi + 0x11a8]
call qword [sym.imp.USER32.dll_InflateRect]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.14001bcf4
mov qword [rdi + 0x11d8], rax
mov rcx, qword [0x140259748]
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x1400337ff
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
cmp eax, r13d
je 0x140033716
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
call qword [rax + 0xe8]
cmp eax, r13d
je 0x140033716
lea rcx, [rsp + 0x40]
call fcn.1400a5a9c
nop
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x18]
mov r11, qword [rdi]
mov edx, dword [rbx + 0x24]
mov rcx, rdi
call qword [r11 + 0x7e0]
mov dword [0x1402580c0], r13d
mov rax, qword [rsp + 0xf0]
mov qword [rdi + 0x11c8], rax
mov rbx, qword [rdi + 0x40]
mov eax, dword [0x140257f98]
cmp dword [0x140257f9c], r13d
cmovne eax, r15d
mov dword [0x140257f98], eax
lea r9, [0x140258050]
lea r8, [rsp + 0x28]
mov edx, 3
lea rcx, [rsp + 0x40]
call fcn.14010450c
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, r13d
jne 0x1400334fe
cmp dword [0x140257f9c], r13d
je 0x1400334ef
mov dword [0x140257f98], r13d
mov dword [0x140257f9c], r13d
mov qword [0x140257fd0], r13
lea rcx, [rsp + 0x40]
call fcn.1400a5adc
jmp 0x140033832
lea rcx, [rsp + 0xe0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0xe0]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [0x1402580c0], r13d
je 0x1400336cd
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, r13d
jne 0x1400336cd
cmp ebp, r15d
je 0x1400336ae
mov rdx, qword [rdi + 0x11e8]
cmp rdx, r13
je 0x1400336ae
cmp dword [0x1402580bc], r13d
jne 0x1400336ae
mov rax, qword [rdi]
mov r8d, ebp
mov rcx, rdi
call qword [rax + 0x6b0]
cmp eax, r13d
je 0x1400336ae
mov rbx, qword [rdi]
mov rdx, qword [rdi + 0x11e8]
mov rcx, rdi
call fcn.14002d710
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x650]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x778]
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r11, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [r11 + 0x560]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
cmp rax, r13
je 0x140033618
cmp qword [rax + 0x40], r13
je 0x140033618
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [0x140257f9c], r13d
jne 0x140033642
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x3c8]
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
lea rdx, str.CMFCTabCtrl
mov rcx, rax
call fcn.14005a7b0
cmp eax, r13d
je 0x1400336e1
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
mov rdx, rax
lea rcx, str.CMFCToolBar
call fcn.14005a7e4
cmp rax, r13
je 0x1400336e1
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x3d0]
jmp 0x1400336e1
mov rdx, qword [rdi + 0x11e8]
cmp rdx, r13
je 0x1400336e1
add rdx, 0x60
mov r8d, r15d
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x1400336e1
mov dword [rdi + 0x1038], esi
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x718]
mov qword [rdi + 0x11e8], r13
mov dword [rsp + 0xf8], r14d
mov dword [rsp + 0xfc], r14d
mov rax, qword [rsp + 0xf8]
mov qword [rdi + 0x11c8], rax
lea rcx, [rsp + 0x40]
call fcn.1400a5adc
jmp 0x1400337ff
mov qword [rdi + 0x11e8], r13
jmp 0x1400337ff
mov dword [rdi + 0x1034], esi
mov edx, esi
mov rcx, rdi
call fcn.14002da8c
bt dword [rbx + 0x28], 0x12
jae 0x140033759
lea rdx, str.CMFCDropDownToolbarButton
mov rcx, rbx
call fcn.14005a7b0
cmp eax, r13d
jne 0x140033759
mov dword [rdi + 0x1034], r14d
jmp 0x140033832
bts dword [rbx + 0x28], 0x11
mov edx, esi
mov rcx, rdi
call fcn.14002fde4
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov r11, qword [rdi]
mov edx, dword [rbx + 0x24]
mov rcx, rdi
call qword [r11 + 0x7e0]
mov r11, qword [rbx]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [r11 + 0x40]
cmp eax, r13d
je 0x1400337e6
lea rcx, [rdi + 0x1080]
xor r8d, r8d
mov rdx, rbx
call fcn.1400be6d4
cmp rax, r13
je 0x1400337b3
btr dword [rbx + 0x28], 0x11
mov dword [rdi + 0x1034], r14d
mov dword [rdi + 0x1038], r14d
mov rax, qword [rdi]
mov edx, r14d
mov rcx, rdi
call qword [rax + 0x718]
mov edx, esi
mov rcx, rdi
call fcn.14002fde4
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1400337ff
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.14001bcf4
mov qword [rdi + 0x11d8], rax
cmp dword [0x140257f9c], r13d
je 0x140033832
mov dword [0x140257f9c], r13d
mov qword [0x140257fd0], r13
xor ecx, ecx
call fcn.14003073c
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret