Function at 0x14017a340
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov r13, rdx
mov rdi, rcx
mov edx, 1
call fcn.140175408
cmp dword [rdi + 0x440], 0
je 0x14017a399
mov edx, 0xec19
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_KillTimer]
and dword [rdi + 0x440], 0
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 0x8000
test bx, ax
je 0x14017a3c5
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x14017a3c5
xor eax, eax
jmp 0x14017accc
cmp qword [0x1403f6770], 0
je 0x14017a3be
mov rsi, qword [rbp + 0x68]
test rsi, rsi
je 0x14017a3fe
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + OleTranslateColor]
test eax, eax
jne 0x14017a3fe
mov dword [rsi + 0x13c], 1
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x370]
mov rcx, qword [r13 + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140036160
mov rdx, rax
lea rcx, str.CMFCPopupMenu
call fcn.14003f75c
mov r15, rax
mov qword [rbp - 0x28], rax
mov rcx, rdi
call fcn.140036b48
mov r12, rax
mov qword [rbp - 0x38], rax
lea rax, vtable.CMenu.0
mov qword [rbp - 0x18], rax
and qword [rbp - 0x10], 0
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.1400326ec
call fcn.140014770
mov rdx, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14017a476
mov ecx, 0x80004005
call fcn.140004b6c
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x48], rbx
cmp dword [rdi + 0x45c], 0
je 0x14017a617
mov r14d, 0x42c8
mov ecx, r14d
call fcn.140031aec
test rax, rax
je 0x14017a4ba
mov r8d, r14d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a4cb
call fcn.140010b1c
int3
mov r9, rbx
xor edx, edx
mov r8d, 0xfffffffe
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r12d, r12d
cmp dword [rdi + 0x1a00], r12d
jle 0x14017a713
xor r14d, r14d
test r14, r14
js 0x14017a611
cmp r14, qword [rdi + 0x1a00]
jge 0x14017a611
mov rax, qword [rdi + 0x19f8]
mov r13d, dword [rax + r14*4]
xor r9d, r9d
xor r8d, r8d
mov edx, r13d
mov rcx, rdi
call fcn.140175bf8
mov r15, rax
test rax, rax
je 0x14017a5f1
mov rbx, qword [rax + 0xa0]
test rbx, rbx
jne 0x14017a541
xor eax, eax
jmp 0x14017a549
mov rcx, rbx
call fcn.14027bf28
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp + 0x48]
call fcn.140011cc0
mov rbx, qword [rbp + 0x48]
cmp dword [rbx - 0x10], 0
jne 0x14017a5ae
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x358]
mov rax, qword [r15]
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [rax + 0x180]
nop
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140014074
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14017a5aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp + 0x48]
mov r15d, r13d
neg r15d
movsxd r8, r15d
mov r9, rbx
xor edx, edx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rdi + 0x1380]
mov rax, qword [rcx]
mov edx, r13d
call qword [rax + 0x340]
test rax, rax
je 0x14017a5f1
mov r8d, 8
mov edx, r15d
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_CheckMenuItem]
inc r12d
inc r14
cmp r12d, dword [rdi + 0x1a00]
jl 0x14017a4f3
mov r15, qword [rbp - 0x28]
mov r13, qword [rbp + 0x50]
jmp 0x14017a713
call fcn.140010b1c
int3
test rsi, rsi
je 0x14017a717
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x368]
mov r14d, eax
cmp dword [rsi + 0x138], 0
je 0x14017a689
mov r14d, 0x42bc
mov ecx, r14d
call fcn.140031aec
test rax, rax
je 0x14017a65e
mov r8d, r14d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a66f
call fcn.140010b1c
int3
mov r9, rbx
xor edx, edx
mov r8d, 0xffffff96
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
jmp 0x14017a717
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x280]
test eax, eax
je 0x14017a717
mov ecx, 0x42bb
call fcn.140031aec
test rax, rax
je 0x14017a6be
mov r8d, 0x42bb
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a6cf
call fcn.140010b1c
int3
mov r9, rbx
xor edx, edx
mov r8d, 0xffffff97
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
lea rcx, [rdi + 0x1380]
mov rax, qword [rcx]
mov edx, r14d
call qword [rax + 0x340]
test rax, rax
je 0x14017a717
mov edx, 0xffffff97
mov r8d, 3
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x14017a717
mov r12, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_GetMenuItemCount]
test eax, eax
jle 0x14017a73a
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov eax, dword [rdi + 0x45c]
neg eax
sbb r14d, r14d
and r14d, 0xc
lea ecx, [r14 + 0x42bd]
call fcn.140031aec
test rax, rax
je 0x14017a771
lea r8d, [r14 + 0x42bd]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a782
call fcn.140010b1c
int3
mov r9, rbx
xor edx, edx
mov r8d, 0xffffff9a
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
cmp dword [rdi + 0x434], 0
je 0x14017a7f9
cmp dword [rdi + 0x468], 0
je 0x14017a7f9
mov eax, dword [rdi + 0x45c]
neg eax
sbb r14d, r14d
and r14d, 0x11
lea ecx, [r14 + 0x42b9]
call fcn.140031aec
test rax, rax
je 0x14017a7e0
lea r8d, [r14 + 0x42b9]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a7f1
call fcn.140010b1c
int3
mov r8d, 0xffffff99
jmp 0x14017a847
mov eax, dword [rdi + 0x45c]
neg eax
sbb r14d, r14d
and r14d, 0x11
lea ecx, [r14 + 0x42ba]
call fcn.140031aec
test rax, rax
je 0x14017a830
lea r8d, [r14 + 0x42ba]
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a841
call fcn.140010b1c
int3
mov r8d, 0xffffff98
mov r9, rbx
xor edx, edx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r14d, 0x42be
mov ecx, r14d
cmp dword [rdi + 0x478], 1
jne 0x14017a8d8
call fcn.140031aec
test rax, rax
je 0x14017a89a
mov r8d, r14d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a8ab
call fcn.140010b1c
int3
mov r9, rbx
mov r14d, 0xffffff94
mov r8d, r14d
xor edx, edx
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r8d, 8
mov edx, r14d
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x14017a91c
call fcn.140031aec
test rax, rax
je 0x14017a8f5
mov r8d, r14d
mov rdx, rax
lea rcx, [rbp + 0x48]
call fcn.140007318
mov rbx, qword [rbp + 0x48]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x14017a906
call fcn.140010b1c
int3
mov r9, rbx
xor edx, edx
mov r8d, 0xffffff95
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14017a936
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [r13 + 0x40]
test r15, r15
je 0x14017a950
mov rax, qword [0x1403f6770]
mov dword [rax + 0xb8], 1
mov rcx, qword [0x1403f6770]
mov rax, qword [rcx]
and dword [rsp + 0x28], 0
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp + 0x60]
mov r8d, dword [rbp + 0x58]
mov rdx, qword [rbp - 0x10]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayAllocDescriptorEx]
mov ebx, eax
xor r13d, r13d
test r15, r15
je 0x14017a98b
mov rax, qword [0x1403f6770]
mov dword [rax + 0xb8], r13d
mov rcx, r14
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14017a9b2
lea rax, vtable.CMenu.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.140032790
nop
jmp 0x14017a3be
test rsi, rsi
je 0x14017a9ee
mov dword [rsi + 0x13c], r13d
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x388]
mov rcx, rax
test rax, rax
je 0x14017a9e2
mov rax, qword [rax]
call qword [rax + 0x330]
mov dword [rsi + 0x154], r13d
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x370]
mov r14d, r13d
cmp ebx, 0xffffff94
je 0x14017ac1e
cmp ebx, 0xffffff95
je 0x14017ac0e
cmp ebx, 0xffffff96
je 0x14017abd7
cmp ebx, 0xffffff97
je 0x14017ab92
cmp ebx, 0xffffff98
je 0x14017ab86
cmp ebx, 0xffffff99
je 0x14017ab7a
cmp ebx, 0xffffff9a
je 0x14017aab3
cmp dword [rdi + 0x45c], r13d
je 0x14017aa84
neg ebx
je 0x14017aa84
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
mov rcx, rdi
call fcn.140175bf8
mov r14, rax
test rax, rax
je 0x14017aa84
lea rsi, [rdi + 0x1380]
mov r8, qword [rsi]
mov edx, ebx
mov rcx, rsi
call qword [r8 + 0x340]
mov rdx, r14
mov rcx, rsi
test rax, rax
jne 0x14017ac01
call fcn.1401719c0
jmp 0x14017ac06
mov rax, qword [0x1403f4d28]
test r15, r15
cmovne rax, r15
mov qword [0x1403f4d28], rax
lea rax, vtable.CMenu.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.140032790
nop
jmp 0x14017a3be
cmp rsi, qword [rdi + 0x488]
jne 0x14017aac3
mov qword [rdi + 0x488], r13
cmp rsi, qword [rdi + 0x490]
jne 0x14017aad3
mov qword [rdi + 0x490], r13
test r15, r15
je 0x14017aaec
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, rdi
xor r8d, r8d
mov edx, dword [0x1403f6448]
mov rcx, qword [r12 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test rax, rax
jne 0x14017ab60
mov ecx, 0x7238
call fcn.140010904
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14017ab2e
mov r8, rdi
mov rdx, r12
mov rcx, rax
call fcn.1401fbec0
mov rbx, rax
jmp 0x14017ab31
mov rbx, r13
mov eax, r13d
test rbx, rbx
setne al
test eax, eax
jne 0x14017ab44
call fcn.140010b1c
int3
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x2d0]
mov r8, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rax, vtable.CMenu.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.140032790
nop
jmp 0x14017acc7
mov dword [rdi + 0x434], r13d
jmp 0x14017ac06
mov dword [rdi + 0x434], 1
jmp 0x14017ac06
test rsi, rsi
je 0x14017ac49
cmp dword [rsi + 0x160], r13d
je 0x14017abbf
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsi + 0x118]
mov rcx, rdi
call fcn.140175bf8
test rax, rax
cmovne rsi, rax
mov rax, qword [rsi]
lea rdx, [rdi + 0x1380]
mov rcx, rsi
call qword [rax + 0x360]
mov r14d, eax
jmp 0x14017ac49
cmp rsi, qword [rdi + 0x488]
jne 0x14017abe7
mov qword [rdi + 0x488], r13
cmp rsi, qword [rdi + 0x490]
jne 0x14017abf7
mov qword [rdi + 0x490], r13
lea rcx, [rdi + 0x1380]
mov rdx, rsi
call fcn.1401728e4
mov r14d, 1
jmp 0x14017ac49
mov rcx, qword [rdi + 0xb08]
test rcx, rcx
je 0x14017ac49
xor edx, edx
jmp 0x14017ac2f
mov rcx, qword [rdi + 0xb08]
test rcx, rcx
je 0x14017ac49
mov edx, 1
call fcn.1400af618
mov r9d, 0x105
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
test r15, r15
je 0x14017ac62
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test r14d, r14d
je 0x14017acb2
mov dword [rdi + 0x438], 1
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x420]
test r12, r12
je 0x14017acb2
cmp qword [r12 + 0x40], r13
je 0x14017acb2
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax + 0x2f0]
mov r9d, 0x581
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12 + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
nop
lea rax, vtable.CMenu.0
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.140032790
nop
mov eax, 1
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret