Function at 0x14004e1a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbp, r8
movsxd r15, edx
lea r14d, [rdi + 1]
mov r13, rcx
cmp r8, rdi
je 0x14004e1d3
mov dword [r8], r14d
mov rcx, qword [0x140258f68]
cmp rcx, rdi
je 0x14004e321
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, edi
je 0x14004e321
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.14001bcf4
mov rcx, qword [0x140258f68]
mov rdx, qword [rcx]
mov rbx, rax
call qword [rdx + 0x3b8]
cmp eax, edi
je 0x14004e27c
cmp rbx, rdi
je 0x14004e25c
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004e25c
mov rcx, qword [0x140258f68]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004e4c2
mov rcx, qword [0x140258f68]
cmp rcx, rdi
je 0x14004e251
mov rdi, qword [rcx + 0x40]
cmp qword [rbx + 0x40], rdi
jne 0x14004e263
jmp 0x14004e4c2
mov rcx, qword [0x140258f68]
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14004e4c2
cmp rbx, rdi
je 0x14004e2a3
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004e2a3
mov rcx, qword [0x140258f68]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004e4c2
mov rcx, qword [0x140258f68]
mov rdx, qword [rcx]
call qword [rdx + 0x338]
mov rcx, qword [0x140258f68]
mov r8, r15
mov rcx, qword [rcx + 0x40]
mov ebx, dword [rax + 0x1290]
xor r9d, r9d
mov edx, pe_nt_image_headers64
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, edi
jne 0x14004e2e1
mov eax, r14d
jmp 0x14004e4c4
mov rdx, qword [0x140258f68]
lea rcx, str.CMFCDropDownListBox
call fcn.14005a7e4
cmp rax, rdi
je 0x14004e317
mov rax, qword [rax + 0x1810]
mov rbx, rdi
cmp rax, rdi
je 0x14004e30c
mov rbx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rbx, rax
je 0x14004e31a
mov edi, r14d
mov eax, edi
jmp 0x14004e4c4
mov rcx, qword [r13 + 0x118]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, edi
jne 0x14004e2d9
cmp dword [0x140257f98], edi
jne 0x14004e4c2
mov rsi, qword [0x140258020]
mov r12d, edi
cmp rsi, rdi
je 0x14004e3b8
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
cmp rbx, rdi
je 0x14004e497
mov rcx, qword [rbx + 0x40]
call fcn.14001bd38
cmp rax, rdi
je 0x14004e3b3
mov rcx, rbx
mov r14d, edi
call fcn.14002e124
cmp eax, edi
jle 0x14004e3ad
mov edx, r14d
mov rcx, rbx
call fcn.14002d8d0
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x148]
cmp eax, edi
jne 0x14004e489
mov rcx, rbx
inc r14d
call fcn.14002e124
cmp r14d, eax
jl 0x14004e37e
mov r14d, 1
cmp r12d, edi
je 0x14004e34c
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
movzx ebx, dil
test si, ax
mov eax, 8
lea ecx, [rax + 0xa]
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004e3e8
or bl, 0x10
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004e3fb
or bl, 4
cmp r12d, edi
jne 0x14004e44a
mov r8, qword [r13 + 0x118]
mov sil, bl
mov r9d, r14d
or sil, r14b
movzx ecx, r15w
mov dl, sil
call fcn.14009a7e8
cmp eax, edi
jne 0x14004e4c2
mov rcx, qword [r13 + 0x118]
mov rax, qword [rcx]
call qword [rax + 0x290]
xor r9d, r9d
mov dl, sil
mov r8, rax
movzx ecx, r15w
call fcn.14009a7e8
cmp eax, edi
jne 0x14004e4c2
mov rcx, qword [r13 + 0x180]
cmp rcx, rdi
je 0x14004e49d
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, edi
je 0x14004e49d
cmp bl, 8
jne 0x14004e49d
cmp r15d, 0x70
jne 0x14004e4b5
mov rcx, qword [r13 + 0x180]
cmp qword [rcx + 0x9d8], rdi
je 0x14004e4b5
call fcn.1400d4a6c
jmp 0x14004e2d9
mov r14d, 1
mov r12d, r14d
jmp 0x14004e3b3
call fcn.14001505c
int3
cmp bl, 0x10
jne 0x14004e4b5
mov edx, r15d
mov rcx, r13
call fcn.14004d630
cmp eax, edi
jne 0x14004e2d9
cmp r12d, edi
je 0x14004e4c2
cmp rbp, rdi
je 0x14004e4c2
mov dword [rbp], edi
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret