Function at 0x14004d5e0
Capabilities:
Log keystrokes via polling

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
movzx ebx, r8b
mov esi, edx
mov rdi, rcx
test byte [rcx + 0x1f0], 1
je 0x14004d845
cmp qword [rcx + 0x40], 0
je 0x14004d845
test bl, bl
je 0x14004d638
call fcn.14000a5c4
and eax, 0x18000000
cmp eax, 0x10000000
jne 0x14004d845
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
mov ebp, 0x8000
test bp, ax
jne 0x14004d841
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test bp, ax
jne 0x14004d841
call fcn.140008c24
mov r11, rax
xor ecx, ecx
test rax, rax
setne cl
test ecx, ecx
jne 0x14004d684
mov ecx, 0x80004005
call fcn.1400052e0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x368]
mov r11, qword [rsp + 0x40]
mov eax, dword [r11 - 0x10]
test eax, eax
jne 0x14004d6d6
lea rdx, [r11 - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004d6cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14004d847
test eax, eax
jle 0x14004d822
mov edx, 0x26
mov rcx, r11
call fcn.14002fb50
mov r10, rax
test rax, rax
je 0x14004d81d
mov r11, qword [rsp + 0x40]
sub r10, r11
sar r10, 1
test r10d, r10d
js 0x14004d822
mov ecx, dword [r11 - 0x10]
lea eax, [rcx - 1]
cmp r10d, eax
je 0x14004d822
lea eax, [r10 + 1]
test eax, eax
js 0x14004d812
cmp eax, ecx
jg 0x14004d812
cdqe
movzx ecx, word [r11 + rax*2]
call fcn.1401a3900
movzx r11d, ax
cmp r11d, esi
je 0x14004d76b
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004d764
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14004d847
test bl, bl
je 0x14004d7ee
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001256c
mov rbx, rax
test rax, rax
je 0x14004d7ee
nop dword [rax]
mov rcx, rdi
call fcn.14000a5c4
mov ecx, eax
and ecx, 0x18000000
cmp ecx, 0x10000000
jne 0x14004d7ca
bt eax, 0x1e
jae 0x14004d7ee
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001256c
mov rbx, rax
test rax, rax
jne 0x14004d790
jmp 0x14004d7ee
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004d7ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14004d847
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004d80e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
jmp 0x14004d847
mov ecx, 0x80070057
call fcn.1400052e0
int3
mov r11, qword [rsp + 0x40]
lea rdx, [r11 - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14004d83d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor al, al
jmp 0x14004d847
xor al, al
jmp 0x14004d847
xor al, al
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret