Function at 0x14004f5a0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc0
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov rax, qword [0x140195088]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rsi, r9
mov r10d, r8d
mov r11, rdx
mov rdi, rcx
mov rcx, qword [rcx + 0x60]
cmp rdx, rcx
je 0x14004f5fa
mov r9, qword [rbp + 0x7f]
mov r8, rsi
mov edx, r10d
mov rcx, r11
call qword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x14004ffbc
cmp r10d, 0x100
ja 0x14004fa9c
je 0x14004f9db
lea eax, [r8 - 1]
cmp eax, 0x52
ja case.0x14004f635.4
lea r8, [0x140000000]
movzx eax, byte [r8 + rax + 0x50024]
mov edx, dword [r8 + rax*4 + 0x4ffdc]
add rdx, r8
jmp rdx
mov rcx, rdi
call fcn.14004a440
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
call fcn.140049610
jmp case.0x14004f635.8
test rsi, rsi
je 0x14004f687
mov rcx, qword [rdi + 0x98]
call fcn.140002220
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x14004f6af
cmp dword [rdi + 0xd0], 0
je 0x14004f6af
jmp 0x14004f6aa
mov rcx, qword [rdi + 0x10]
call fcn.140049720
jmp case.0x14004f635.8
mov rax, qword [rdi + 0x30]
test rax, rax
je 0x14004f6b3
cmp dword [rdi + 0xd0], 0
je 0x14004f6b3
mov rcx, rax
call fcn.140043240
mov rcx, qword [rdi + 0x60]
test rcx, rcx
je case.0x14004f635.8
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [0x1401a1120], eax
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je case.0x14004f635.8
call fcn.140049780
jmp case.0x14004f635.8
cmp rsi, 1
jne 0x14004f710
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je case.0x14004f635.8
mov eax, dword [rdi + 0xf8]
add eax, 0xfffffffe
cmp eax, 2
jbe case.0x14004f635.8
xor edx, edx
call fcn.14001f330
jmp case.0x14004f635.8
test rsi, 0xfffffffffffffffd
jne 0x14004f732
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x14004f732
cmp dword [rdi + 0xd0], 0
je 0x14004f732
xor edx, edx
call fcn.1400431b0
xor esi, esi
mov qword [rbp - 0x51], rsi
mov rcx, qword [rbp + 0x7f]
movzx eax, cx
mov dword [rbp - 0x49], eax
shr rcx, 0x10
movzx eax, cx
mov dword [rbp - 0x45], eax
movaps xmm0, xmmword [rbp - 0x51]
movdqa xmmword [rbp - 0x51], xmm0
lea rdx, [rbp - 0x51]
mov rcx, rdi
call fcn.14004bb50
jmp case.0x14004f635.8
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x51]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov dword [0x1401a1120], eax
cmp dword [rbp - 0x51], 0
jl 0x14004f7b1
cmp dword [rbp - 0x4d], 0
jl 0x14004f7b1
cmp dword [rbp - 0x49], 0
jl 0x14004f7b1
cmp dword [rbp - 0x45], 0
jl 0x14004f7b1
movaps xmm0, xmmword [rbp - 0x51]
movdqa xmmword [rbp - 0x61], xmm0
lea rdx, [rbp - 0x61]
mov rcx, qword [rdi + 0xa0]
call fcn.1400596d0
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je 0x14004f7bf
call fcn.140043060
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je case.0x14004f635.8
call fcn.140020110
jmp case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
mov rcx, qword [rdi + 0x70]
call fcn.1400411c0
mov eax, 1
jmp 0x14004ffbc
xor edx, edx
mov rcx, qword [rdi + 0x98]
call fcn.140039c40
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x98]
call fcn.140038820
jmp case.0x14004f635.8
mov rcx, qword [rdi]
call fcn.1400069e0
mov rcx, qword [rdi + 8]
call fcn.14003f6c0
mov rcx, qword [rdi + 0x70]
call fcn.140002220
mov rcx, qword [rdi + 0x18]
call fcn.1400137f0
mov rcx, qword [rdi + 0x20]
call fcn.140047580
xor eax, eax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x21], rax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x11], rax
mov qword [rbp - 9], rax
mov qword [rbp - 1], rax
lea rdx, [rbp - 0x41]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_BeginPaint]
mov rbx, rax
call fcn.14002d6c0
mov rsi, rax
cmp dword [rdi + 0x8c], 0
jle 0x14004f8d3
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
lea rdx, [rbp - 0x51]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_GetClientRect]
mov r8d, dword [rbp - 0x51]
add r8d, dword [rdi + 0x8c]
lea ecx, [r8 + 2]
mov dword [rbp - 0x49], ecx
mov dword [rbp - 0x51], r8d
mov edx, 1
mov rcx, rsi
call fcn.14002d4f0
mov r8, rax
lea rdx, [rbp - 0x51]
mov rcx, rbx
call qword [sym.imp.USER32.dll_FillRect]
lea rdx, [rbp - 0x41]
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_EndPaint]
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x98]
call fcn.140038510
jmp case.0x14004f635.8
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0xc8]
movzx eax, word [rbp + 0x7f]
mov word [rcx + 0x252], ax
mov rcx, qword [rdi + 0x30]
test rcx, rcx
je case.0x14004f635.8
xor edx, edx
call fcn.140043460
jmp case.0x14004f635.8
mov edx, 0x418
mov r8, qword [rbp + 0x7f]
cmp dx, si
jne 0x14004f94e
mov rdx, rsi
mov rcx, qword [rdi + 0x70]
call fcn.140041420
jmp case.0x14004f635.8
cmp dword [r8 + 0x10], 0xfffffff4
jne case.0x14004f635.8
cmp qword [r8 + 8], 0x41d
jne case.0x14004f635.8
mov rcx, qword [rdi + 0x48]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x10]
jmp case.0x14004f635.8
test rsi, rsi
je case.0x14004f635.8
cmp rsi, 0x41d
jne 0x14004f9a1
mov rcx, qword [rdi + 0x48]
mov rax, qword [rcx]
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
call qword [rax + 8]
jmp case.0x14004f635.8
mov edx, 0x418
cmp rsi, rdx
jne case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rcx, qword [rdi + 0x70]
call fcn.140041520
jmp case.0x14004f635.8
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, r11
call qword [sym.imp.USER32.dll_InvalidateRect]
mov dword [0x1401a1120], eax
jmp case.0x14004f635.8
mov edx, 8
mov rcx, qword [rdi + 0xa0]
call fcn.140057cd0
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov r14d, 0x8000
and ebx, r14d
mov r9d, 1
mov r8d, dword [rdi + 0x114]
mov edx, dword [rdi + 0x110]
mov rcx, rdi
call fcn.14004e6f0
mov dword [rdi + 0xd4], ebx
mov edx, 0x21
mov rcx, qword [rdi + 0xa0]
call fcn.1400578b0
mov ebx, eax
mov edx, 9
mov rcx, qword [rdi + 0xa0]
call fcn.140057cd0
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
test r14w, ax
je 0x14004fa7f
xor esi, esi
test ebx, ebx
sete sil
xor r8d, r8d
mov edx, esi
mov rcx, qword [rdi + 0x10]
call fcn.140049870
mov rcx, qword [rdi + 0x10]
call fcn.140049520
cmp ebx, eax
je 0x14004fa7f
mov rcx, qword [rdi + 0x10]
call fcn.140049b30
mov rcx, qword [rdi + 0x60]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov dword [0x1401a1120], eax
mov rcx, rdi
call fcn.14004caa0
jmp case.0x14004f635.8
cmp r10d, 0x214
ja 0x14004feeb
je 0x14004fe72
cmp r10d, 0x115
ja 0x14004fd43
je 0x14004fd11
mov eax, r10d
sub eax, 0x101
je 0x14004fcfd
sub eax, 1
je case.0x14004f635.8
cmp eax, 0xf
jne case.0x14004f635.4
movzx ecx, si
cmp ecx, 0x17f
ja 0x14004fc52
je 0x14004fb89
sub ecx, 0x16b
je 0x14004fb72
sub ecx, 4
je 0x14004fb34
sub ecx, 3
je 0x14004fb23
cmp ecx, 1
jne 0x14004fc74
mov rcx, qword [rdi + 0x98]
call fcn.1400394d0
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x98]
call fcn.140038050
jmp case.0x14004f635.8
mov rax, qword [rdi + 0x98]
mov rbx, qword [rax + 0x18]
mov edx, 0x25
mov rcx, rbx
call fcn.1400578b0
xor esi, esi
test eax, eax
sete sil
mov r8d, esi
mov edx, 0x25
mov rcx, rbx
call fcn.140058290
mov rcx, qword [rdi + 0x70]
call fcn.1400424b0
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x70]
call fcn.140042460
mov rcx, qword [rdi + 0x10]
call fcn.140049b20
jmp case.0x14004f635.8
mov rax, qword [rdi + 0x70]
mov r12, qword [rax + 0x18]
mov rcx, r12
call fcn.1400224a0
mov r14d, eax
mov ecx, 0x18
call fcn.14005d524
mov qword [rbp - 0x51], rax
xor esi, esi
test rax, rax
je 0x14004fbd2
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
lea edx, [r14 + r14*4]
shl edx, 2
mov rcx, rax
call fcn.140031390
mov rbx, rax
jmp 0x14004fbd5
mov rbx, rsi
test rbx, rbx
je case.0x14004f635.8
mov r15d, 0xa
test r14d, r14d
jle 0x14004fc1f
nop dword [rax]
mov edx, esi
mov rcx, r12
call fcn.1400224b0
mov rdi, qword [rax + 0x10]
test esi, esi
jle 0x14004fc0d
mov edx, r15d
mov rcx, rbx
call fcn.140031690
mov rdx, rdi
mov rcx, rbx
call fcn.140031590
inc esi
cmp esi, r14d
jl 0x14004fbf0
mov edx, r15d
mov rcx, rbx
call fcn.140031690
mov rdx, rbx
mov rcx, qword [0x1401a1610]
mov rcx, qword [rcx + 0x140]
call fcn.14005a270
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
jmp case.0x14004f635.8
sub ecx, 0x1a5
je 0x14004fcc2
sub ecx, 0x278
je 0x14004fc90
sub ecx, 1
je case.0x14004f635.8
cmp ecx, 0x10
je case.0x14004f635.8
mov rax, qword [rbp + 0x7f]
mov qword [rsp + 0x20], rax
mov r8d, 0x111
mov rcx, rdi
call fcn.14004af40
jmp case.0x14004f635.8
xor esi, esi
mov qword [rbp - 0x51], rsi
lea rcx, [rbp - 0x51]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rdx, qword [rbp - 0x51]
mov rcx, qword [rdi + 0x48]
call fcn.14003d4b0
test eax, eax
je case.0x14004f635.8
mov rcx, rdi
call fcn.14004bf10
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x98]
mov rax, qword [rcx + 0x30]
test rax, rax
je case.0x14004f635.8
mov rdx, qword [rax + 0x10]
test rdx, rdx
je case.0x14004f635.8
mov rcx, qword [rcx + 0x140]
test rcx, rcx
je case.0x14004f635.8
call fcn.14005a270
jmp case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
mov rcx, rdi
call fcn.14004a990
jmp case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
mov rcx, qword [rdi + 0x28]
call fcn.140050300
mov ebx, eax
mov rcx, qword [rdi + 0x28]
mov edx, dword [rcx + 0x28]
mov rcx, qword [rdi + 0x10]
call fcn.1400498d0
mov edx, ebx
mov rcx, qword [rdi + 0x10]
call fcn.1400497b0
jmp case.0x14004f635.8
mov eax, r10d
sub eax, 0x126
je 0x14004fe54
sub eax, 0xda
je 0x14004fe36
cmp eax, 0xa
jne case.0x14004f635.4
lea ecx, [rax + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebx, ax
mov r14d, 0x8000
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr rsi, 0x10
movsx esi, si
and ebx, r14d
je 0x14004fe07
mov edx, 3
mov rcx, qword [rdi + 0xa0]
call fcn.140057cd0
mov ebx, eax
mov eax, 0x32
mov r15d, 0xa
cmp ebx, 0x64
cmovg r15d, eax
mov eax, 0x64
cmp ebx, 0x190
cmovg r15d, eax
mov ecx, ebx
sub ecx, r15d
lea r14d, [r15 + rbx]
test esi, esi
cmovle r14d, ecx
mov edx, r14d
mov rcx, qword [rdi + 0x10]
call fcn.1400497f0
mov rcx, qword [rdi + 0x10]
call fcn.1400494b0
cmp ebx, eax
je case.0x14004f635.8
mov r8d, r14d
mov edx, 3
mov rcx, qword [rdi + 0xa0]
call fcn.140058870
jmp case.0x14004f635.8
neg esi
mov edx, esi
mov rcx, qword [rdi + 0x28]
call fcn.140050450
mov ebx, eax
mov rcx, qword [rdi + 0x28]
mov edx, dword [rcx + 0x28]
mov rcx, qword [rdi + 0x10]
call fcn.1400498d0
mov edx, ebx
mov rcx, qword [rdi + 0x10]
call fcn.1400497b0
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
call fcn.140049750
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
call fcn.140049450
jmp case.0x14004f635.8
mov rcx, qword [rbp + 0x7f]
mov edx, dword [rcx + 8]
mov r8d, dword [rcx]
mov eax, edx
sub eax, r8d
cmp eax, 0x2d5
jge 0x14004fead
cmp rsi, 7
ja 0x14004fea3
mov eax, 0x92
bt rax, rsi
jae 0x14004fea3
lea eax, [rdx - 0x2d5]
mov dword [rcx], eax
jmp 0x14004fead
lea eax, [r8 + 0x2d5]
mov dword [rcx + 8], eax
mov edx, dword [rcx + 0xc]
mov r8d, dword [rcx + 4]
mov eax, edx
sub eax, r8d
cmp eax, 0x12c
jge case.0x14004f635.8
lea rax, [r9 - 3]
cmp rax, 2
jbe 0x14004fedd
lea eax, [r8 + 0x12c]
mov dword [rcx + 0xc], eax
jmp case.0x14004f635.8
lea eax, [rdx - 0x12c]
mov dword [rcx + 4], eax
jmp case.0x14004f635.8
cmp r10d, 0x312
ja 0x14004ff5d
je 0x14004ff4c
mov eax, r10d
sub eax, 0x216
je 0x14004ff35
sub eax, 0xf2
je 0x14004ff24
cmp eax, 5
jne case.0x14004f635.4
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
mov rcx, qword [rdi + 0x98]
call fcn.140039020
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x98]
call fcn.140039030
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
call fcn.140049760
jmp case.0x14004f635.8
mov rdx, rsi
mov rcx, qword [rdi + 0x98]
call fcn.140038830
jmp case.0x14004f635.8
mov eax, r10d
sub eax, 0x42b
je 0x14004ffac
cmp eax, 0xa
je 0x14004ff97
mov rcx, qword [rdi + 0x98]
cmp dword [rcx + 0x16c], r10d
jne 0x14004ff83
call fcn.1400392b0
jmp case.0x14004f635.8
cmp dword [rcx + 0x168], r10d
jne 0x14004f5e2
call fcn.1400388a0
jmp case.0x14004f635.8
mov r8, qword [rbp + 0x7f]
mov rdx, rsi
mov rcx, qword [rdi + 0x98]
call fcn.1400392a0
jmp case.0x14004f635.8
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je case.0x14004f635.8
call fcn.1400496e0
xor eax, eax
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14005d680
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret