Function at 0x140151e00
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov edi, edx
mov rbx, rcx
xor r15d, r15d
cmp qword [rcx + 0x500], r15
jne 0x140151e37
xor eax, eax
jmp 0x14015270b
mov rcx, qword [rcx + 0x2a8]
cmp rcx, r15
je 0x140151e5b
mov rax, qword [rcx]
call qword [rax + 0x320]
cmp eax, r15d
je 0x140151e5b
mov eax, 1
jmp 0x14015270b
cmp edi, 9
jne 0x140151e75
lea ecx, [rdi + 7]
call qword [sym.imp.USER32.dll_GetKeyState]
and al, 0x80
neg al
sbb edi, edi
and edi, 0xfffffffe
add edi, 0x28
mov rbp, r15
mov ecx, dword [rbx + 0x20]
mov esi, 1
cmp ecx, r15d
jne 0x140151e96
cmp dword [rbx + 0x30], r15d
je 0x140151e91
cmp dword [rbx + 0x34], r15d
jne 0x140151e96
mov eax, r15d
jmp 0x140151e98
mov eax, esi
mov r13d, r15d
mov dword [rsp + 0xa0], r15d
movsxd r9, eax
mov qword [rsp + 0x40], r9
mov eax, edi
sub eax, 0xd
je 0x1401524c6
sub eax, 0x13
je 0x1401524c6
mov r9d, 5
sub eax, r9d
je 0x14015229a
sub eax, esi
je 0x1401520f3
sub eax, esi
je 0x14015209a
cmp eax, esi
je 0x1401520f3
cmp ecx, r15d
je 0x1401524ef
mov ecx, edi
call fcn.14009a5dc
cmp eax, r15d
je 0x140151f04
mov ecx, edi
call fcn.14009a698
mov edi, eax
mov r14d, r15d
cmp qword [rbx + 0x500], r15
jle 0x1401524ec
cmp r13, r15
jl 0x140152094
cmp r13, qword [rbx + 0x500]
jge 0x140152094
mov rax, qword [rbx + 0x4f8]
mov r12, qword [rax + r13*8]
mov rax, qword [r12]
mov edx, edi
mov rcx, r12
call qword [rax + 0x278]
cmp eax, r15d
jne 0x14015208d
mov rdx, qword [r12 + 8]
lea rcx, [rsp + 0xb8]
call fcn.1400087d0
nop
mov rax, qword [rsp + 0xb8]
cmp dword [rax - 0x10], r15d
jle 0x140151ff6
mov edx, 0x26
mov rcx, rax
call fcn.140185e3c
mov r11, rax
cmp rax, r15
je 0x140151fee
mov rax, qword [rsp + 0xb8]
sub r11, rax
sar r11, 1
cmp r11d, r15d
jl 0x140151ff6
mov ecx, dword [rax - 0x10]
dec ecx
cmp r11d, ecx
jge 0x140151ff6
lea ecx, [r11 + 1]
cmp ecx, r15d
jl 0x140152075
cmp ecx, dword [rax - 0x10]
jg 0x140152075
movsxd rcx, ecx
movzx edx, word [rax + rcx*2]
mov word [rsp + 0xb0], dx
mov word [rsp + 0xb2], r15w
lea rcx, [rsp + 0xb0]
call qword [sym.imp.USER32.dll_CharUpperW]
movzx r11d, word [rsp + 0xb0]
cmp r11d, edi
je 0x140152029
mov rax, qword [rsp + 0xb8]
lea rdx, [rax - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x140152012
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add r14d, esi
add r13, rsi
movsxd rax, r14d
cmp rax, qword [rbx + 0x500]
jge 0x140152080
jmp 0x140151f14
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x70]
cmp eax, r15d
jne 0x140152040
mov rbp, r12
mov r13d, esi
jmp 0x140152048
mov r13d, dword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x1401524ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1401524ef
mov ecx, 0x80070057
call fcn.140001f40
nop
mov r13d, dword [rsp + 0xa0]
jmp 0x1401524ef
mov eax, esi
jmp 0x14015270b
call fcn.14001505c
int3
cmp ecx, r15d
je 0x14015229a
mov rcx, qword [rbx + 0x2a8]
cmp rcx, r15
je 0x14015229a
mov rax, qword [rcx]
call qword [rax + 0x130]
cmp eax, r15d
je 0x14015229a
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x80]
cmp eax, r15d
jne 0x14015229a
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x138]
jmp 0x1401524ef
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x140152275
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov ecx, dword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x28
jne 0x14015213b
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x38]
shr r12, 0x20
add r12d, esi
jmp 0x140152151
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r12, qword [rsp + 0x30]
shr r12, 0x20
sub r12d, esi
mov ecx, 0xfffffffb
cmp edi, 0x28
cmove ecx, r9d
mov dword [rsp + 0xb0], ecx
mov dword [rsp + 0xb8], r15d
cmp rbp, r15
jne 0x1401524dd
mov r15d, eax
mov r14d, eax
mov esi, dword [rsp + 0xb0]
mov r13d, r12d
cmp r14d, dword [rbx + 0x70]
jge 0x140152195
cmp r15d, dword [rbx + 0x78]
jg 0x140152225
test rbp, rbp
jne 0x140152216
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x2c], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x1401521e0
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x34], r13d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x1401521f5
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r13d, esi
cmp edi, 0x28
jne 0x140152205
cmp r13d, dword [rbx + 0x7c]
jg 0x140152210
jmp 0x14015220b
cmp r13d, dword [rbx + 0x74]
jl 0x140152210
test rbp, rbp
je 0x14015219f
mov r9d, 5
sub r14d, r9d
add r15d, r9d
test rbp, rbp
je 0x140152182
mov eax, dword [rsp + 0xb8]
xor r15d, r15d
cmp eax, r15d
lea esi, [r15 + 1]
jne 0x140152257
cmp rbp, r15
jne 0x140152257
cmp qword [rsp + 0x40], r15
je 0x1401524e7
cmp edi, 0x28
jne 0x140152253
mov r12d, dword [rbx + 0x74]
jmp 0x140152257
mov r12d, dword [rbx + 0x7c]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x14015216c
mov r13d, r15d
jmp 0x1401524ef
cmp edi, 0x28
jne 0x14015228a
mov rcx, rbx
call fcn.14014d850
mov rbp, rax
jmp 0x1401524ef
mov rcx, rbx
call fcn.14014d8d4
mov rbp, rax
jmp 0x1401524ef
cmp dword [rbx + 0x20], r15d
je 0x14015231f
cmp edi, 0x25
jne 0x14015231f
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x14015231f
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
mov rdx, rax
lea rcx, str.CMFCPopupMenu
call fcn.14005a7e4
mov r12, rax
mov rcx, rax
call fcn.1400469d8
cmp rax, r15
je 0x14015231f
mov rcx, qword [rbx + 0xc0]
call fcn.140140800
cmp rax, r15
je 0x14015230e
cmp qword [rax + 0xae0], rbx
jne 0x14015230e
mov r8d, esi
mov rdx, qword [rax + 0xad8]
mov rcx, rax
call fcn.1400d5c3c
xor edx, edx
mov rcx, r12
call fcn.140048488
mov eax, esi
jmp 0x14015270b
mov r8, qword [rbx + 0x2a8]
cmp r8, r15
je 0x1401524a7
movdqu xmm0, xmmword [r8 + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x38]
shr rax, 0x20
mov rcx, qword [rsp + 0x30]
shr rcx, 0x20
add eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x20], eax
cmp edi, 0x27
jne 0x14015236d
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x38]
inc r15d
jmp 0x14015237f
movdqu xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov r15d, dword [rsp + 0x30]
dec r15d
mov ecx, 0xfffffffb
cmp edi, 0x27
lea edx, [rcx + 0xa]
cmove ecx, edx
mov dword [rsp + 0xb0], ecx
and dword [rsp + 0xb8], ebp
test rbp, rbp
jne 0x1401524cb
mov r14d, eax
mov r13d, eax
mov esi, dword [rsp + 0xb0]
lea eax, [rbp + 5]
mov r12d, r15d
cmp r13d, dword [rbx + 0x74]
jge 0x1401523c7
cmp r14d, dword [rbx + 0x7c]
jg 0x140152456
test rbp, rbp
jne 0x140152447
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x30], r12d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x30]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
jne 0x140152412
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x2c], r14d
mov rax, qword [rbx]
xor r8d, r8d
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x28]
mov rbp, rax
test rax, rax
je 0x140152427
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0xf0]
neg eax
sbb rcx, rcx
and rbp, rcx
add r12d, esi
cmp edi, 0x27
jne 0x140152437
cmp r12d, dword [rbx + 0x78]
jg 0x140152442
jmp 0x14015243d
cmp r12d, dword [rbx + 0x70]
jl 0x140152442
test rbp, rbp
je 0x1401523d1
mov eax, 5
sub r13d, eax
add r14d, eax
test rbp, rbp
je 0x1401523b4
mov eax, dword [rsp + 0xb8]
test eax, eax
mov esi, 1
jne 0x140152484
test rbp, rbp
jne 0x140152484
xor r15d, r15d
cmp qword [rsp + 0x40], r15
je 0x1401524d8
cmp edi, 0x27
jne 0x140152480
mov r15d, dword [rbx + 0x70]
jmp 0x140152484
mov r15d, dword [rbx + 0x78]
add eax, esi
mov dword [rsp + 0xb8], eax
cmp eax, 2
mov eax, dword [rsp + 0x20]
jl 0x14015239b
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x1401524ef
cmp edi, 0x27
jne 0x1401524b9
mov rcx, rbx
call fcn.14014d850
mov rbp, rax
jmp 0x1401524ef
mov rcx, rbx
call fcn.14014d8d4
mov rbp, rax
jmp 0x1401524ef
mov r13d, esi
jmp 0x1401524ef
mov r13d, dword [rsp + 0xa0]
xor r15d, r15d
jmp 0x1401524ef
mov r13d, r15d
jmp 0x1401524ef
mov r13d, dword [rsp + 0xa0]
jmp 0x1401524ef
mov r13d, r15d
jmp 0x1401524ef
mov r13d, ebp
mov r12d, r15d
cmp rbp, r15
je 0x140152666
mov rax, qword [rbx + 0x2a8]
cmp rax, rbp
je 0x140152663
cmp rax, r15
je 0x14015254e
mov dword [rax + 0xa4], r15d
mov rax, qword [rbx + 0x2a8]
mov dword [rax + 0xa8], r15d
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov qword [rbx + 0x2a8], r15
cmp dword [0x140259874], r15d
je 0x1401525cd
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x1401525cd
cmp dword [rbx + 0x20], r15d
je 0x1401525cd
movdqu xmm0, xmmword [rbp + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rsp + 0x40]
mov dword [rsp + 0x20], eax
shr rax, 0x20
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x20]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_ClientToScreen]
movzx ecx, word [rsp + 0x24]
shl ecx, 0x10
movzx eax, word [rsp + 0x20]
or rcx, rax
mov rdx, qword [rbx + 0xc0]
cmp rdx, r15
jne 0x1401525b5
mov rdx, r15
jmp 0x1401525b9
mov rdx, qword [rdx + 0x40]
mov r9d, ecx
mov ecx, 0x8005
mov r8d, 0xfffffffc
call qword [sym.imp.USER32.dll_NotifyWinEvent]
mov qword [rbx + 0x2a8], rbp
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2d8]
mov dword [rbp + 0xa4], esi
mov dword [rbp + 0xa8], esi
mov rax, qword [rbp]
mov edx, esi
mov rcx, rbp
call qword [rax + 0x2e0]
mov rcx, qword [rbx + 0x2a8]
mov rax, qword [rcx]
call qword [rax + 0x228]
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x140152663
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14001bcf4
mov rdx, rax
lea rcx, str.CMFCRibbonPanelMenu
call fcn.14005a7e4
cmp rax, r15
je 0x140152663
mov rcx, qword [rax + 0x17e8]
cmp rcx, r15
je 0x140152663
mov rax, qword [rcx]
mov r8, qword [rbx + 0x2a8]
mov rdx, qword [rbx + 0xc0]
call qword [rax + 0x2a0]
mov r12d, esi
cmp r13d, r15d
je 0x140152708
mov rdx, qword [rbx + 0x2a8]
cmp rdx, r15
je 0x140152708
lea rcx, str.CMFCRibbonButton
call fcn.14005a7e4
mov rdi, rax
cmp rax, r15
je 0x140152708
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x130]
cmp eax, r15d
je 0x1401526b2
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x138]
jmp 0x140152705
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x70]
cmp eax, r15d
jne 0x140152705
mov rcx, qword [rbx + 0xc0]
cmp rcx, r15
je 0x1401526e9
call fcn.140140800
cmp rax, r15
je 0x1401526e9
cmp qword [rax + 0xae0], rbx
jne 0x1401526e9
mov edx, esi
mov rcx, rax
call fcn.1400d591c
movdqu xmm0, xmmword [rdi + 0x30]
movdqu xmmword [rsp + 0x40], xmm0
mov rax, qword [rdi]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call qword [rax + 0x358]
mov r12d, esi
mov eax, r12d
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret