Function at 0x1400141dc
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1400c1010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, qword [rsp + 0xc0]
xor ebx, ebx
mov r13, rcx
mov esi, r9d
mov rcx, r8
mov rdi, r8
mov r15d, edx
mov r12d, ebx
lea r14d, [rbx + 1]
call fcn.140017278
test eax, eax
mov edx, 0x112
cmovne r15d, eax
cmp esi, edx
ja 0x14001481b
je 0x140014708
cmp esi, 0x21
ja 0x1400144fc
je 0x1400144a2
cmp esi, 2
je 0x14001443b
cmp esi, 6
je 0x140014404
cmp esi, 7
je 0x1400143c2
cmp esi, 0xf
jbe 0x1400142fa
cmp esi, 0x11
jbe 0x14001432f
cmp esi, 0x20
jne 0x1400142fa
cmp byte [0x1400c6038], bl
jne 0x1400142be
mov rax, qword [rsp + 0xc8]
mov edx, 0xfffe
mov rbx, qword [0x1400c7df8]
cmp ax, dx
jne 0x1400142b1
shr rax, 0x10
cmp ax, 0x201
jne 0x1400142b1
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
mov rcx, rbx
call fcn.140001378
mov r12, r14
jmp 0x1400142fd
mov rax, qword [0x1400c7be8]
mov rdi, qword [rax + 0x26]
test rdi, rdi
je 0x140014329
mov rax, qword [rsp + 0xc8]
mov edx, 0xfffe
cmp ax, dx
jne 0x1400142f2
shr rax, 0x10
cmp ax, 0x201
jne 0x1400142f2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
mov rcx, rdi
call fcn.140001378
mov r14d, ebx
mov dword [r13], r14d
mov rax, r12
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400af450
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [rax + 0x2e], rbx
jmp 0x1400142fa
mov rcx, rdi
call fcn.140008df0
test eax, eax
je 0x140014355
mov r9d, SQLDriverConnect
xor r8d, r8d
xor edx, edx
mov ecx, 0xf0003
call fcn.14000e620
cmp eax, 7
je 0x1400142fd
mov eax, dword [0x1400c7ca8]
test r14b, al
je 0x1400143a4
mov rsi, qword [0x1400c6ac8]
mov rcx, rdi
call fcn.140059214
test rax, rax
je 0x140014386
mov rax, qword [0x1400c7ae0]
mov ecx, dword [rax + 0x8319]
and ecx, r14d
jmp 0x140014388
mov ecx, ebx
mov qword [0x1400c6ac8], rsi
mov qword [0x1400c7ae0], rsi
test ecx, ecx
jne 0x1400142fa
mov eax, dword [0x1400c7ca8]
test al, 2
jne 0x1400142fa
mov rcx, rdi
call fcn.1400188c4
cmp eax, 2
je 0x1400142fd
jmp 0x1400142fa
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1c
not eax
test r14b, al
jne 0x1400143eb
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x1400142fa
cmp byte [0x1400c6038], bl
je 0x1400142fd
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetFocus]
jmp 0x1400142fd
test rdi, rdi
je 0x1400142fa
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1f
test eax, eax
je 0x1400142fa
neg rbp
sbb rax, rax
and rax, rdi
mov qword [0x1400c6a80], rax
jmp 0x1400142fa
cmp r15d, 0x600
lea rax, fcn.14002a5c0
mov r8, rbx
cmove r8, rax
test r8, r8
je 0x140014464
mov r8, qword [r8 + 0x40]
mov edx, r15d
mov rcx, rdi
call fcn.140014c9c
test rdi, rdi
je 0x140014482
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1f
test eax, eax
jne 0x1400142fa
and r15d, 0xff00
cmp r15d, 0xc00
je 0x1400142fa
mov dword [0x1400c7af8], r14d
jmp 0x1400142fa
test rdi, rdi
je 0x1400144bc
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1f
test eax, eax
jne 0x1400144eb
and r15d, 0xff00
cmp r15d, 0xc00
je 0x1400144eb
cmp rdi, qword [0x1400c6a68]
je 0x1400144eb
cmp word [rsp + 0xc8], r14w
jne 0x1400144eb
mov r12d, 2
jmp 0x1400142fd
mov rax, qword [0x1400c7be8]
cmp byte [rax], bl
je 0x14001486a
jmp 0x1400144e0
sub esi, 0x22
je 0x1400145fe
sub esi, 0x5f
je 0x1400145db
sub esi, r14d
je 0x140014551
cmp esi, 0x8f
jne 0x1400142fa
mov r9, qword [rsp + 0xc8]
test r9w, r9w
jne 0x1400142fa
mov rcx, rdi
cmp rbp, 0xf000
jb 0x140014545
mov r8, rbp
jmp 0x1400146fd
mov edx, ebp
call fcn.14001599c
jmp 0x1400142fd
cmp r15d, 0x600
lea rax, fcn.14002a5c0
mov r8, rbx
cmove r8, rax
test r8, r8
je 0x14001457a
mov r8, qword [r8 + 0x48]
mov edx, r15d
mov rcx, rdi
call fcn.140014c9c
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x14001459c
mov rcx, qword [0x1400c6a98]
mov rdx, rax
call fcn.1400a1e40
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rdx, qword [0x1400c6a90]
mov r8, rdi
mov rcx, qword [0x1400c6a98]
call fcn.140092228
cmp rdi, qword [0x1400c6a88]
jne 0x1400142fa
mov qword [0x1400c6a88], rbx
jmp 0x1400142fa
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
xor r8d, r8d
mov rcx, rdi
lea edx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
jmp 0x1400142fa
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x1400142fa
cmp dword [0x1400c6a60], ebx
jne 0x1400142fa
test rdi, rdi
je 0x14001463f
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1f
test eax, eax
jne 0x1400142fa
cmp rdi, qword [0x1400c6a68]
je 0x1400142fa
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
test si, ax
jne 0x140014673
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x1400142fa
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x1400142fa
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1400142fa
movzx ecx, word [rsp + 0x44]
xor r8d, r8d
movzx eax, word [rsp + 0x40]
mov edx, 0x84
shl ecx, 0x10
or ecx, eax
movsxd r9, ecx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0x11
ja 0x1400142fa
mov ecx, 0x3fc14
bt ecx, eax
jae 0x1400142fa
xor r9d, r9d
mov edx, 0x5f9
xor r8d, r8d
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
jmp 0x1400142fd
cmp dword [0x1400c5fec], ebx
je 0x14001471d
mov rcx, rbp
call fcn.14000eaf8
jmp 0x1400142fd
and ebp, 0xfff0
sub rbp, 0xf020
je 0x1400147fc
sub rbp, 0x10
je 0x14001474f
sub rbp, 0x10
je 0x140014779
sub rbp, 0x20
je 0x14001476f
cmp rbp, 0xc0
jne 0x1400142fa
cmp rdi, qword [0x1400c6a68]
jne 0x1400142fa
mov r8d, r14d
mov rdx, rdi
mov rcx, rdi
call fcn.140014ab8
jmp 0x1400142fa
call fcn.1400013fc
jmp 0x1400142fa
test rdi, rdi
je 0x140014797
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1f
test eax, eax
jne 0x1400142fa
mov rdi, qword [0x1400c6a68]
test rdi, rdi
je 0x1400142fd
mov rcx, rdi
call fcn.1400155f8
test rax, rax
jne 0x1400147bb
xor ecx, ecx
call fcn.1400155f8
cmp rax, qword [0x1400c6a68]
je 0x1400142fd
mov edx, 2
mov rcx, rax
call fcn.140017d20
mov dword [rsp + 0x30], reloc.ODBC32.dll_SQLPrepare
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov rdx, r14
mov dword [rsp + 0x20], ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1400142fd
mov r8d, 2
mov rdx, rdi
mov rcx, rdi
call fcn.140014ab8
mov rcx, rdi
call qword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1400142fa
mov eax, 0x222
cmp esi, eax
ja 0x14001495d
je 0x1400148ec
cmp esi, 0x114
jb 0x1400142fa
cmp esi, 0x115
jbe 0x1400148db
cmp esi, 0x117
je 0x1400148b2
cmp esi, 0x11f
je 0x140014890
cmp esi, 0x121
je 0x14001487b
cmp esi, 0x201
jne 0x1400142fa
cmp dword [0x1400c5fec], ebx
je 0x1400142fa
jmp 0x1400144e0
mov ecx, r14d
call fcn.1400163b0
mov rcx, rbp
call fcn.1400139c4
jmp 0x1400142fd
mov rcx, qword [0x1400c7be8]
mov rax, qword [rsp + 0xc8]
mov qword [rcx + 0x218], rbp
mov qword [rcx + 0x220], rax
jmp 0x1400142fd
mov rax, qword [rsp + 0xc8]
mov rdx, rbp
movzx r8d, word [rsp + 0xc8]
mov rcx, rdi
shr rax, 0x10
movzx r9d, ax
call fcn.140015adc
jmp 0x1400142fd
cmp dword [0x1400c5fec], ebx
jne 0x1400142fd
jmp 0x1400142fa
cmp qword [rsp + 0xc8], rbx
jne 0x140014902
xor ecx, ecx
call fcn.140014e14
jmp 0x1400142fa
cmp qword [rsp + 0xc8], rdi
jne 0x1400142fa
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x1400142fa
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1c
not eax
test r14b, al
jne 0x140014951
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x140014951
mov rcx, rdi
jmp 0x1400148f8
xor ecx, ecx
call fcn.140014e14
jmp 0x1400142fd
sub esi, 0x30f
je 0x140014a12
sub esi, 2
je 0x1400149d9
sub esi, 0x2e7
je 0x1400149c0
cmp esi, r14d
jne 0x1400142fa
test rdi, rdi
je 0x14001499d
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1f
test eax, eax
jne 0x1400142fd
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1c
not eax
test r14b, al
cmovne rdi, qword [0x1400c6a68]
mov rcx, rdi
jmp 0x140014953
mov eax, 0xc04
cmp word [rsp + 0xc8], ax
sete r12b
sete bl
jmp 0x1400142fa
cmp rbp, qword [0x1400c6010]
je 0x1400142fa
mov rcx, qword [0x1400c6a98]
test rcx, rcx
je 0x140014a08
mov rdx, qword [0x1400c6a90]
test rdx, rdx
je 0x140014a08
mov r8, rbp
call fcn.140092328
jmp 0x140014a0a
mov eax, ebx
test eax, eax
jne 0x1400142fa
test rdi, rdi
je 0x1400142fa
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongA]
shr eax, 0x1f
test eax, eax
je 0x1400142fa
mov rax, qword [0x1400c7be8]
cmp qword [rax + 0xb6], rbx
je 0x1400142fa
xor edx, edx
mov rcx, rdi
call fcn.1400a1164
mov rsi, rax
test rax, rax
je 0x1400142fa
mov rdx, qword [0x1400c7be8]
xor r8d, r8d
mov rcx, rax
mov rdx, qword [rdx + 0xb6]
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rbp, rax
test rax, rax
je 0x140014aa4
mov rcx, rsi
call qword [sym.imp.GDI32.dll_RealizePalette]
mov r8d, r14d
mov rdx, rbp
mov rcx, rsi
mov r12d, eax
call qword [sym.imp.GDI32.dll_SelectPalette]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_RealizePalette]
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.1400a11a0
jmp 0x1400142fd