Function at 0x14005cf30
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x68]
sub rsp, 0x168
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1402a98a8]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov r15, r8
mov rsi, rcx
mov eax, edx
sub eax, 0x14
je 0x14005d619
sub eax, 0xfd
je 0x14005cfe8
cmp eax, 0x22
je 0x14005cf8c
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x14005d68e
mov ecx, dword [0x1402c12d8]
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1402beca0], eax
jg 0x14005d6b4
cmp dword [rsi + 0x40], 1
je 0x14005cfc0
xor eax, eax
jmp 0x14005d68e
mov edx, 0xffffff
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetTextColor]
mov edx, 0x6666ff
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetBkColor]
mov rax, qword [0x1402bec98]
jmp 0x14005d68e
xor bl, bl
mov r12b, 1
xor r13b, r13b
movzx edi, r15w
cmp edi, 0x695
ja 0x14005d149
je 0x14005d13a
cmp edi, 1
je 0x14005d02b
cmp edi, 2
je 0x14005d0f5
cmp edi, 0x692
je 0x14005d083
lea eax, [rdi - 0x693]
cmp eax, 1
ja 0x14005d171
mov bl, 1
mov eax, 0x694
cmp di, ax
je 0x14005d1d6
mov eax, 0xa7fa
cmp di, ax
je 0x14005d1d6
mov eax, 0xa803
cmp di, ax
je 0x14005d1d6
cmp edi, 1
jne 0x14005d073
lea ecx, [rdi + 0xf]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x14005d1d6
xor r12b, r12b
mov eax, 2
xor r15b, r15b
jmp 0x14005d1ee
mov rax, r15
shr rax, 0x10
mov ecx, 0x300
cmp ax, cx
jne 0x14005d171
mov bl, 1
mov edx, 0x69a
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 1
sete r13b
mov edx, 0x695
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
call qword [sym.imp.USER32.dll_SendMessageW]
cmp rax, 1
sete r15b
jmp 0x14005d1e9
mov rax, qword [rcx + 0x38]
mov rcx, qword [rax + 0xd0]
mov edx, 0x1c
mov rcx, qword [rcx]
call fcn.140050e10
mov rax, qword [rsi + 0x38]
mov rdx, qword [rax + 0xd0]
mov rcx, qword [rdx]
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_SetFocus]
mov rax, qword [rsi]
xor edx, edx
mov rcx, rsi
call qword [rax + 0x18]
mov eax, 1
jmp 0x14005d68e
mov bl, 1
movzx r15d, bl
movzx r13d, bl
jmp 0x14005d1e9
mov ecx, edi
sub ecx, 0x69a
je 0x14005d1e3
sub ecx, 0xa160
je 0x14005d02b
sub ecx, 8
je 0x14005d02b
cmp ecx, 1
je 0x14005d185
mov edx, 0x111
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x14005d68e
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetFocus]
cmp rax, rbx
je 0x14005d02b
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov r9d, 1
mov r8, rax
lea edx, [r9 + 0x27]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
jmp 0x14005d68e
mov r12b, 1
mov eax, 2
xor r15b, r15b
jmp 0x14005d1ee
mov r13b, 1
xor r15b, r15b
mov eax, 1
mov dword [rbp - 0x70], 0x1010101
xor r14d, r14d
mov qword [rbp - 0x6c], r14
mov word [rbp - 0x64], r14w
mov byte [rbp - 0x62], r14b
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x1401e5030]
movdqa xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x60], r14w
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov word [rbp - 0x40], r14w
movdqa xmmword [rbp - 0x10], xmm0
movdqa xmmword [rbp - 0x10], xmm1
mov word [rbp - 0x20], r14w
movdqa xmmword [rbp + 0x10], xmm0
movdqa xmmword [rbp + 0x10], xmm1
mov word [rbp], r14w
mov dword [rbp + 0x20], 1
mov word [rbp + 0x24], r14w
mov byte [rbp + 0x26], 1
mov byte [rbp - 0x70], r14b
mov dword [rbp - 0x6c], eax
mov byte [rbp - 0x6d], r12b
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 0x695
mov r8d, 0xf0
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 1
sete byte [rbp - 0x6f]
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140058260
nop
test bl, bl
je 0x14005d553
mov dword [rsp + 0x48], r14d
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov dword [rsp + 0x20], r14d
lea r9, [rsp + 0x48]
lea r8, [rbp - 0x70]
mov rcx, qword [rsi + 0x38]
call fcn.1400599a0
mov byte [rsp + 0x40], al
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x78]
lea rcx, [rbp - 0x60]
call fcn.140006d70
mov r12, qword [rsi + 0x38]
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x58], rax
mov rax, qword [r12 + 0xd0]
mov rbx, qword [rax]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x85f
mov rcx, rbx
call fcn.14000fa10
mov rdi, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x861
mov rcx, rbx
call fcn.14000fa10
mov rbx, rax
mov rcx, qword [r12 + 0xd0]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7d6
mov rcx, qword [rcx]
call fcn.14000fa10
mov edx, ebx
movzx ecx, byte [rbp - 0x6d]
test cl, cl
cmovne edx, eax
mov r8d, r14d
cmovne r8d, edi
cmp byte [rbp - 0x62], r14b
jne 0x14005d3a5
cmp byte [rbp - 0x6e], r14b
jne 0x14005d3a0
mov edi, r8d
mov ebx, edx
jmp 0x14005d3a5
mov edi, r14d
mov ebx, eax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x30], rax
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x38], rax
mov dword [rbp + 0x40], edi
mov dword [rbp + 0x44], ebx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0xffffffff
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp + 0x30]
lea edx, [r9 + 2]
mov rcx, r12
call fcn.14005a550
test eax, eax
jg 0x14005d3f7
mov word [0x1402becb0], r14w
jmp 0x14005d499
cmp eax, 1
jne 0x14005d418
mov r8d, eax
lea rdx, str._d_match.
lea rcx, [0x1402becb0]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14005d499
movsxd rdx, eax
lea rcx, [rbp + 0x30]
call fcn.140028450
nop
cmp qword [rax + 0x18], 8
jb 0x14005d42f
mov rax, qword [rax]
mov r8, rax
lea rdx, str._s_matches.
lea rcx, [0x1402becb0]
call qword [sym.imp.USER32.dll_wsprintfW]
nop
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14005d487
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d482
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005d6f0
call fcn.1401812c4
movdqa xmm0, xmmword [0x1401e5030]
movdqu xmmword [rbp + 0x40], xmm0
mov word [rbp + 0x30], r14w
movsxd rbx, dword [rsp + 0x48]
test ebx, ebx
js 0x14005d4ee
cmp ebx, 4
jae 0x14005d4ee
mov dword [rsi + 0x40], ebx
mov edx, 0x692
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, rax
call qword [sym.imp.USER32.dll_InvalidateRect]
lea rcx, [0x1401f9790]
mov rax, qword [rcx + rbx*8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov edx, 0x699
lea r8d, [r9 + 0xc]
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
test r15b, r15b
je 0x14005d553
cmp byte [rsp + 0x40], 0
jne 0x14005d553
mov rax, qword [rsi + 0x38]
mov rcx, qword [rax + 0xd0]
mov rdi, qword [rcx]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x85f
mov rcx, rdi
call fcn.14000fa10
mov rbx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x861
mov rcx, rdi
call fcn.14000fa10
movsxd r9, ebx
mov rax, qword [rsi + 0x38]
mov rcx, qword [rax + 0xd0]
mov edx, 0x870
mov r8, 0xffffffffffffffff
mov rcx, qword [rcx]
call fcn.14000fa10
test r13b, r13b
je 0x14005d597
cmp qword [rsp + 0x78], 0
je 0x14005d588
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 0x69a
mov r8d, 0xf0
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
cmp rax, 1
jne 0x14005d588
movzx edx, al
jmp 0x14005d58a
xor dl, dl
lea r8, [rbp - 0x70]
mov rcx, rsi
call fcn.140058d00
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x14005d5d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d5d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005d6ae
call fcn.1401812c4
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
lea rcx, [rbp]
call fcn.1400068d0
nop
lea rcx, [rbp - 0x20]
call fcn.1400068d0
nop
lea rcx, [rbp - 0x40]
call fcn.1400068d0
nop
lea rcx, [rbp - 0x60]
call fcn.1400068d0
mov eax, 1
jmp 0x14005d68e
mov rcx, qword [rcx + 0x18]
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
xor r14d, r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r14
lea r9d, [r14 + 1]
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, qword [rsi + 0x18]
call qword [sym.imp.USER32.dll_MapWindowPoints]
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
mov rcx, r15
call qword [sym.imp.GDI32.dll_OffsetWindowOrgEx]
xor r9d, r9d
mov r8, r15
lea edx, [r14 + 0x14]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rbx, rax
xor r9d, r9d
mov r8d, dword [rsp + 0x54]
mov edx, dword [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.GDI32.dll_SetWindowOrgEx]
movsxd rax, ebx
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.1401813e0
add rsp, 0x168
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401a2d8c
nop
lea rcx, [0x1402beca0]
call fcn.1401818fc
cmp dword [0x1402beca0], 0xffffffff
jne 0x14005cfb3
mov ecx, 0x6666ff
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [0x1402bec98], rax
lea rcx, [0x1402beca0]
call fcn.14018189c
jmp 0x14005cfb3
call fcn.1401a2d8c
int3