Function at 0x14004b38c
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbp, r8
movsxd r15, edx
lea r14d, [rdi + 1]
mov r13, rcx
cmp r8, rdi
je 0x14004b3bf
mov dword [r8], r14d
mov rcx, qword [0x140255ec8]
cmp rcx, rdi
je 0x14004b50d
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, edi
je 0x14004b50d
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.14001917c
mov rcx, qword [0x140255ec8]
mov rdx, qword [rcx]
mov rbx, rax
call qword [rdx + 0x3b8]
cmp eax, edi
je 0x14004b468
cmp rbx, rdi
je 0x14004b448
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004b448
mov rcx, qword [0x140255ec8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004b6ae
mov rcx, qword [0x140255ec8]
cmp rcx, rdi
je 0x14004b43d
mov rdi, qword [rcx + 0x40]
cmp qword [rbx + 0x40], rdi
jne 0x14004b44f
jmp 0x14004b6ae
mov rcx, qword [0x140255ec8]
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14004b6ae
cmp rbx, rdi
je 0x14004b48f
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004b48f
mov rcx, qword [0x140255ec8]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004b6ae
mov rcx, qword [0x140255ec8]
mov rdx, qword [rcx]
call qword [rdx + 0x338]
mov rcx, qword [0x140255ec8]
mov r8, r15
mov rcx, qword [rcx + 0x40]
mov ebx, dword [rax + 0x1290]
xor r9d, r9d
mov edx, pe_nt_image_headers64
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, edi
jne 0x14004b4cd
mov eax, r14d
jmp 0x14004b6b0
mov rdx, qword [0x140255ec8]
lea rcx, str.CMFCDropDownListBox
call fcn.1400577f4
cmp rax, rdi
je 0x14004b503
mov rax, qword [rax + 0x1810]
mov rbx, rdi
cmp rax, rdi
je 0x14004b4f8
mov rbx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rbx, rax
je 0x14004b506
mov edi, r14d
mov eax, edi
jmp 0x14004b6b0
mov rcx, qword [r13 + 0x118]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, edi
jne 0x14004b4c5
cmp dword [0x140254ef8], edi
jne 0x14004b6ae
mov rsi, qword [0x140254f80]
mov r12d, edi
cmp rsi, rdi
je 0x14004b5a4
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
cmp rbx, rdi
je 0x14004b683
mov rcx, qword [rbx + 0x40]
call fcn.1400191c0
cmp rax, rdi
je 0x14004b59f
mov rcx, rbx
mov r14d, edi
call fcn.14002b294
cmp eax, edi
jle 0x14004b599
mov edx, r14d
mov rcx, rbx
call fcn.14002aa40
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x148]
cmp eax, edi
jne 0x14004b675
mov rcx, rbx
inc r14d
call fcn.14002b294
cmp r14d, eax
jl 0x14004b56a
mov r14d, 1
cmp r12d, edi
je 0x14004b538
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
movzx ebx, dil
test si, ax
mov eax, 8
lea ecx, [rax + 0xa]
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004b5d4
or bl, 0x10
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004b5e7
or bl, 4
cmp r12d, edi
jne 0x14004b636
mov r8, qword [r13 + 0x118]
mov sil, bl
mov r9d, r14d
or sil, r14b
movzx ecx, r15w
mov dl, sil
call fcn.140097650
cmp eax, edi
jne 0x14004b6ae
mov rcx, qword [r13 + 0x118]
mov rax, qword [rcx]
call qword [rax + 0x290]
xor r9d, r9d
mov dl, sil
mov r8, rax
movzx ecx, r15w
call fcn.140097650
cmp eax, edi
jne 0x14004b6ae
mov rcx, qword [r13 + 0x180]
cmp rcx, rdi
je 0x14004b689
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, edi
je 0x14004b689
cmp bl, 8
jne 0x14004b689
cmp r15d, 0x70
jne 0x14004b6a1
mov rcx, qword [r13 + 0x180]
cmp qword [rcx + 0x9d8], rdi
je 0x14004b6a1
call fcn.1400d18fc
jmp 0x14004b4c5
mov r14d, 1
mov r12d, r14d
jmp 0x14004b59f
call fcn.1400124d4
int3
cmp bl, 0x10
jne 0x14004b6a1
mov edx, r15d
mov rcx, r13
call fcn.14004a858
cmp eax, edi
jne 0x14004b4c5
cmp r12d, edi
je 0x14004b6ae
cmp rbp, rdi
je 0x14004b6ae
mov dword [rbp], edi
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret