Function at 0x1401262a0
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x118
mov rcx, qword [rsp + 0x120]
mov rcx, qword [rcx + 0x98]
call sub.mfc90u.dll_CDaoTableDef::GetValidationRule
test eax, eax
jne 0x1401262d4
xor eax, eax
jmp 0x140126960
cmp qword [rsp + 0x130], 0
je 0x1401262ed
mov rax, qword [rsp + 0x130]
mov dword [rax], 1
cmp qword [0x1404e7670], 0
je 0x14012663c
mov rcx, qword [0x1404e7670]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x14012663c
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call sub.mfc90u.dll_CDaoDatabase::Execute
mov qword [rsp + 0x30], rax
mov rax, qword [0x1404e7670]
mov rax, qword [rax]
mov rcx, qword [0x1404e7670]
call qword [rax + 0x3c8]
test eax, eax
je 0x14012648c
cmp qword [rsp + 0x30], 0
jne 0x14012635c
mov qword [rsp + 0xc0], 0
jmp 0x14012636d
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0xc0], 0
je 0x14012643b
mov rax, qword [0x1404e7670]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x30], 0
jne 0x14012639e
mov qword [rsp + 0xc8], 0
jmp 0x1401263af
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xc8], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x14012642e
cmp qword [rsp + 0x30], 0
jne 0x1401263e0
mov qword [rsp + 0xd0], 0
jmp 0x1401263f1
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xd0], rax
cmp qword [0x1404e7670], 0
jne 0x140126409
mov qword [rsp + 0xd8], 0
jmp 0x14012641c
mov rax, qword [0x1404e7670]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
cmp qword [rsp + 0xd0], rax
jne 0x14012643b
mov dword [rsp + 0xe0], 1
jmp 0x140126446
mov dword [rsp + 0xe0], 0
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x3c], eax
cmp dword [rsp + 0x3c], 0
je 0x14012645f
xor eax, eax
jmp 0x140126960
mov rax, qword [0x1404e7670]
mov qword [rsp + 0x68], rax
xor r9d, r9d
xor r8d, r8d
mov edx, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x140126960
cmp qword [rsp + 0x30], 0
jne 0x1401264a2
mov qword [rsp + 0xe8], 0
jmp 0x1401264b3
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xe8], rax
cmp qword [rsp + 0xe8], 0
je 0x140126513
mov rax, qword [0x1404e7670]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x30], 0
jne 0x1401264e0
mov qword [rsp + 0xf0], 0
jmp 0x1401264f1
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x70]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x140126513
xor eax, eax
jmp 0x140126960
mov rax, qword [0x1404e7670]
mov rax, qword [rax]
mov rcx, qword [0x1404e7670]
call qword [rax + COleVariant::operator=]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov eax, dword [rax + 0x13c4]
mov dword [rsp + 0x38], eax
mov rax, qword [0x1404e7670]
mov qword [rsp + 0x80], rax
movsxd r8, dword [rsp + 0x128]
xor r9d, r9d
mov edx, HashKey<wchar_t const *>
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp dword [rsp + 0x38], 0
jne 0x140126580
mov eax, 1
jmp 0x140126960
call fcn.1402bbbc0
mov rdx, qword [0x1404e7670]
mov rcx, rax
call sub.mfc90u.dll_AfxCheckError
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140126625
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x1940]
mov qword [rsp + 0x88], rax
cmp qword [rsp + 0x88], 0
jne 0x1401265d2
mov qword [rsp + 0xf8], 0
jmp 0x1401265e6
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 0x40]
mov qword [rsp + 0xf8], rax
call qword [sym.imp.USER32.dll_GetFocus]
cmp qword [rsp + 0xf8], rax
jne 0x140126603
mov dword [rsp + 0x100], 1
jmp 0x14012660e
mov dword [rsp + 0x100], 0
cmp dword [rsp + 0x100], 0
je 0x140126625
mov dword [rsp + 0x104], 0
jmp 0x140126630
mov dword [rsp + 0x104], 1
mov eax, dword [rsp + 0x104]
jmp 0x140126960
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x98]
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x140126673
mov eax, 1
jmp 0x140126960
cmp dword [0x1404e6674], 0
je 0x140126683
xor eax, eax
jmp 0x140126960
mov dword [rsp + 0x24], 0
lea rax, [0x1404e66f8]
mov rax, qword [rax + 8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x40], rax
cmp dword [rsp + 0x24], 0
jne 0x140126786
cmp qword [rsp + 0x40], 0
je 0x140126786
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xa0], rax
cmp qword [rsp + 0xa0], 0
jne 0x1401266df
call sub.mfc90u.dll_AfxOleUnregisterServerClass
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xa0]
add rax, 0x10
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx + 0x40]
call sub.mfc90u.dll_CWnd::ExecuteDlgInit
test rax, rax
je 0x140126781
mov dword [rsp + 0x50], 0
jmp 0x14012673b
mov eax, dword [rsp + 0x50]
add eax, 1
mov dword [rsp + 0x50], eax
mov rcx, qword [rsp + 0x48]
call fcn.1401183d0
cmp dword [rsp + 0x50], eax
jge 0x140126781
mov edx, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.140110eb0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x58]
call qword [rax + 0x158]
test eax, eax
je 0x14012677f
mov dword [rsp + 0x24], 1
jmp 0x140126781
jmp 0x140126730
jmp 0x1401266ab
mov byte [rsp + 0x20], 0
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401267ac
movzx eax, byte [rsp + 0x20]
or eax, 8
mov byte [rsp + 0x20], al
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401267cd
movzx eax, byte [rsp + 0x20]
or eax, 0x10
mov byte [rsp + 0x20], al
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1401267ee
movzx eax, byte [rsp + 0x20]
or eax, 4
mov byte [rsp + 0x20], al
cmp dword [rsp + 0x24], 0
jne 0x14012687a
movzx eax, byte [rsp + 0x20]
or eax, 1
mov r9d, 1
mov r8, qword [rsp + 0x120]
mov r8, qword [r8 + 0x98]
movzx edx, al
movzx ecx, word [rsp + 0x128]
call fcn.1401fc040
test eax, eax
jne 0x140126873
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x98]
mov rcx, qword [rsp + 0x120]
mov rcx, qword [rcx + 0x98]
mov rax, qword [rax]
call qword [rax + 0x2a0]
mov r8, rax
movzx eax, byte [rsp + 0x20]
or eax, 1
xor r9d, r9d
movzx edx, al
movzx ecx, word [rsp + 0x128]
call fcn.1401fc040
test eax, eax
je 0x14012687a
xor eax, eax
jmp 0x140126960
mov rax, qword [rsp + 0x120]
cmp qword [rax + 0x118], 0
je 0x140126915
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x118]
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140126915
movzx eax, byte [rsp + 0x20]
cmp eax, 8
jne 0x140126915
cmp dword [rsp + 0x128], 0x70
jne 0x140126915
mov rax, qword [rsp + 0x120]
mov rax, qword [rax + 0x118]
mov rax, qword [rax + 0x3c8]
mov qword [rsp + 0xb8], rax
cmp qword [rsp + 0xb8], 0
je 0x140126915
mov rcx, qword [rsp + 0x120]
mov rcx, qword [rcx + 0x118]
call fcn.14029e7a0
mov eax, 1
jmp 0x140126960
movzx eax, byte [rsp + 0x20]
cmp eax, 0x10
jne 0x14012693e
mov edx, dword [rsp + 0x128]
mov rcx, qword [rsp + 0x120]
call fcn.140127cd0
test eax, eax
je 0x14012693e
mov eax, 1
jmp 0x140126960
cmp dword [rsp + 0x24], 0
je 0x14012695e
cmp qword [rsp + 0x130], 0
je 0x14012695e
mov rax, qword [rsp + 0x130]
mov dword [rax], 0
xor eax, eax
add rsp, 0x118
ret