Function at 0x1400309b8
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r12d, edx
mov rdi, rcx
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x6d8]
mov esi, eax
or r14d, 0xffffffff
xor r13d, r13d
mov rcx, qword [0x140254f30]
cmp rcx, rdi
je 0x140030a2c
cmp dword [0x140254ef8], r13d
je 0x140030a35
mov qword [0x140254f30], rdi
cmp rcx, r13
je 0x140030a2c
mov edx, dword [rcx + 0x103c]
mov dword [rcx + 0x103c], r14d
call fcn.14002d6cc
cmp dword [0x140254ef8], r13d
jne 0x140030a75
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
mov rdx, rax
lea rcx, str.CPane
call fcn.1400580b0
cmp rax, r13
je 0x140030a75
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
mov rcx, rax
call fcn.140010038
cmp esi, r13d
jge 0x140030b00
mov dword [rdi + 0x1034], r14d
cmp dword [0x140254ef8], r13d
je 0x140030aca
cmp dword [rdi + 0xfb8], r13d
jne 0x140030aca
mov edx, dword [rdi + 0x103c]
mov dword [rdi + 0x103c], r14d
cmp edx, r14d
je 0x140030abb
mov rcx, rdi
call fcn.14002d6cc
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [rdi]
mov edx, r14d
mov rcx, rdi
call qword [rax + 0x718]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x348]
cmp eax, r13d
je 0x140030ae8
mov rcx, qword [0x1402566c0]
call qword [sym.imp.USER32.dll_SetCursor]
mov r8, qword [rsp + 0xf0]
mov edx, r12d
mov rcx, rdi
call fcn.1400cec58
jmp 0x14003111a
mov edx, esi
mov rcx, rdi
call fcn.14002b280
mov rbx, rax
cmp rax, r13
je 0x14003111a
mov r8, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [r8 + 0x468]
mov dword [0x140254efc], r13d
mov r15d, 1
cmp dword [0x140254f1c], r13d
je 0x140030b84
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x7f0]
cmp eax, r13d
je 0x140030b84
cmp dword [0x140254ef8], r13d
jne 0x140030b9a
lea ecx, [r15 + 0x11]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x140030b84
mov dword [0x140254efc], r15d
mov dword [rdi + 0x103c], esi
mov dword [rdi + 0x1038], r14d
mov qword [0x140254f30], rdi
cmp dword [0x140254ef8], r13d
jne 0x140030b9a
cmp dword [0x140254efc], r13d
je 0x14003100a
cmp dword [rdi + 0xfb8], r13d
jne 0x14003100a
cmp dword [rdi + 0xff8], r13d
jne 0x14003100a
mov ebp, dword [rdi + 0x103c]
mov dword [rdi + 0x103c], esi
mov rax, qword [rdi]
lea r8, [rsp + 0x28]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x690]
cmp ebp, r14d
je 0x140030be2
mov edx, ebp
mov rcx, rdi
call fcn.14002d6cc
mov edx, dword [rdi + 0x103c]
mov rcx, rdi
call fcn.14002b280
mov r11, rax
mov qword [rdi + 0x11e8], rax
mov ecx, r13d
cmp rax, r13
setne cl
cmp ecx, r13d
jne 0x140030c0e
call fcn.1400129dc
int3
and r12d, 8
mov dword [rdi + 0xfe0], r12d
mov rax, qword [rax]
mov rcx, r11
call qword [rax + 0xc0]
cmp eax, r13d
jne 0x140030c50
mov dword [rdi + 0x103c], r14d
mov qword [rdi + 0x11e8], r13
cmp ebp, r14d
je 0x14003111a
mov edx, ebp
mov rcx, rdi
call fcn.14002d6cc
jmp 0x14003111a
mov edx, esi
mov rcx, rdi
call fcn.14002d6cc
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
call qword [rax + 0x78]
cmp eax, r13d
je 0x140030cfe
mov ecx, dword [rsp + 0xf0]
sub ecx, dword [rsp + 0x30]
call fcn.140185288
cmp eax, 6
jg 0x140030cfe
cmp dword [0x140254efc], r13d
jne 0x140030cfe
mov dword [rdi + 0xfe4], r15d
mov rcx, qword [rdi + 0x11e8]
movdqu xmm0, xmmword [rcx + 0x60]
movdqu xmmword [rdi + 0x11a8], xmm0
mov rax, qword [rcx]
call qword [rax + 0x70]
cmp rax, r13
je 0x140030cd3
mov edx, 2
mov r8d, edx
lea rcx, [rdi + 0x11a8]
call qword [sym.imp.USER32.dll_InflateRect]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.140019768
mov qword [rdi + 0x11d8], rax
mov rcx, qword [0x1402566a8]
call qword [sym.imp.USER32.dll_SetCursor]
jmp 0x1400310e7
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
call qword [rax + 0xa0]
cmp eax, r13d
je 0x140030ffe
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
call qword [rax + 0xe8]
cmp eax, r13d
je 0x140030ffe
lea rcx, [rsp + 0x40]
call fcn.1400a3198
nop
mov rcx, qword [rdi + 0x11e8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
call qword [rax + 0x18]
mov r11, qword [rdi]
mov edx, dword [rbx + 0x24]
mov rcx, rdi
call qword [r11 + 0x7e0]
mov dword [0x140255020], r13d
mov rax, qword [rsp + 0xf0]
mov qword [rdi + 0x11c8], rax
mov rbx, qword [rdi + 0x40]
mov eax, dword [0x140254ef8]
cmp dword [0x140254efc], r13d
cmovne eax, r15d
mov dword [0x140254ef8], eax
lea r9, [0x140254fb0]
lea r8, [rsp + 0x28]
mov edx, 3
lea rcx, [rsp + 0x40]
call fcn.140101e24
mov ebp, eax
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, r13d
jne 0x140030de6
cmp dword [0x140254efc], r13d
je 0x140030dd7
mov dword [0x140254ef8], r13d
mov dword [0x140254efc], r13d
mov qword [0x140254f30], r13
lea rcx, [rsp + 0x40]
call fcn.1400a31d8
jmp 0x14003111a
lea rcx, [rsp + 0xe0]
call qword [sym.imp.USER32.dll_GetCursorPos]
lea rdx, [rsp + 0xe0]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [0x140255020], r13d
je 0x140030fb5
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, r13d
jne 0x140030fb5
cmp ebp, r15d
je 0x140030f96
mov rdx, qword [rdi + 0x11e8]
cmp rdx, r13
je 0x140030f96
cmp dword [0x14025501c], r13d
jne 0x140030f96
mov rax, qword [rdi]
mov r8d, ebp
mov rcx, rdi
call qword [rax + 0x6b0]
cmp eax, r13d
je 0x140030f96
mov rbx, qword [rdi]
mov rdx, qword [rdi + 0x11e8]
mov rcx, rdi
call fcn.14002b0c0
mov edx, eax
mov rcx, rdi
call qword [rbx + 0x650]
mov r11, qword [rdi]
mov rcx, rdi
call qword [r11 + 0x778]
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov r11, qword [rdi]
mov edx, r15d
mov rcx, rdi
call qword [r11 + 0x560]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
cmp rax, r13
je 0x140030f00
cmp qword [rax + 0x40], r13
je 0x140030f00
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
cmp dword [0x140254efc], r13d
jne 0x140030f2a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x3c8]
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
lea rdx, str.CMFCTabCtrl
mov rcx, rax
call fcn.14005807c
cmp eax, r13d
je 0x140030fc9
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.140019768
mov rdx, rax
lea rcx, str.CMFCToolBar
call fcn.1400580b0
cmp rax, r13
je 0x140030fc9
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x3d0]
jmp 0x140030fc9
mov rdx, qword [rdi + 0x11e8]
cmp rdx, r13
je 0x140030fc9
add rdx, 0x60
mov r8d, r15d
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x140030fc9
mov dword [rdi + 0x1038], esi
mov rax, qword [rdi]
mov edx, esi
mov rcx, rdi
call qword [rax + 0x718]
mov qword [rdi + 0x11e8], r13
mov dword [rsp + 0xf8], r14d
mov dword [rsp + 0xfc], r14d
mov rax, qword [rsp + 0xf8]
mov qword [rdi + 0x11c8], rax
lea rcx, [rsp + 0x40]
call fcn.1400a31d8
jmp 0x1400310e7
mov qword [rdi + 0x11e8], r13
jmp 0x1400310e7
mov dword [rdi + 0x1034], esi
mov edx, esi
mov rcx, rdi
call fcn.14002b43c
bt dword [rbx + 0x28], 0x12
jae 0x140031041
lea rdx, str.CMFCDropDownToolbarButton
mov rcx, rbx
call fcn.14005807c
cmp eax, r13d
jne 0x140031041
mov dword [rdi + 0x1034], r14d
jmp 0x14003111a
bts dword [rbx + 0x28], 0x11
mov edx, esi
mov rcx, rdi
call fcn.14002d6cc
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov r11, qword [rdi]
mov edx, dword [rbx + 0x24]
mov rcx, rdi
call qword [r11 + 0x7e0]
mov r11, qword [rbx]
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [r11 + 0x40]
cmp eax, r13d
je 0x1400310ce
lea rcx, [rdi + 0x1080]
xor r8d, r8d
mov rdx, rbx
call fcn.1400bbe1c
cmp rax, r13
je 0x14003109b
btr dword [rbx + 0x28], 0x11
mov dword [rdi + 0x1034], r14d
mov dword [rdi + 0x1038], r14d
mov rax, qword [rdi]
mov edx, r14d
mov rcx, rdi
call qword [rax + 0x718]
mov edx, esi
mov rcx, rdi
call fcn.14002d6cc
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1400310e7
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_SetCapture]
mov rcx, rax
call fcn.140019768
mov qword [rdi + 0x11d8], rax
cmp dword [0x140254efc], r13d
je 0x14003111a
mov dword [0x140254efc], r13d
mov qword [0x140254f30], r13
xor ecx, ecx
call fcn.14002e024
mov r9d, 0x505
xor r8d, r8d
xor edx, edx
mov rcx, qword [rdi + 0x40]
call qword [sym.imp.USER32.dll_RedrawWindow]
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret