Function at 0x4c6110
Capabilities:
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0xa0
cmp dword [rsp + 0xf0], 0
mov r10, r9
mov esi, r8d
mov rdi, rcx
jne 0x4c63ae
mov rbp, qword [rsp + 0xe8]
mov ebx, 1
cmp r8d, 0x115
jne 0x4c61b5
cmp byte [rcx + 0x6d], 0
je 0x4c618b
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1037
call qword [sym.imp.USER32.dll_SendMessageW]
test bl, al
je 0x4c618b
mov rcx, qword [rdi + 8]
mov r8d, ebx
xor edx, edx
call qword [sym.imp.USER32.dll_InvalidateRect]
mov qword [rbp], rbx
add rdi, 0x50
cmp esi, ebx
jne 0x4c6365
mov rcx, rdi
call fcn.00442738
test rdi, rdi
je 0x4c634c
lea rdx, [rdi - 0x50]
jmp 0x4c634e
mov edx, 0x126
cmp r8d, edx
jne 0x4c61e9
mov r9, qword [rsp + 0xe0]
lea rax, [rsp + 0xf0]
mov r8, r10
mov qword [rsp + 0x20], rax
call fcn.004c849c
mov rcx, rbp
mov qword [rcx], rax
mov eax, ebx
jmp 0x4c63b0
cmp r8d, 0x100
jne 0x4c627a
mov r12d, ebx
cmp r9, 0x41
jne 0x4c6262
lea ecx, [r9 - 0x30]
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4c6262
mov rcx, qword [rdi + 8]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1004
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jle 0x4c625e
xor r13d, r13d
mov r14d, eax
mov rcx, qword [rdi + 8]
mov eax, 2
lea r9, [rsp + 0x50]
mov r8, r13
mov edx, 0x102b
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x5c], eax
call qword [sym.imp.USER32.dll_SendMessageW]
add r13, rbx
sub r14, rbx
jne 0x4c6232
xor eax, eax
jmp 0x4c6268
xor r12d, r12d
mov rax, rbx
mov qword [rbp], rax
test r12d, r12d
je 0x4c618f
jmp 0x4c61e2
cmp r8d, 0x14
jne 0x4c62b5
xor eax, eax
mov dword [rsp + 0xf0], eax
cmp dword [rcx + 0x70], eax
je 0x4c62aa
lea r8, [rsp + 0xf0]
mov rdx, r9
call fcn.00476cf4
mov r11, rax
mov eax, dword [rsp + 0xf0]
jmp 0x4c62ad
xor r11d, r11d
mov qword [rbp], r11
test eax, eax
jmp 0x4c626f
cmp r8d, 0x7b
jne 0x4c618f
mov rax, qword [rsp + 0xe0]
mov r12d, ebx
movsx ecx, ax
shr rax, 0x10
movsx edx, ax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], edx
cmp ecx, 0xffffffff
jne 0x4c62e5
cmp edx, ecx
je 0x4c633f
mov rcx, qword [rdi + 8]
and dword [rsp + 0x38], 0
and dword [rsp + 0x3c], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x44], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x101f
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, [rsp + 0x38]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x4c633f
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.0043df2c
jmp 0x4c6342
xor r12d, r12d
and qword [rbp], 0
jmp 0x4c626c
xor edx, edx
mov rdx, qword [rdx + 8]
lea rcx, [0x008672b0]
call fcn.00444f08
and qword [rbp], 0
jmp 0x4c63ae
cmp esi, 2
jne 0x4c639d
test rdi, rdi
je 0x4c6375
lea rdx, [rdi - 0x50]
jmp 0x4c6377
xor edx, edx
mov rdx, qword [rdx + 8]
lea rcx, [0x008672b0]
call fcn.00444be0
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, qword [rdi + 8]
call qword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4c635e
cmp esi, 0x1a
jne 0x4c63ae
mov rcx, rdi
call fcn.00442738
mov qword [rbp], rbx
xor eax, eax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop r12
ret