Function at 0x140156100
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1402cece8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rsi, rcx
xor r15d, r15d
lea rcx, [rbp - 0x50]
mov qword [rbp - 0x50], r15
mov rbx, r8
mov r14d, edx
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x370]
mov rcx, rdi
call fcn.1401c8134
mov rcx, rsi
call rdi
test al, 1
je 0x140156385
cmp byte [rsi + 0x210], r15b
jne 0x14015617f
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, rax
call fcn.14004054c
cmp rax, rsi
je 0x1401561b5
cmp byte [rsi + 0x210], r15b
je 0x140156192
call qword [sym.imp.USER32.dll_GetCapture]
mov rcx, rax
call fcn.14004054c
cmp rax, rsi
jne 0x1401561b5
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb ecx, ecx
neg ecx
inc ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1401561d2
cmp dword [rsi + 0x4d8], r15d
jne 0x1401561d2
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [rsi + 0x210], r15b
mov byte [rsi + 0x408], r15b
cmp byte [rsi + 0x408], r15b
je 0x1401563b9
mov rcx, qword [rsi + 0x40]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], r15
call qword [sym.imp.USER32.dll_GetWindowRect]
cmp byte [rsi + 0x409], r15b
jne 0x140156218
mov rdx, qword [rbp - 0x50]
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_PtInRect]
cmp eax, 1
sete al
mov byte [rsi + 0x409], al
mov rax, qword [rsi + 0x240]
lea rdx, [rbp - 0x48]
mov ecx, dword [rbp - 0x50]
sub ecx, eax
shr rax, 0x20
mov dword [rbp - 0x30], ecx
mov ecx, dword [rbp - 0x4c]
sub ecx, eax
mov rax, qword [rbp - 0x50]
mov qword [rsi + 0x240], rax
mov rax, qword [rsi + 0x208]
mov dword [rbp - 0x2c], ecx
mov rcx, qword [rsi + 0x40]
mov qword [rbp - 0x48], rax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rbp - 0x48]
mov rcx, rsi
mov ebx, dword [rbp - 0x50]
mov edi, dword [rbp - 0x4c]
sub ebx, eax
mov rdx, qword [rbp - 0x30]
shr rax, 0x20
sub edi, eax
call fcn.140079b00
mov ecx, ebx
call fcn.1401da7ac
cmp eax, dword [0x1402dd800]
jg 0x140156297
mov ecx, edi
call fcn.1401da7ac
cmp eax, dword [0x1402dd804]
jle 0x1401563e6
cmp byte [rsi + 0x409], r15b
je 0x1401563e6
mov rax, qword [rsi]
mov rbx, qword [rax + 0x2d8]
mov rcx, rbx
call fcn.1401c8134
mov rcx, rsi
call rbx
test eax, eax
je 0x140156310
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
call fcn.14004054c
mov rdx, rax
lea rcx, str.CMFCBaseTabCtrl
call fcn.140034aa8
mov rdi, rax
test rax, rax
je 0x14015637b
mov rcx, qword [rax]
mov rbx, qword [rcx + 0x340]
mov rcx, rbx
call fcn.1401c8134
xor r9d, r9d
or r8d, 0xffffffff
mov rcx, rdi
lea edx, [r9 + 1]
call rbx
jmp 0x14015637b
mov rax, qword [rsi]
movups xmm0, xmmword [rsi + 0x2c0]
mov rbx, qword [rax + 0x3f8]
mov rcx, rbx
movdqu xmmword [rbp - 0x30], xmm0
call fcn.1401c8134
mov r9b, 1
lea rdx, [rbp - 0x30]
mov r8d, 1
mov rcx, rsi
call rbx
mov rax, qword [rsi]
mov rbx, qword [rax + 0x338]
mov rcx, rbx
call fcn.1401c8134
mov rcx, rsi
call rbx
mov rdx, rax
lea rcx, vtable.CGlobalUtils.0
call fcn.14010e8f0
xor r9d, r9d
lea rcx, vtable.CGlobalUtils.0
xor r8d, r8d
mov rdx, rax
call fcn.14010e79c
mov word [rsi + 0x408], r15w
jmp 0x1401563e6
mov rax, qword [rsi]
mov rdi, qword [rax + 0x370]
mov rcx, rdi
call fcn.1401c8134
mov rcx, rsi
call rdi
test al, 2
je 0x1401563b9
cmp byte [rsi + 0x408], r15b
je 0x1401563b9
mov r8, rbx
mov edx, r14d
mov rcx, rsi
call fcn.140078478
jmp 0x1401563e6
mov rcx, qword [rsi + 0x40]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x40], rbx
call qword [sym.imp.USER32.dll_ClientToScreen]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x710]
mov rcx, rbx
call fcn.1401c8134
mov rdx, qword [rbp - 0x40]
mov rcx, rsi
call rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401c73d0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret