Function at 0x14004dea4
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor edi, edi
mov rbp, r8
movsxd r15, edx
lea r14d, [rdi + 1]
mov r13, rcx
cmp r8, rdi
je 0x14004ded7
mov dword [r8], r14d
mov rcx, qword [0x140259f88]
cmp rcx, rdi
je 0x14004e025
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindow]
cmp eax, edi
je 0x14004e025
call qword [sym.imp.USER32.dll_GetFocus]
mov rcx, rax
call fcn.14001bcf8
mov rcx, qword [0x140259f88]
mov rdx, qword [rcx]
mov rbx, rax
call qword [rdx + 0x3b8]
cmp eax, edi
je 0x14004df80
cmp rbx, rdi
je 0x14004df60
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004df60
mov rcx, qword [0x140259f88]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004e1c6
mov rcx, qword [0x140259f88]
cmp rcx, rdi
je 0x14004df55
mov rdi, qword [rcx + 0x40]
cmp qword [rbx + 0x40], rdi
jne 0x14004df67
jmp 0x14004e1c6
mov rcx, qword [0x140259f88]
mov rcx, qword [rcx + 0x40]
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14004e1c6
cmp rbx, rdi
je 0x14004dfa7
mov rdx, qword [rbx + 0x40]
cmp rdx, rdi
je 0x14004dfa7
mov rcx, qword [0x140259f88]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsChild]
cmp eax, edi
jne 0x14004e1c6
mov rcx, qword [0x140259f88]
mov rdx, qword [rcx]
call qword [rdx + 0x338]
mov rcx, qword [0x140259f88]
mov r8, r15
mov rcx, qword [rcx + 0x40]
mov ebx, dword [rax + 0x1290]
xor r9d, r9d
mov edx, 0x100
call qword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, edi
jne 0x14004dfe5
mov eax, r14d
jmp 0x14004e1c8
mov rdx, qword [0x140259f88]
lea rcx, str.CMFCDropDownListBox
call fcn.14005a468
cmp rax, rdi
je 0x14004e01b
mov rax, qword [rax + 0x1810]
mov rbx, rdi
cmp rax, rdi
je 0x14004e010
mov rbx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_GetFocus]
cmp rbx, rax
je 0x14004e01e
mov edi, r14d
mov eax, edi
jmp 0x14004e1c8
mov rcx, qword [r13 + 0x118]
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, edi
jne 0x14004dfdd
cmp dword [0x140258fb8], edi
jne 0x14004e1c6
mov rsi, qword [0x140259040]
mov r12d, edi
cmp rsi, rdi
je 0x14004e0bc
mov rbx, qword [rsi + 0x10]
mov rsi, qword [rsi]
cmp rbx, rdi
je 0x14004e19b
mov rcx, qword [rbx + 0x40]
call fcn.14001bd3c
cmp rax, rdi
je 0x14004e0b7
mov rcx, rbx
mov r14d, edi
call fcn.14002de48
cmp eax, edi
jle 0x14004e0b1
mov edx, r14d
mov rcx, rbx
call fcn.14002d5f4
mov rcx, rax
mov rdx, qword [rax]
call qword [rdx + 0x148]
cmp eax, edi
jne 0x14004e18d
mov rcx, rbx
inc r14d
call fcn.14002de48
cmp r14d, eax
jl 0x14004e082
mov r14d, 1
cmp r12d, edi
je 0x14004e050
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, 0x8000
movzx ebx, dil
test si, ax
mov eax, 8
lea ecx, [rax + 0xa]
cmovne ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004e0ec
or bl, 0x10
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test si, ax
je 0x14004e0ff
or bl, 4
cmp r12d, edi
jne 0x14004e14e
mov r8, qword [r13 + 0x118]
mov sil, bl
mov r9d, r14d
or sil, r14b
movzx ecx, r15w
mov dl, sil
call fcn.14009a0b8
cmp eax, edi
jne 0x14004e1c6
mov rcx, qword [r13 + 0x118]
mov rax, qword [rcx]
call qword [rax + 0x290]
xor r9d, r9d
mov dl, sil
mov r8, rax
movzx ecx, r15w
call fcn.14009a0b8
cmp eax, edi
jne 0x14004e1c6
mov rcx, qword [r13 + 0x180]
cmp rcx, rdi
je 0x14004e1a1
mov rcx, qword [rcx + 0x40]
call qword [sym.imp.USER32.dll_IsWindowVisible]
cmp eax, edi
je 0x14004e1a1
cmp bl, 8
jne 0x14004e1a1
cmp r15d, 0x70
jne 0x14004e1b9
mov rcx, qword [r13 + 0x180]
cmp qword [rcx + 0x9d8], rdi
je 0x14004e1b9
call fcn.1400d44c4
jmp 0x14004dfdd
mov r14d, 1
mov r12d, r14d
jmp 0x14004e0b7
call fcn.14001501c
int3
cmp bl, 0x10
jne 0x14004e1b9
mov edx, r15d
mov rcx, r13
call fcn.14004d2a8
cmp eax, edi
jne 0x14004dfdd
cmp r12d, edi
je 0x14004e1c6
cmp rbp, rdi
je 0x14004e1c6
mov dword [rbp], edi
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret