Function at 0x140010790
Capabilities:
Log keystrokes
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x14001c1c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rdi, r8
mov qword [rsp + 0x48], rcx
mov rbp, rdx
mov r13, rcx
mov r10, qword [0x14001c048]
lea r15, [0x14001c048]
cmp r10, r15
je 0x1400107fd
test byte [r10 + 0x1c], 2
je 0x1400107fd
mov rcx, qword [r10 + 0x10]
lea r8, [0x140018670]
mov edx, 0x12
call fcn.140004af4
mov r10, qword [0x14001c048]
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov esi, r14d
lea ebx, [r14 + 0x57]
test rbp, rbp
jne 0x14001082d
cmp r10, r15
je 0x140010caf
test byte [r10 + 0x1c], 1
je 0x140010caf
lea edx, [rbx - 0x44]
jmp 0x140010c57
cmp word [rbp], 0x20
jne 0x140010c6c
cmp qword [r13 + 0x48], r14
je 0x140010c6c
mov rax, qword [rbp + 0x30]
mov esi, dword [rbp + 0x28]
lea rdx, [rsi + rax]
cmp rdx, rax
jb 0x140010c46
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
jb 0x140010c46
mov rax, qword [rdi + 8]
add rcx, rax
cmp rdx, rcx
ja 0x140010c46
mov edx, dword [rbp + 0x38]
add rdx, qword [rbp + 0x40]
cmp rdx, qword [rbp + 0x40]
jb 0x140010c46
mov rcx, qword [rdi + 0x10]
cmp qword [rbp + 0x40], rcx
jb 0x140010c46
add rcx, rax
cmp rdx, rcx
ja 0x140010c46
mov ecx, esi
call fcn.140001318
mov rdi, rax
test rax, rax
je 0x140010c90
mov r8, qword [rbp + 0x30]
mov r9d, esi
mov edx, esi
mov qword [rsp + 0x38], rsi
mov rcx, rax
call qword [sym.imp.msvcrt.dll_memcpy_s]
nop dword [rax + rax]
mov eax, dword [rbp + 0x38]
mov r12, qword [rbp + 0x40]
mov dword [rsp + 0x30], eax
mov rcx, qword [0x14001c048]
cmp rcx, r15
je 0x140010904
test byte [rcx + 0x1c], 2
je 0x140010904
mov r9d, dword [rdi + 4]
lea r8, [0x140018670]
mov rcx, qword [rcx + 0x10]
mov edx, 0x16
call fcn.140004b84
mov edx, dword [rbp + 8]
mov ecx, dword [0x14001c918]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop dword [rax + rax]
lea r15, [rdi + 4]
mov ebx, r14d
cmp word [rbp + 4], r14w
jl 0x140010995
mov eax, dword [r15]
cmp eax, 0x70
ja 0x140010940
je 0x140010995
sub eax, 0x6a
je 0x140010995
sub eax, 1
je 0x140010995
sub eax, 2
jmp 0x140010948
sub eax, 0x71
je 0x140010995
sub eax, 1
je 0x140010995
sub eax, 1
je 0x140010995
cmp eax, 1
je 0x140010995
mov ebx, 0x57
mov rcx, qword [0x14001c048]
lea rax, [0x14001c048]
cmp rcx, rax
je 0x140010c28
test byte [rcx + 0x1c], 1
je 0x140010c28
mov rcx, qword [rcx + 0x10]
lea edx, [rbx - 0x40]
mov r9d, ebx
lea r8, [0x140018670]
call fcn.140004b84
jmp 0x140010c28
cmp dword [r15], 0x6d
jne 0x140010a01
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x50], 0x48
mov dword [rsp + 0x40], eax
test eax, eax
je 0x140010a01
lea rdx, [rsp + 0x50]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
nop dword [rax + rax]
test eax, eax
je 0x140010a01
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.USER32.dll_IsWindow]
nop dword [rax + rax]
test eax, eax
je 0x140010a01
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, dword [rsp + 0x40]
mov r8d, 1
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
nop dword [rax + rax]
mov r14d, eax
movabs r10, 0xa9b086c61450c970
mov r9d, dword [rsp + 0x30]
mov r8, r12
mov rax, qword [r13 + 0x48]
mov edx, esi
mov rcx, rdi
call qword [vtable.H_MA8HI.0]
test r14d, r14d
je 0x140010a48
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
nop dword [rax + rax]
mov edx, dword [rsp + 0x40]
xor r8d, r8d
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
nop dword [rax + rax]
mov ecx, dword [r15]
sub ecx, 0x6d
je 0x140010a5a
sub ecx, 1
je 0x140010a5a
cmp ecx, 6
jne 0x140010ac9
mov eax, dword [rsp + 0x30]
xor esi, esi
mov r14d, eax
test eax, eax
je 0x140010a89
mov ecx, eax
call fcn.140001318
mov r9d, r14d
mov r8, r12
mov edx, r14d
mov rcx, rax
mov rsi, rax
call qword [sym.imp.msvcrt.dll_memcpy_s]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x38]
mov r8, rdi
mov rcx, qword [rbp + 0x30]
mov r9, rdx
call qword [sym.imp.msvcrt.dll_memcpy_s]
nop dword [rax + rax]
test rsi, rsi
je 0x140010ac9
mov r9, r14
mov r8, rsi
mov rdx, r14
mov rcx, r12
call qword [sym.imp.msvcrt.dll_memcpy_s]
nop dword [rax + rax]
mov rcx, rsi
call fcn.1400012cc
cmp dword [r15], 0x6a
jne 0x140010b8b
mov r14, qword [r12 + 8]
xor r15d, r15d
cmp qword [r13 + 0x50], r15
je 0x140010b81
lea ecx, [r15 + 0x28]
call fcn.1400012d8
mov rsi, rax
test rax, rax
je 0x140010b81
mov rax, qword [rbp + 8]
lea rcx, [0x1400154e0]
mov qword [rsi], rcx
lea rdx, [rsp + 0x38]
mov qword [rsi + 0x10], rax
mov dword [rsi + 8], r15d
mov dword [rsi + 0x20], 0x554d5044
mov qword [rsi + 0x18], r14
mov rax, qword [rbp + 8]
mov rcx, qword [r13 + 0x50]
mov qword [rsp + 0x38], rax
call fcn.14000fc7c
test rax, rax
jne 0x140010b72
mov rax, qword [rbp + 8]
lea rdx, [rsp + 0x38]
mov rcx, qword [r13 + 0x50]
mov qword [rsp + 0x38], rax
call fcn.14000f6a4
test rax, rax
jne 0x140010b72
mov rax, qword [rsi]
movabs r10, 0xcc059fb312538170
mov rax, qword [rax]
lea edx, [r15 + 1]
mov rcx, rsi
call qword [vtable.H_MA8HI.0]
jmp 0x140010b81
mov rcx, qword [rax]
mov rdx, rsi
mov rcx, qword [rcx + 0x28]
call fcn.14000f7cc
mov qword [r12 + 8], r15
jmp 0x140010c28
cmp dword [r15], 0x6b
jne 0x140010c28
mov r13, qword [r12]
lea rdx, [rsp + 0x38]
mov rax, qword [rbp + 8]
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], rax
mov rcx, qword [rcx + 0x50]
call fcn.14000fc7c
mov r14, rax
test rax, rax
je 0x140010c23
mov rax, qword [rax]
xor esi, esi
mov rbp, qword [rax + 0x28]
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
cmp dword [rbp + 0x30], esi
je 0x140010bfd
mov rsi, qword [rbp + 0x20]
test rsi, rsi
je 0x140010bfd
mov rdx, qword [rsi]
test rdx, rdx
je 0x140010bfd
cmp qword [rdx + 0x18], r13
je 0x140010bfd
mov rsi, qword [rsi + 8]
jmp 0x140010be4
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
test rsi, rsi
je 0x140010c23
mov rcx, qword [r14]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + 0x28]
call fcn.140010e10
and qword [r12], 0
mov rcx, rdi
call fcn.1400012cc
mov ecx, dword [0x14001c918]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop dword [rax + rax]
jmp 0x140010caf
cmp r10, r15
je 0x140010caf
test byte [r10 + 0x1c], 1
je 0x140010caf
mov edx, 0x14
mov rcx, qword [r10 + 0x10]
lea r8, [0x140018670]
mov r9d, ebx
call fcn.140004b84
jmp 0x140010caf
cmp r10, r15
je 0x140010caf
test byte [r10 + 0x1c], 1
je 0x140010c97
mov rcx, qword [r10 + 0x10]
lea r8, [0x140018670]
mov edx, 0x15
mov r9d, ebx
call fcn.140004b84
mov r10, qword [0x14001c048]
cmp r10, r15
je 0x140010caf
test byte [r10 + 0x1c], 1
je 0x140010caf
mov rcx, qword [r10 + 0x10]
mov r9d, esi
call fcn.1400111a4
mov eax, ebx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140001670
mov rbx, qword [rsp + 0x100]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret