Function at 0x14013a7f0
Capabilities:
Log keystrokes via application hook

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1b8
mov rsi, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rcx, qword [0x140331aa8]
test rcx, rcx
je 0x14013a82e
call fcn.1400d77f0
test rax, rax
je 0x14013a8eb
mov rcx, rsi
call fcn.140034b50
mov rdx, qword [rsi + 0x80]
mov rcx, rsi
mov r8d, eax
call fcn.1400cd9c0
mov qword [rsi + 0x80], rax
test rax, rax
je 0x14013a8db
mov rdi, qword [rax + 0x1b0]
call fcn.1400bad60
test rax, rax
je 0x14013a8b8
mov ebx, dword [rax + 0x58]
call fcn.1400ba0c0
cmp ebx, eax
je 0x14013a8b8
test byte [rsi + 0x370], 0xa
je 0x14013a89b
movsx rax, byte [rsi + 0x38f]
test rax, rax
jns 0x14013a892
mov rax, qword [rsi + 0x380]
test rax, rax
je 0x14013ae34
movsx rax, byte [rsi + 0x3df]
test rax, rax
jns 0x14013a8af
mov rax, qword [rsi + 0x3d0]
test rax, rax
je 0x14013ab60
mov ebx, dword [rsi + 0x370]
test bl, 0xa
je 0x14013a900
mov ecx, ebx
and ecx, 0x10
xor eax, eax
cmp ecx, 1
adc eax, 3
test bl, bl
jns 0x14013a915
or eax, 0x100
jmp 0x14013a922
xor edi, edi
jmp 0x14013a85f
mov rcx, qword [0x140331aa8]
call fcn.1400d8ae0
mov rcx, qword [0x140331aa8]
call fcn.1400d8ac0
test al, al
jne 0x14013a8df
jmp 0x14013a82e
xor eax, eax
test bl, 0x10
je 0x14013a922
mov eax, ebx
shr eax, 0x17
and eax, 0x100
inc eax
jmp 0x14013a922
mov ecx, ebx
shr ecx, 0x16
and ecx, 0x200
or eax, ecx
lea ebp, [rbx*4]
and ebp, 0x4000
or ebp, eax
mov rcx, rsi
call fcn.14013c830
add eax, 0xffffff00
rol eax, 0x18
cmp eax, 7
ja case.0x14013a954.2
lea rcx, [0x1402fa630]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
or ebp, 0x40
jmp case.0x14013a954.2
or ebp, 0x10
jmp case.0x14013a954.2
or ebp, 0x30
jmp case.0x14013a954.2
or ebp, 0x20
shl ebx, 3
and ebx, 0x40000
or ebx, ebp
mov rcx, qword [rsi + 0x80]
call fcn.14009a090
mov ecx, ebx
or ecx, 0x180000
cmp eax, 2
cmovne ecx, ebx
mov ebx, ecx
or ebx, 0x2000
test rdi, rdi
cmovne ebx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x150], eax
lea rdx, [0x140139720]
mov ecx, 5
xor r8d, r8d
mov r9d, eax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rsi + 0x440], rax
mov eax, dword [0x14033d3c8]
mov ecx, dword [0x14032bc90]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14013b0f1
lea r8, [rsp + 0x150]
lea rax, [rsp + 0xc0]
mov qword [rax], r8
lea rcx, [rsp + 0x120]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [0x14033d398]
lea r9, [0x14029efa1]
lea r14, [rsp + 0x180]
mov rdx, r14
call fcn.14013caa0
mov rax, qword [r14]
test rax, rax
je 0x14013b0ef
mov qword [rax + 0x18], rsi
lea r15, [rsi + 0x348]
cmp byte [rsi + 0x35f], 0
jns 0x14013aa52
mov r15, qword [r15]
mov rcx, rsi
mov rdx, r14
call fcn.14013b150
cmp byte [rsp + 0x197], 0
jns 0x14013aa6f
mov r14, qword [rsp + 0x180]
mov rcx, rdi
mov rdx, r14
mov r8, r15
mov r9d, ebx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
mov rcx, qword [rsp + 0x198]
call fcn.140071eb0
cmp byte [rsp + 0x197], 0
jns 0x14013aaa7
mov rcx, qword [rsp + 0x180]
call fcn.1401ef41c
mov esi, 0x13ed
dec edi
cmp edi, 8
ja case.0x14013aac1.3
lea rax, [0x1402fa650]
movsxd rcx, dword [rax + rdi*4]
add rcx, rax
jmp rcx
mov esi, 0x1391
jmp case.0x14013aac1.2
mov esi, 0x13f0
jmp case.0x14013aac1.2
mov esi, 0x13ec
jmp case.0x14013aac1.2
mov esi, 0x13ef
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1401f08b0
mov eax, esi
add rsp, 0x1b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
cmp qword [0x14031f9c0], 0
je case.0x14013aac1.2
lea rax, str.unexpected_return_code
mov qword [rsp + 0x20], rax
lea rcx, str.....update_notifier_thirdpartywxWidgets_srcmswmsgdlg.cpp
lea r8, str.wxMSWMessageDialog::MSWTranslateReturnCode
lea r9, str._Assert_failure_
mov edx, 0x33d
call fcn.1400d8690
cmp byte [0x140331ad8], 1
jne case.0x14013aac1.2
mov byte [0x140331ad8], 0
int3
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x180]
call fcn.1401ad2f0
jmp 0x14013ac23
movsx rax, byte [rsi + 0x407]
test rax, rax
jns 0x14013ab74
mov rax, qword [rsi + 0x3f8]
test rax, rax
jne 0x14013a8b8
xor eax, eax
mov qword [rsp + 0x170], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x140], rax
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
lea rdx, [0x1402e6121]
lea rcx, [rsp + 0xf8]
call fcn.1400343a0
call fcn.140113640
test rax, rax
je 0x14013abf5
lea rdx, [rsp + 0xf8]
lea r8, [rsp + 0x120]
lea r9, [rsp + 0x150]
mov rcx, rax
call fcn.1401137c0
test rax, rax
jne 0x14013ac02
lea rcx, [rsp + 0xf8]
call fcn.140113740
cmp byte [rax + 0x17], 0
js 0x14013ab47
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x190], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x180], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x198], xmm0
mov dword [rsp + 0x1a8], 0xfffffffd
xor eax, eax
mov qword [rsp + 0xb0], rax
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, [0x14029f0cd]
lea rcx, [rsp + 0x38]
call fcn.1400343a0
call fcn.140113640
test rax, rax
je 0x14013ac9f
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x60]
lea r9, [rsp + 0x90]
mov rcx, rax
call fcn.1401137c0
test rax, rax
jne 0x14013aca9
lea rcx, [rsp + 0x38]
call fcn.140113740
cmp byte [rax + 0x17], 0
js 0x14013ae02
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc0], xmm0
xorps xmm0, xmm0
lea rbx, [rsp + 0xc0]
movups xmmword [rbx + 0x18], xmm0
mov dword [rbx + 0x28], 0xfffffffd
lea r8, [rsp + 0x180]
mov rcx, rsi
mov rdx, rbx
call fcn.1400a9510
mov rcx, qword [rbx + 0x18]
call fcn.140071eb0
cmp byte [rbx + 0x17], 0
jns 0x14013ad0f
mov rcx, qword [rsp + 0xc0]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x50]
call fcn.140071eb0
cmp byte [rsp + 0x4f], 0
jns 0x14013ad2a
mov rcx, qword [rsp + 0x38]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x78]
call fcn.140071eb0
cmp byte [rsp + 0x77], 0
jns 0x14013ad45
mov rcx, qword [rsp + 0x60]
call fcn.1401ef41c
mov rcx, qword [rsp + 0xa8]
call fcn.140071eb0
cmp byte [rsp + 0xa7], 0
jns 0x14013ad69
mov rcx, qword [rsp + 0x90]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x198]
call fcn.140071eb0
cmp byte [rsp + 0x197], 0
jns 0x14013ad8d
mov rcx, qword [rsp + 0x180]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x110]
call fcn.140071eb0
cmp byte [rsp + 0x10f], 0
jns 0x14013adb1
mov rcx, qword [rsp + 0xf8]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x138]
call fcn.140071eb0
cmp byte [rsp + 0x137], 0
jns 0x14013add5
mov rcx, qword [rsp + 0x120]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x168]
call fcn.140071eb0
cmp byte [rsp + 0x167], 0
jns 0x14013a8b8
mov rcx, qword [rsp + 0x150]
call fcn.1401ef41c
jmp 0x14013a8b8
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0xc0]
call fcn.1401ad2f0
jmp 0x14013acca
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0x180]
call fcn.1401ad2f0
jmp 0x14013aef7
movsx rax, byte [rsi + 0x3b7]
test rax, rax
jns 0x14013ae48
mov rax, qword [rsi + 0x3a8]
test rax, rax
jne 0x14013a89b
xor eax, eax
mov qword [rsp + 0x170], rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x160], xmm0
movaps xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x140], rax
movaps xmmword [rsp + 0x130], xmm0
movaps xmmword [rsp + 0x120], xmm0
lea rdx, [0x1402f7d31]
lea rcx, [rsp + 0xf8]
call fcn.1400343a0
call fcn.140113640
test rax, rax
je 0x14013aec9
lea rdx, [rsp + 0xf8]
lea r8, [rsp + 0x120]
lea r9, [rsp + 0x150]
mov rcx, rax
call fcn.1401137c0
test rax, rax
jne 0x14013aed6
lea rcx, [rsp + 0xf8]
call fcn.140113740
cmp byte [rax + 0x17], 0
js 0x14013ae1b
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x190], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x180], xmm0
xorps xmm0, xmm0
movups xmmword [rsp + 0x198], xmm0
mov dword [rsp + 0x1a8], 0xfffffffd
xor eax, eax
mov qword [rsp + 0xb0], rax
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0x80], rax
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
lea rdx, str.Yes
lea rcx, [rsp + 0x38]
call fcn.1400343a0
call fcn.140113640
test rax, rax
je 0x14013af73
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x60]
lea r9, [rsp + 0x90]
mov rcx, rax
call fcn.1401137c0
test rax, rax
jne 0x14013af7d
lea rcx, [rsp + 0x38]
call fcn.140113740
cmp byte [rax + 0x17], 0
js 0x14013b0d6
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0xd0], rcx
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xc0], xmm0
xorps xmm0, xmm0
lea rbx, [rsp + 0xc0]
movups xmmword [rbx + 0x18], xmm0
mov dword [rbx + 0x28], 0xfffffffd
lea r8, [rsp + 0x180]
mov rcx, rsi
mov rdx, rbx
call fcn.1400a9460
mov rcx, qword [rbx + 0x18]
call fcn.140071eb0
cmp byte [rbx + 0x17], 0
jns 0x14013afe3
mov rcx, qword [rsp + 0xc0]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x50]
call fcn.140071eb0
cmp byte [rsp + 0x4f], 0
jns 0x14013affe
mov rcx, qword [rsp + 0x38]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x78]
call fcn.140071eb0
cmp byte [rsp + 0x77], 0
jns 0x14013b019
mov rcx, qword [rsp + 0x60]
call fcn.1401ef41c
mov rcx, qword [rsp + 0xa8]
call fcn.140071eb0
cmp byte [rsp + 0xa7], 0
jns 0x14013b03d
mov rcx, qword [rsp + 0x90]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x198]
call fcn.140071eb0
cmp byte [rsp + 0x197], 0
jns 0x14013b061
mov rcx, qword [rsp + 0x180]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x110]
call fcn.140071eb0
cmp byte [rsp + 0x10f], 0
jns 0x14013b085
mov rcx, qword [rsp + 0xf8]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x138]
call fcn.140071eb0
cmp byte [rsp + 0x137], 0
jns 0x14013b0a9
mov rcx, qword [rsp + 0x120]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x168]
call fcn.140071eb0
cmp byte [rsp + 0x167], 0
jns 0x14013a89b
mov rcx, qword [rsp + 0x150]
call fcn.1401ef41c
jmp 0x14013a89b
mov rdx, qword [rax]
mov r8, qword [rax + 8]
lea rcx, [rsp + 0xc0]
call fcn.1401ad2f0
jmp 0x14013af9e
ud2
lea rcx, [0x14033d3c8]
call fcn.1401ef46c
cmp dword [0x14033d3c8], 0xffffffff
jne 0x14013a9ec
xorps xmm0, xmm0
movups xmmword [0x14033d3a8], xmm0
movups xmmword [0x14033d398], xmm0
mov dword [0x14033d3c0], 0x3f800000
lea rcx, [0x14013c910]
call fcn.1401ef638
lea rcx, [0x14033d3c8]
call fcn.1401ef520
jmp 0x14013a9ec