Function at 0x1400b4780
Capabilities:
Enumerate gui resources
Log keystrokes

Disassembly:
push rbx
push rbp
push rdi
mov eax, 0x11d00
call fcn.1400eb380
sub rsp, rax
cmp qword [rcx + 0x10], 0
movzx ebp, dl
mov rbx, rcx
je 0x1400b4c91
xor edi, edi
mov byte [rcx], 0
cmp qword [0x140136600], rcx
je 0x1400b47bd
mov qword [0x140136600], rcx
mov dword [0x140136610], edi
cmp qword [0x140136608], rdi
jne 0x1400b47e7
mov ecx, 0xfa0
call fcn.1400a96d0
mov qword [0x140136608], rax
test rax, rax
jne 0x1400b47e7
add rsp, 0x11d00
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x11d28], rsi
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r8, qword [0x14012fc08]
mov rcx, rbx
mov rdx, rax
mov rsi, rax
call fcn.1400b4cb0
test rax, rax
je 0x1400b4819
mov ecx, edi
mov dword [0x140136610], ecx
jmp 0x1400b481f
mov ecx, dword [0x140136610]
mov dword [rsp + 0x40], edi
lea rax, [0x1400fb87c]
mov qword [rsp + 0x1058], rax
mov dword [rsp + 0x1894], edi
mov qword [rsp + 0x1898], rdi
mov qword [rsp + 0x18a0], rdi
mov qword [rsp + 0x18c8], rdi
mov qword [rsp + 0x18d0], rdi
test bpl, bpl
je 0x1400b486a
mov byte [rsp + 0x1891], dil
test ecx, ecx
je 0x1400b4872
mov byte [rsp + 0x1891], 1
mov rax, qword [0x140136608]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x18a8], rax
mov rax, qword [rbx + 0x10]
mov dword [rsp + 0x18b0], ecx
lea rcx, [0x1400b5210]
mov qword [rsp + 0x18b8], rax
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x1898]
test rax, rax
je 0x1400b4c51
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [0x1400b3130]
mov qword [rsp + 0x38], rdi
call qword [sym.imp.USER32.dll_EnumWindows]
mov rbx, qword [rsp + 0x38]
mov r8, qword [0x140136608]
test rbx, rbx
je 0x1400b492d
movsxd rcx, dword [0x140136610]
mov edx, edi
mov r9, qword [rsp + 0x1898]
test ecx, ecx
jle 0x1400b490f
mov rax, r8
nop dword [rax]
cmp qword [rax], r9
je 0x1400b4923
inc edx
add rax, 8
cmp edx, ecx
jl 0x1400b4900
cmp ecx, 0x1f4
jge 0x1400b4923
mov qword [r8 + rcx*8], r9
inc ecx
mov dword [0x140136610], ecx
mov qword [rsp + 0x1898], rbx
jmp 0x1400b493b
mov rbx, qword [rsp + 0x1898]
mov ecx, dword [0x140136610]
test rbx, rbx
je 0x1400b4c03
mov qword [rsp + 0x11d30], r12
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x11cf8], r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140136620]
mov r12d, eax
je 0x1400b497a
mov rcx, rbx
call fcn.1400b3190
test al, al
jne 0x1400b4bde
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400b499e
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, r14
je 0x1400b4bde
cmp byte [0x140134299], dil
jne 0x1400b4a09
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14012fc00], edi
lea ecx, [rdx + 7]
call fcn.140001940
mov dword [0x14012fc00], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
cmp rax, rbx
je 0x1400b4bde
cmp rax, r14
je 0x1400b4a09
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400b4a09
test rsi, rsi
jne 0x1400b4bde
mov qword [rsp + 0x11d38], r13
xor r13b, r13b
mov qword [rsp + 0x11cf0], r15
mov byte [rsp + 0x11d20], dil
test r14, r14
je 0x1400b4a92
xor edx, edx
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r15d, eax
test eax, eax
je 0x1400b4a9a
cmp dword [0x140136620], eax
je 0x1400b4a6a
mov rcx, r14
call fcn.1400b3190
test al, al
jne 0x1400b4a6a
mov ecx, dword [0x140136620]
mov r8d, 1
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
test r12d, r12d
je 0x1400b4a9a
cmp r15d, r12d
je 0x1400b4a9a
mov r8d, 1
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [rsp + 0x11d20]
jmp 0x1400b4a9a
mov r15d, dword [rsp + 0x11d20]
mov ebp, edi
nop dword [rax]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14012fc00], edi
lea ecx, [rdx + 7]
call fcn.140001940
mov dword [0x14012fc00], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
cmp rax, rbx
je 0x1400b4b8d
cmp rax, r14
je 0x1400b4af9
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400b4af9
test rsi, rsi
jne 0x1400b4b90
inc ebp
cmp ebp, 5
jl 0x1400b4aa0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], dil
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001e3e0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], dil
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001e3e0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14012fc00], edi
lea ecx, [rdx + 7]
call fcn.140001940
mov dword [0x14012fc00], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
cmp rax, rbx
je 0x1400b4b8d
cmp rax, r14
je 0x1400b4b88
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
je 0x1400b4b90
mov rsi, rdi
jmp 0x1400b4b90
mov rsi, rbx
test r13b, r13b
mov r13, qword [rsp + 0x11d38]
je 0x1400b4baf
mov ecx, dword [0x140136620]
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rsp + 0x11d20], dil
je 0x1400b4bc8
xor r8d, r8d
mov edx, r12d
mov ecx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r15, qword [rsp + 0x11cf0]
test rsi, rsi
je 0x1400b4bde
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov r8, qword [0x140136608]
mov ecx, dword [0x140136610]
mov rbx, qword [rsp + 0x1898]
mov r14, qword [rsp + 0x11cf8]
mov r12, qword [rsp + 0x11d30]
test ecx, ecx
jle 0x1400b4c1f
mov rax, r8
nop word [rax + rax]
cmp qword [rax], rbx
je 0x1400b4c36
inc edi
add rax, 8
cmp edi, ecx
jl 0x1400b4c10
cmp ecx, 0x1f4
jge 0x1400b4c36
movsxd rax, ecx
inc ecx
mov dword [0x140136610], ecx
mov qword [r8 + rax*8], rbx
mov rax, qword [0x14012fc08]
mov ecx, dword [rax + 0x74]
cmp ecx, 0xffffffff
jle 0x1400b4c89
mov edx, 1
call fcn.140001940
jmp 0x1400b4c89
mov ecx, dword [0x140136610]
test ecx, ecx
je 0x1400b4c89
cmp ecx, 1
mov dword [0x140136610], edi
setg cl
test cl, cl
je 0x1400b4c89
mov rcx, qword [0x140136608]
xor edx, edx
mov dword [0x140136610], 1
mov qword [rcx], rsi
mov rcx, rbx
call fcn.1400b4780
mov rsi, qword [rsp + 0x11d28]
mov eax, 1
add rsp, 0x11d00
pop rdi
pop rbp
pop rbx
ret