Function at 0x14005ef60
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa0
mov r13, rcx
mov rbx, r9
mov rcx, rdx
mov rsi, r8
call fcn.14005db60
mov r15d, eax
test eax, eax
je 0x14005f3d8
mov rdx, qword [rbp + 0x7f]
mov r9, qword [rbp + 0x77]
mov r8, qword [rbp + 0x6f]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbp + 0x67]
call fcn.14004e2a0
mov r14, rax
test rax, rax
je 0x14005f3d8
mov rdx, rbx
mov rcx, rax
call fcn.14008cc40
mov rdi, rax
test rax, rax
je 0x14005f3d8
lea eax, [r15 - 1]
cmp eax, 0x10
ja case.default.0x14005effe
movsxd rcx, eax
lea rax, [0x140000000]
mov edx, dword [rax + rcx*4 + 0x5f7c8]
add rdx, rax
jmp rdx
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov edx, 0xf0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
xor ebx, ebx
cmp r15d, 1
mov eax, ebx
sete al
cmp qword [rbp - 0x49], rax
je case.default.0x14005effe
xor edx, edx
mov rcx, r14
xor r15b, r15b
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
test eax, eax
je 0x14005f08b
cmp eax, dword [0x140105320]
je 0x14005f08b
mov rcx, r14
call fcn.14008d260
test al, al
jne 0x14005f08b
mov ecx, dword [0x140105320]
lea r8d, [rbx + 1]
mov edx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r15b
cmp r14, rdi
jne 0x14005f09b
mov rcx, rdi
call fcn.14008d200
mov r14, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_SetActiveWindow]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x14005f0c9
mov qword [rbp - 0x35], rbx
mov r8d, ebx
mov r9d, ebx
mov dword [rbp - 0x39], ebx
mov eax, ebx
mov dword [rbp - 0x2d], ebx
jmp 0x14005f0d7
mov eax, dword [rbp - 0x2d]
mov r8d, dword [rbp - 0x31]
mov ebx, dword [rbp - 0x35]
mov r9d, dword [rbp - 0x39]
sub eax, ebx
sub r8d, r9d
cdq
sub eax, edx
sar eax, 1
movzx ebx, ax
mov eax, r8d
cdq
shl ebx, 0x10
sub eax, edx
mov r8d, 1
sar eax, 1
mov edx, 0x201
movzx ecx, ax
or rbx, rcx
mov rcx, rdi
mov r9, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, rbx
xor r8d, r8d
mov edx, 0x202
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
test r15b, r15b
je case.default.0x14005effe
mov ecx, dword [0x140105320]
xor r8d, r8d
mov edx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp case.default.0x14005effe
mov edx, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x14005effe
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x14005effe
mov edx, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x14005effe
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x14005effe
cmp word [rsi], 0
jne 0x14005f195
mov eax, 1
jmp 0x14005f7a4
mov edx, 0xfffffff0
cmp r15d, 7
mov r12d, 0xffffffec
mov rcx, rdi
cmove r12d, edx
mov edx, r12d
call qword [sym.imp.USER32.dll_GetWindowLongW]
movzx edx, word [rsi]
lea rcx, [0x1400e7000]
mov r14d, eax
call fcn.1400a5b28
test rax, rax
jne 0x14005f1d8
mov rcx, rsi
call fcn.140015650
mov rbx, rax
jmp 0x14005f209
lea rcx, [rsi + 2]
call fcn.140015650
movzx ecx, word [rsi]
cmp ecx, 0x2b
je 0x14005f204
cmp ecx, 0x2d
je 0x14005f1fd
cmp ecx, 0x5e
jne 0x14005f1f8
xor eax, r14d
jmp 0x14005f207
mov ebx, dword [rbp - 0x49]
jmp 0x14005f209
not eax
and eax, r14d
jmp 0x14005f207
or eax, r14d
mov ebx, eax
cmp ebx, r14d
je 0x14005f25b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, ebx
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x14005f237
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14005f3d8
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, r14d
je 0x14005f3d8
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [0x140100ee0]
lea rdx, [0x1400cc0a4]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call fcn.14008ac50
jmp 0x14005f7a4
xor ebx, ebx
mov edx, 0x14f
cmp r15d, 9
sete bl
xor r9d, r9d
mov r8, rbx
jmp 0x14005f745
cmp word [rsi], 0
je 0x14005f2ab
mov rcx, rsi
call fcn.14000ed90
mov r13d, eax
jmp 0x14005f2b1
mov r13d, 1
mov eax, 0x25
cmp r15d, 0xb
mov ebx, 0x27
cmove ebx, eax
xor edx, edx
movzx ecx, bl
call fcn.140014b30
movzx eax, ax
shl eax, 0x10
movsxd rsi, eax
test r13d, r13d
jle case.default.0x14005effe
mov r12, rsi
movzx r14d, bl
mov eax, 0xc0000001
mov r15d, r13d
or r12, 1
or rsi, rax
xor ebx, ebx
nop word [rax + rax]
mov r9, r12
mov r8, r14
mov edx, 0x100
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov edx, 1
mov dword [0x1400fcaa0], ebx
xor ecx, ecx
call fcn.1400018c0
mov r9, rsi
mov dword [0x1400fcaa0], 1
mov r8, r14
mov edx, 0x101
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
sub r15, 1
jne 0x14005f300
jmp case.default.0x14005effe
cmp word [rbx], 0
jne 0x14005f36c
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f387
mov edx, 0x143
jmp 0x14005f3a0
lea rdx, str.List
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f3d8
mov edx, 0x180
lea rax, [rbp - 0x49]
mov r9, rsi
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
cmp qword [rbp - 0x49], 0xfffffffffffffffe
jb case.default.0x14005effe
mov rax, qword [0x1400fcaa8]
lea rdx, [0x1400df6c0]
cmp byte [rax + 0x150], 0
jne 0x14005f792
mov rcx, qword [0x140100ee0]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.14008ac50
jmp 0x14005f7a4
cmp word [rsi], 0
je 0x14005f3d8
mov rcx, rsi
call fcn.14000ed90
mov esi, eax
sub esi, 1
js 0x14005f3d8
cmp word [rbx], 0
jne 0x14005f442
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f45d
mov edx, 0x144
jmp 0x14005f47a
lea rdx, str.List
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f3d8
mov edx, 0x182
lea rax, [rbp - 0x49]
movsxd r8, esi
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
cmp qword [rbp - 0x49], 0xffffffffffffffff
jmp 0x14005f76a
cmp word [rsi], 0
je 0x14005f3d8
mov rcx, rsi
call fcn.14000ed90
mov esi, eax
sub esi, 1
js 0x14005f3d8
cmp word [rbx], 0
jne 0x14005f4ef
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f50f
mov edx, 0x14e
mov ebx, 9
jmp 0x14005f569
lea rdx, str.List
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f3d8
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, 2
test eax, 0x808
je 0x14005f564
lea rax, [rbp - 0x49]
movsxd r9, esi
mov qword [rsp + 0x30], rax
lea r8d, [rbx - 1]
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x185
mov dword [rsp + 0x20], ebx
jmp 0x14005f588
mov edx, 0x186
movsxd r8, esi
xor r9d, r9d
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
cmp qword [rbp - 0x49], 0xffffffffffffffff
je 0x14005f3d8
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rsi, rax
test rax, rax
je 0x14005f3d8
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
test eax, eax
je 0x14005f3d8
movzx r14d, ax
mov r9, rdi
lea rax, [rbp - 0x49]
movsxd r8, r14d
mov qword [rsp + 0x30], rax
bts r8, 0x10
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x111
mov rcx, rsi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
movzx eax, bx
mov r9, rdi
shl eax, 0x10
mov edx, 0x111
movsxd r8, eax
mov rcx, rsi
or r8, r14
jmp 0x14005f748
cmp word [rbx], 0
jne 0x14005f643
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f66d
mov ebx, 9
mov edx, 0x14d
mov r9, rsi
lea r8d, [rbx - 8]
jmp 0x14005f56f
lea rdx, str.List
mov rcx, rbx
call fcn.140087b90
test rax, rax
je 0x14005f3d8
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, 2
test eax, 0x808
je 0x14005f724
lea rax, [rbp - 0x41]
mov r9, rsi
mov qword [rsp + 0x30], rax
or r8, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x18f
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
mov r9, qword [rbp - 0x41]
cmp r9, 0xffffffffffffffff
je 0x14005f3d8
lea rax, [rbp - 0x49]
mov edx, 0x185
mov qword [rsp + 0x30], rax
lea r8d, [rbx - 1]
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
cmp qword [rbp - 0x49], 0xffffffffffffffff
jne 0x14005f5a5
jmp 0x14005f3d8
mov edx, 0x18c
mov r9, rsi
mov r8d, 1
jmp 0x14005f56f
mov r9, rsi
mov edx, 0xc2
mov r8d, 1
mov rcx, rdi
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14005f3d8
mov rax, qword [0x1400fcaa8]
mov ecx, dword [rax + 0x78]
cmp ecx, 0xffffffff
jle 0x14005f25b
mov edx, 1
call fcn.1400018c0
jmp 0x14005f25b
lea r9, [0x1400e8120]
xor r8d, r8d
mov rcx, r13
call fcn.140035600
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret