Function at 0x140034490
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
sub rsp, 0x130
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rsi, rcx
xor edi, edi
mov dword [rsp + 0x158], edi
mov ebx, dword [rcx + 0x110]
test ebx, ebx
je 0x140034584
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
lea r8d, [rdi + 1]
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x140034547
mov rcx, qword [rsi + 0xa8]
test rcx, rcx
je 0x140034584
mov rax, qword [rcx]
lea rdx, [rsp + 0x160]
call qword [rax]
nop
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetFocus]
nop
mov rax, qword [rsp + 0x160]
test rax, rax
je 0x14003452e
mov rcx, qword [rax + 8]
movsxd rdx, dword [rcx + 4]
lea rcx, [rax + 8]
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 8]
nop
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor r8d, r8d
mov edx, dword [rsi + 0x110]
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x140034584
call fcn.1401c9e90
mov rbx, rax
mov qword [rsp + 0x160], rax
lea rcx, str.CefController_AttachThreadInput_failed.
call fcn.1401cbc90
nop
test rbx, rbx
je 0x140034573
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
jmp 0x140034584
cmp byte [rsi + 0x179], 0
je 0x1400345cf
mov rcx, qword [rsi + 0xa8]
test rcx, rcx
je 0x1400345cf
mov rax, qword [rcx]
lea rdx, [rsp + 0x160]
call qword [rax]
nop
mov edi, 1
mov dword [rsp + 0x158], edi
mov rcx, qword [rax]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x1400345cf
movzx ebx, dil
jmp 0x1400345d1
xor bl, bl
test dil, 1
je 0x140034604
and edi, 0xfffffffe
mov dword [rsp + 0x158], edi
mov rax, qword [rsp + 0x160]
test rax, rax
je 0x140034604
mov rcx, qword [rax + 8]
movsxd rdx, dword [rcx + 4]
lea rcx, [rax + 8]
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 8]
nop
test bl, bl
je 0x140034746
cmp byte [rsi + 0x178], 0
je 0x140034627
mov ecx, 2
call qword [sym.imp.USER32.dll_LockSetForegroundWindow]
mov byte [rsi + 0x178], 0
call fcn.1401c9e90
mov rbx, rax
mov qword [rsp + 0x160], rax
lea rcx, str.TEST_LOADEXTENSION_PERFORMANCE__CEPHTMLENGINE__show_browser_window.
call fcn.1401cb840
nop
test rbx, rbx
je 0x140034653
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
nop
jmp 0x140034664
test dil, 0x20
je 0x140034677
and edi, 0xffffffdf
lea rcx, [rsp + 0x28]
call fcn.14005ba00
mov rcx, qword [rsi + 0xa8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x150]
call qword [rax]
mov rbx, rax
test dil, 0x40
je 0x1400346a1
and edi, 0xffffffbf
lea rcx, [rsp + 0x28]
call fcn.14005ba00
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov rax, qword [rsp + 0x150]
test rax, rax
je 0x1400346dc
mov rcx, qword [rax + 8]
movsxd rdx, dword [rcx + 4]
lea rcx, [rax + 8]
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 8]
nop
test dil, dil
jns 0x1400346ef
btr edi, 7
lea rcx, [rsp + 0x28]
call fcn.14005ba00
mov rcx, qword [rsi + 0xa8]
mov rax, qword [rcx]
lea rdx, [rsp + 0x150]
call qword [rax]
mov rbx, rax
bt edi, 8
jae 0x140034716
lea rcx, [rsp + 0x28]
call fcn.14005ba00
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x128]
nop
mov rax, qword [rsp + 0x150]
test rax, rax
je 0x140034746
mov rcx, qword [rax + 8]
movsxd rdx, dword [rcx + 4]
lea rcx, [rax + 8]
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + 8]
nop
add rsp, 0x130
pop rdi
pop rsi
pop rbx
ret