Function at 0x14000e350
Capabilities:
Log keystrokes

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r13, r9
mov r12d, r8d
movzx r15d, dx
mov r14, rcx
call fcn.1400a0754
mov rcx, rax
xor ebx, ebx
test rax, rax
je 0x14000e39c
mov rax, qword [rax]
call qword [rax + pe_nt_image_headers64]
jmp 0x14000e39f
mov rax, rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2b13
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
call fcn.1400a0754
test rax, rax
je 0x14000e3d5
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + pe_nt_image_headers64]
test rax, rax
je 0x14000e3d5
mov rdi, qword [rax + 0x40]
jmp 0x14000e3d8
mov rdi, rbx
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebp, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
test ebp, ebp
je 0x14000e48a
test eax, eax
je 0x14000e48a
cmp ebp, eax
je 0x14000e48a
mov r8d, 1
mov edx, eax
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x14000e47f
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [rsp + 0x70]
xor edx, edx
mov ecx, 0x2000
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor r9d, r9d
lea r8, [rsp + 0x20]
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r9d, r9d
lea r8, [rsp + 0x70]
xor edx, edx
mov ecx, 0x2001
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
xor r8d, r8d
mov edx, esi
mov ecx, ebp
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x14000e493
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x14000e493
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rbp, qword [r14 + 0x138]
cmp dword [rbp - 0x10], ebx
cmove rbp, rbx
call fcn.14009d5e8
mov rdx, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000e4c0
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x28], rdi
or rsi, 0xffffffffffffffff
test rbp, rbp
je 0x14000e51e
test rbp, 0xffffffffffff0000
jne 0x14000e50a
movzx ebp, bp
mov ecx, ebp
call fcn.1400a1868
test rax, rax
je 0x14000e535
mov r8d, ebp
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000a990
mov rdi, qword [rsp + 0x28]
jmp 0x14000e535
xor eax, eax
mov rcx, rsi
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
jmp 0x14000e520
mov ecx, ebx
mov r8d, ecx
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.140003940
mov rdi, qword [rsp + 0x28]
call fcn.14009d5e8
mov r11, rax
mov ecx, ebx
test rax, rax
setne cl
test ecx, ecx
jne 0x14000e554
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
movzx edx, r15w
mov rcx, qword [r14 + 0x198]
call fcn.14006bf80
mov dword [rsp + 0x90], ebx
lea rcx, [rsp + 0x90]
call qword [sym.imp.USER32.dll_GetProcessDefaultLayout]
test eax, eax
je 0x14000e5a5
cmp dword [rsp + 0x90], 1
jne 0x14000e5a5
or r12d, 0x180000
test r13, r13
je 0x14000e5c2
mov r9d, r12d
mov r8, rdi
mov rdx, qword [rsp + 0x30]
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
mov edi, eax
jmp 0x14000e5f5
mov rbp, qword [rsp + 0x30]
call fcn.1400a0754
test rax, rax
je 0x14000e5df
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + pe_nt_image_headers64]
jmp 0x14000e5e2
mov rax, rbx
mov r9d, r12d
mov r8, rdi
mov rdx, rbp
mov rcx, rax
call fcn.14009371c
mov edi, eax
call fcn.1400a0754
test rax, rax
je 0x14000e60e
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + pe_nt_image_headers64]
mov rbx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x2b12
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000e645
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x14000e663
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret