Function at 0x14009f730
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x14009fa2e
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140124508]
mov r15d, eax
je 0x14009f769
mov rcx, rbx
call fcn.1400a13d0
test al, al
jne 0x14009fa2e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x14009f78d
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x14009f79f
mov rax, rbx
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
cmp byte [0x140122d6a], 0
jne 0x14009f811
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011c180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011c180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
jne 0x14009f7f0
mov rdi, rbx
mov rax, rbx
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
cmp rdi, rbp
je 0x14009f811
mov edx, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x14009f811
test rdi, rdi
jne 0x14009fa21
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r12
xor r12b, r12b
mov qword [rsp + 0x78], r13
xor r13b, r13b
mov qword [rsp + 0x30], r14
test rbp, rbp
je 0x14009f895
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x14009f89a
cmp dword [0x140124508], eax
je 0x14009f871
mov rcx, rbp
call fcn.1400a13d0
test al, al
jne 0x14009f871
mov ecx, dword [0x140124508]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x14009f89a
cmp r14d, r15d
je 0x14009f89a
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x14009f89a
mov r14d, dword [rsp + 0x60]
xor esi, esi
nop dword [rax]
movzx eax, byte [0x140122d6a]
cmp esi, eax
jne 0x14009f8d9
cmp byte [0x140125ddd], 0
jne 0x14009f8d9
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d450
xor r9d, r9d
mov byte [0x140125ddd], 1
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov byte [rsp + 0x20], r8b
lea ecx, [r8 + 1]
call fcn.14001fbd0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011c180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011c180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x14009f9d1
cmp rax, rbp
je 0x14009f936
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x14009f936
test rdi, rdi
jne 0x14009f9d4
inc esi
cmp esi, 5
jl 0x14009f8a0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fbd0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fbd0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011c180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011c180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x14009f9d1
cmp rax, rbp
je 0x14009f9cd
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
je 0x14009f9d4
xor edi, edi
jmp 0x14009f9d4
mov rdi, rbx
mov rsi, qword [rsp + 0x68]
test r12b, r12b
mov r12, qword [rsp + 0x70]
je 0x14009f9f5
mov ecx, dword [0x140124508]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x78]
je 0x14009fa0e
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x30]
test rdi, rdi
je 0x14009fa2e
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rdi
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret