Function at 0x14006c180
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rax, qword [rbp + 0x87]
mov rsi, r9
mov r9, qword [rbp + 0x7f]
mov r8, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x6f]
mov qword [rsp + 0x20], rax
call fcn.14007d8c0
mov qword [rbp - 0x59], rax
test rax, rax
je 0x14006c3db
movzx ebx, word [rsi]
mov r13d, 2
mov rdi, qword [rbp + 0x67]
xor r14d, r14d
xor r15b, r15b
mov qword [rbp - 0x69], r13
mov dword [rbp - 0x61], r13d
mov r12d, r13d
mov dword [rbp - 0x71], 0x80000000
mov dword [rbp - 0x6d], 0x80000000
mov qword [rbp - 0x51], r14
test bx, bx
je 0x14006c30a
mov dil, 1
movzx ecx, bx
test ecx, 0xffffff80
jne 0x14006c233
mov edx, r13d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x14006c233
mov eax, 0xffdf
and bx, ax
movzx eax, bx
add eax, 0xffffffbc
cmp eax, 0x15
ja case.0x14006c259.69
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x6c7d8]
mov ecx, dword [rdx + rax*4 + 0x6c7bc]
add rcx, rdx
jmp rcx
mov r12d, r14d
jmp case.0x14006c259.69
mov r12d, 1
jmp case.0x14006c259.69
movzx ebx, word [rsi + 2]
mov ecx, ebx
test ebx, 0xffffff80
jne 0x14006c28b
mov edx, r13d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x14006c28b
mov eax, 0xffdf
and bx, ax
cmp bx, 0x41
jne 0x14006c297
add rsi, r13
xor dil, dil
xor r14d, r14d
add rsi, r13
movzx eax, dil
mov ecx, r12d
movzx ebx, word [rsi]
test bx, bx
jne 0x14006c213
mov rdi, qword [rbp + 0x67]
movzx r12d, al
mov dword [rbp - 0x61], ecx
test r15b, r15b
je 0x14006c30d
mov rsi, qword [rbp - 0x59]
mov dword [rbp - 0x61], ecx
jmp 0x14006c328
mov r8d, 3
lea rdx, [0x140111a20]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne case.0x14006c259.69
add rsi, 4
mov r15b, 1
jmp case.0x14006c259.69
lea rcx, [rsi + 2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov dword [rbp - 0x71], eax
jmp case.0x14006c259.69
lea rcx, [rsi + 2]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
mov dword [rbp - 0x6d], eax
jmp case.0x14006c259.69
mov r12b, 1
mov rsi, qword [rbp - 0x59]
mov rdx, rdi
mov rcx, rsi
call fcn.1400decb0
mov r14, rax
test rax, rax
jne 0x14006c48c
xor eax, eax
mov dword [rbp - 0x39], 0
xorps xmm0, xmm0
mov qword [rbp - 0x15], rax
mov byte [rbp - 0x11], 1
movups xmmword [rbp - 0x35], xmm0
mov dword [rbp - 0xd], eax
movups xmmword [rbp - 0x25], xmm0
movzx ebx, word [rdi]
cmp ebx, 0x20
je 0x14006c354
cmp ebx, 9
jne 0x14006c359
add rdi, r13
jmp 0x14006c347
mov ecx, ebx
test ebx, 0xffffff80
jne 0x14006c378
mov edx, r13d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__isctype]
test eax, eax
je 0x14006c378
mov eax, 0xffdf
and bx, ax
cmp bx, 0x58
jne 0x14006c3db
cmp word [rdi + 2], 0
lea rbx, [rdi + 2]
je 0x14006c3db
mov rcx, rbx
call fcn.14001eeb0
movzx edx, word [rbx]
mov dword [rbp - 0x39], eax
test dx, dx
je 0x14006c3db
mov r8d, SafeArrayAllocDescriptor
nop dword [rax]
nop word [rax + rax]
lea rcx, [0x140110770]
movzx eax, r8w
nop dword [rax + rax]
cmp dx, ax
je 0x14006c401
add rcx, r13
movzx eax, word [rcx]
test ax, ax
jne 0x14006c3c0
add rbx, r13
movzx edx, word [rbx]
test dx, dx
jne 0x14006c3b0
mov rcx, qword [rbp + 0x47]
mov dl, 1
call fcn.140063df0
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
test rbx, rbx
je 0x14006c3db
add rbx, r13
movzx ecx, word [rbx]
cmp cx, r8w
je 0x14006c406
cmp cx, 9
je 0x14006c406
test cx, cx
je 0x14006c3db
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towupper]
cmp ax, 0x59
jne 0x14006c3db
cmp word [rbx + 2], 0
lea rcx, [rbx + 2]
je 0x14006c3db
call fcn.14001eeb0
lea rdx, [rbp - 9]
mov dword [rbp - 0x35], eax
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 9]
lea r8, [rbp - 0x39]
add dword [rbp - 0x39], eax
lea rdx, [0x1400749b0]
mov eax, dword [rbp - 5]
mov rcx, rsi
add dword [rbp - 0x35], eax
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rax, qword [rbp - 0x21]
lea rdx, [rbp - 0x71]
test rax, rax
mov r14, rsi
cmovne r14, rax
mov rax, qword [rbp - 0x39]
mov rcx, r14
mov qword [rbp - 0x71], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8d, dword [rbp + 0x57]
cmp r8d, 1
jl 0x14006c794
mov ecx, dword [rbp - 0x71]
cmp ecx, 0x80000000
je 0x14006c4af
mov eax, dword [rbp - 0x6d]
cmp eax, 0x80000000
jne 0x14006c4fb
lea rdx, [rbp - 0x49]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x14006c3db
mov ecx, dword [rbp - 0x71]
cmp ecx, 0x80000000
jne 0x14006c4df
mov eax, dword [rbp - 0x41]
sub eax, dword [rbp - 0x49]
cdq
sub eax, edx
sar eax, 1
mov ecx, eax
mov dword [rbp - 0x71], eax
mov eax, dword [rbp - 0x6d]
mov r8d, dword [rbp + 0x57]
cmp eax, 0x80000000
jne 0x14006c4fb
mov eax, dword [rbp - 0x3d]
sub eax, dword [rbp - 0x45]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp - 0x6d], eax
movzx edx, byte [rbp + 0x4f]
movzx r15d, ax
shl r15d, 0x10
movzx eax, cx
or r15, rax
lea eax, [rdx + 0x62]
cmp al, 1
lea eax, [rdx + 0x64]
setbe r13b
cmp al, 1
setbe sil
test r13b, r13b
je 0x14006c54e
mov edi, dword [rbp - 0x75]
cmp dl, 0x9f
mov eax, 0xffffff88
mov ecx, 0x78
cmove eax, ecx
mov ebx, 0x20a
imul eax, r8d
shl eax, 0x10
cdqe
mov qword [rbp - 0x69], rax
jmp 0x14006c607
test sil, sil
je 0x14006c57e
mov edi, dword [rbp - 0x75]
cmp dl, 0x9c
mov eax, 0xffffff88
mov ecx, 0x78
cmove ecx, eax
mov ebx, 0x20e
imul ecx, r8d
shl ecx, 0x10
movsxd rax, ecx
mov qword [rbp - 0x69], rax
jmp 0x14006c607
mov ecx, edx
sub ecx, 1
je 0x14006c5f5
sub ecx, 1
je 0x14006c5e9
sub ecx, 2
je 0x14006c5d5
sub ecx, 1
je 0x14006c5b9
cmp ecx, 1
jne 0x14006c3db
mov ebx, 0x20b
mov qword [rbp - 0x51], 0x20000
mov edi, 0x20c
mov qword [rbp - 0x69], 0x20040
jmp 0x14006c607
mov ebx, 0x20b
mov qword [rbp - 0x51], 0x10000
mov edi, 0x20c
mov qword [rbp - 0x69], 0x10020
jmp 0x14006c607
mov ebx, 0x207
mov qword [rbp - 0x69], reloc.WSOCK32.dll_recv
mov edi, 0x208
jmp 0x14006c607
mov ebx, 0x204
mov edi, 0x205
jmp 0x14006c607
mov ebx, 0x201
mov qword [rbp - 0x69], 1
mov edi, 0x202
mov byte [rbp - 0x79], 0
test r12b, r12b
je 0x14006c662
mov rcx, qword [rbp - 0x59]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x75], eax
mov r12d, eax
test eax, eax
je 0x14006c656
cmp eax, dword [0x140136030]
je 0x14006c656
mov rcx, qword [rbp - 0x59]
call fcn.1400df220
test al, al
jne 0x14006c656
mov ecx, dword [0x140136030]
mov r8d, 1
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [rbp - 0x79]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x14006c66a
mov r12d, dword [rbp - 0x75]
mov dword [rbp - 0x75], r12d
test r13b, r13b
jne 0x14006c733
test sil, sil
jne 0x14006c733
mov esi, dword [rbp + 0x57]
mov r13d, dword [rbp - 0x61]
mov r12, qword [rbp - 0x69]
cmp r13d, 1
je 0x14006c6da
mov r9, r15
mov r8, r12
mov edx, ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x14012f240]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14006c6d5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140136030], eax
mov rcx, qword [0x14012f240]
mov ecx, dword [rcx + 0x78]
je 0x14006c6cb
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006c6d5
mov edx, 1
call fcn.140001b00
test r13d, r13d
je 0x14006c723
mov r8, qword [rbp - 0x51]
mov r9, r15
mov edx, edi
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x14012f240]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14006c723
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140136030], eax
mov rcx, qword [0x14012f240]
mov ecx, dword [rcx + 0x78]
je 0x14006c719
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006c723
mov edx, 1
call fcn.140001b00
sub rsi, 1
jne 0x14006c687
mov r12d, dword [rbp - 0x75]
jmp 0x14006c77c
mov r8, qword [rbp - 0x69]
mov r9, r15
mov edx, ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x14012f240]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14006c77c
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140136030], eax
mov rcx, qword [0x14012f240]
mov ecx, dword [rcx + 0x78]
je 0x14006c772
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14006c77c
mov edx, 1
call fcn.140001b00
cmp byte [rbp - 0x79], 0
je 0x14006c794
mov ecx, dword [0x140136030]
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [0x140132a80]
lea rdx, [0x1400f98c8]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
jmp 0x14006c3e6