Function at 0x1800024d0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rcx
cmp edx, 0x111
je 0x1800025e8
ja 0x180002520
cmp edx, 2
je 0x1800025c0
cmp edx, 0x110
jne 0x18000262a
mov rdx, r9
call sym.CredDialogInit
cdqe
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp edx, 0x113
mov eax, 0
jne 0x18000250e
cmp r8, 1
jne 0x18000250e
mov rcx, rbx
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, qword [rax + 0x48]
mov rsi, rax
test rcx, rcx
je 0x1800025da
pxor xmm0, xmm0
lea rdi, [rsp + 0x20]
xor r8d, r8d
mov edx, 0x411
movups xmmword [rsp + 0x24], xmm0
mov r9, rdi
mov qword [rsp + 0x28], rbx
mov rbx, qword [sym.imp.user32.dll_SendMessageW]
movups xmmword [rsp + 0x34], xmm0
movups xmmword [rsp + 0x44], xmm0
movups xmmword [rsp + 0x54], xmm0
mov dword [rsp + 0x64], 0
mov dword [rsp + 0x20], 0x48
call rbx
mov r9, rdi
xor r8d, r8d
mov edx, 0x411
mov qword [rsp + 0x30], 1
mov rcx, qword [rsi + 0x48]
call rbx
mov dword [rsi + 0x50], 0
jmp 0x1800025da
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, qword [rax + 0x48]
test rcx, rcx
je 0x1800025da
call qword [sym.imp.user32.dll_DestroyWindow]
mov eax, 1
jmp 0x18000250e
cmp r8, 0x1000066
je 0x180002640
ja 0x180002610
cmp r8, 1
je 0x180002668
cmp r8, 2
jne 0x18000262a
mov edx, 2
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x1800025da
cmp r8, 0x2000066
je 0x1800027c8
cmp r8, 0x3000066
je 0x180002533
xor eax, eax
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, 0x14
call qword [sym.imp.user32.dll_GetKeyState]
test al, 1
jne 0x180002810
mov ecx, 1
call qword [sym.imp.user32.dll_LockSetForegroundWindow]
jmp 0x1800025da
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov edx, 0x65
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.user32.dll_GetDlgItem]
mov r12, rax
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindowTextLengthW]
lea r13d, [rax + 1]
mov ebp, eax
mov r14, qword gs:[0x30]
mov rdx, qword [r14 + 0x60]
movsxd rax, r13d
lea r8, [rax + rax]
mov rcx, qword [rdx + 0x30]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r8d, r13d
mov rcx, r12
mov rdi, rax
mov rdx, rax
call qword [sym.imp.user32.dll_GetWindowTextW]
cmp word [rdi], 0
je 0x1800027f8
mov r12, qword [sym.imp.ucrtbase.dll_wcschr]
mov edx, 0x5c
mov rcx, rdi
call r12
test rax, rax
je 0x18000282e
mov edx, dword [rsi + 0x28]
test edx, edx
je 0x180002702
mov rax, qword [rsi + 0x20]
xor r8d, r8d
mov word [rax], r8w
mov edx, dword [rsi + 0x28]
mov rcx, qword [rsi + 0x20]
cmp word [rcx], 0
je 0x1800028b4
mov rax, rcx
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x180002718
sub rax, rcx
sar rax, 1
mov r12d, eax
sub edx, eax
cdqe
lea rcx, [rcx + rax*2]
cmp ebp, edx
cmovbe edx, ebp
mov r8d, edx
mov rdx, rdi
add r8, r8
call sym.memcpy
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x180002766
sub eax, 1
sub eax, r12d
cmp eax, ebp
cmova eax, ebp
xor ecx, ecx
lea edx, [rax + r12]
mov rax, qword [rsi + 0x20]
mov word [rax + rdx*2], cx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov r9d, dword [rsi + 0x38]
mov r8, qword [rsi + 0x30]
mov rcx, rbx
mov edx, 0x66
call qword [sym.imp.user32.dll_GetDlgItemTextW]
mov rcx, rbx
mov edx, 0x68
call qword [sym.imp.user32.dll_IsDlgButtonChecked]
mov edx, 1
mov rcx, rbx
cmp eax, 1
sete al
movzx eax, al
mov dword [rsi + 0x3c], eax
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x1800025da
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov ecx, 2
mov rsi, rax
call qword [sym.imp.user32.dll_LockSetForegroundWindow]
mov rcx, qword [rsi + 0x48]
test rcx, rcx
jne 0x180002551
jmp 0x1800025da
mov rax, qword [r14 + 0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1800025da
mov rcx, rbx
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, rbx
mov rdx, rax
call sym.CredDialogShowCapsLockBalloon
jmp 0x180002653
mov edx, 0x40
mov rcx, rdi
call r12
test rax, rax
jne 0x1800026ed
mov rdx, qword [rsi]
cmp word [rdx], 0
mov rax, rdx
je 0x180002858
add rax, 2
cmp word [rax], 0
jne 0x18000284e
mov r8d, dword [rsi + 0x28]
sub rax, rdx
mov rcx, qword [rsi + 0x20]
sar rax, 1
cmp eax, r8d
mov r12, rax
cmova eax, r8d
mov r8d, eax
add r8, r8
call sym.memcpy
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x28]
jae 0x180002892
mov rcx, qword [rsi + 0x20]
mov edx, r12d
mov word [rcx + rdx*2], 0x5c
mov edx, dword [rsi + 0x28]
add r12d, 2
cmp r12d, edx
jae 0x180002702
mov rdx, qword [rsi + 0x20]
mov word [rdx + rax*2], 0
mov edx, dword [rsi + 0x28]
jmp 0x180002702
xor r12d, r12d
jmp 0x180002733