Function at 0x14009b110
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa0
mov rcx, rdx
mov rbx, r9
mov rsi, r8
call fcn.140036a30
mov r15d, eax
test eax, eax
je 0x14009b609
mov rdx, qword [rbp + 0x7f]
mov r9, qword [rbp + 0x77]
mov r8, qword [rbp + 0x6f]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbp + 0x67]
call fcn.14007d8c0
mov r14, rax
test rax, rax
je 0x14009b609
mov rdx, rbx
mov rcx, rax
call fcn.1400decb0
mov rdi, rax
test rax, rax
je 0x14009b609
mov r13d, dword gs:[0x48]
lea eax, [r15 - 1]
cmp eax, 0x10
ja case.default.0x14009b1b9
movsxd rcx, eax
lea rax, [0x140000000]
mov edx, dword [rax + rcx*4 + 0x9b9fc]
add rdx, rax
jmp rdx
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov edx, 0xf0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
xor ebx, ebx
cmp r15d, 1
mov eax, ebx
sete al
cmp qword [rbp - 0x49], rax
je case.default.0x14009b1b9
xor edx, edx
mov rcx, r14
xor r12b, r12b
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r15d, eax
test eax, eax
je 0x14009b24a
cmp eax, dword [0x140136030]
je 0x14009b24a
mov rcx, r14
call fcn.1400df220
test al, al
jne 0x14009b24a
mov ecx, dword [0x140136030]
mov r8d, 1
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
cmp r14, rdi
jne 0x14009b295
mov r14d, 0xfffffff0
mov rcx, rdi
mov edx, r14d
mov rsi, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x14009b298
nop word [rax + rax]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x14009b298
mov edx, r14d
mov rcx, rax
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x14009b270
jmp 0x14009b298
mov rsi, r14
mov rcx, rsi
call qword [sym.imp.USER32.dll_SetActiveWindow]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x14009b2c5
mov qword [rbp - 0x35], rbx
mov ecx, ebx
mov r8d, ebx
mov dword [rbp - 0x39], ebx
mov eax, ebx
mov dword [rbp - 0x2d], ebx
jmp 0x14009b2d2
mov eax, dword [rbp - 0x2d]
mov ecx, dword [rbp - 0x31]
mov ebx, dword [rbp - 0x35]
mov r8d, dword [rbp - 0x39]
sub eax, ebx
sub ecx, r8d
cdq
mov r8d, 1
sub eax, edx
sar eax, 1
movzx ebx, ax
mov eax, ecx
cdq
shl rbx, 0x10
sub eax, edx
mov edx, 0x201
sar eax, 1
movzx ecx, ax
or rbx, rcx
mov rcx, rdi
mov r9, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, rbx
xor r8d, r8d
mov edx, 0x202
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
test r12b, r12b
je case.default.0x14009b1b9
mov ecx, dword [0x140136030]
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp case.default.0x14009b1b9
mov edx, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x14009b1b9
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x14009b1b9
mov edx, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x14009b1b9
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x14009b1b9
cmp word [rsi], 0
jne 0x14009b391
mov eax, 1
jmp 0x14009b614
cmp r15d, 7
mov r12d, 0xffffffec
mov r14d, 0xfffffff0
mov rcx, rdi
cmove r12d, r14d
mov edx, r12d
call qword [sym.imp.USER32.dll_GetWindowLongW]
movzx edx, word [rsi]
lea rcx, [0x1401190a0]
mov r14d, eax
call qword [sym.imp.VCRUNTIME140.dll_wcschr]
test rax, rax
jne 0x14009b3d6
mov rcx, rsi
call fcn.140005d80
mov rbx, rax
jmp 0x14009b40a
lea rcx, [rsi + 2]
call fcn.140005d80
movzx ecx, word [rsi]
cmp cx, 0x2b
je 0x14009b405
cmp cx, 0x2d
je 0x14009b3fe
cmp cx, 0x5e
jne 0x14009b3f9
xor eax, r14d
jmp 0x14009b408
mov ebx, dword [rbp - 0x49]
jmp 0x14009b40a
not eax
and eax, r14d
jmp 0x14009b408
or eax, r14d
mov ebx, eax
cmp ebx, r14d
je 0x14009b45e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, ebx
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x14009b438
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009b609
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, r14d
je 0x14009b609
xor edx, edx
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [0x140132a80]
lea rdx, [0x1400f98c8]
xor r9d, r9d
mov byte [rsp + 0x20], 1
mov r8, 0xffffffffffffffff
call fcn.1400dc860
jmp 0x14009b614
xor ebx, ebx
mov edx, 0x14f
cmp r15d, 9
sete bl
xor r9d, r9d
mov r8, rbx
jmp 0x14009b98e
cmp word [rsi], 0
je 0x14009b4de
mov rcx, rsi
call fcn.14001eeb0
mov ecx, 0x25
mov r14d, eax
cmp r15d, 0xb
mov ebx, 0x27
cmove ebx, ecx
xor edx, edx
movzx ecx, bl
call fcn.140026220
movzx ecx, ax
shl ecx, 0x10
movsxd r15, ecx
test r14d, r14d
jle case.default.0x14009b1b9
jmp 0x14009b508
mov ecx, 0x25
mov r14d, 1
cmp r15d, 0xb
mov ebx, 0x27
cmove ebx, ecx
xor edx, edx
movzx ecx, bl
call fcn.140026220
movzx eax, ax
shl eax, 0x10
movsxd r15, eax
mov r12, r15
movzx esi, bl
mov eax, 0xc0000001
or r12, 1
or r15, rax
xor ebx, ebx
nop dword [rax]
mov r9, r12
mov r8, rsi
mov edx, 0x100
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
mov dword [0x14012f234], ebx
cmp dword [0x140136030], r13d
je 0x14009b54d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14009b557
mov edx, 1
call fcn.140001b00
mov r9, r15
mov dword [0x14012f234], 1
mov r8, rsi
mov edx, 0x101
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
sub r14, 1
jne 0x14009b520
jmp case.default.0x14009b1b9
cmp word [rbx], 0
jne 0x14009b59d
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b5b8
mov edx, 0x143
jmp 0x14009b5d1
lea rdx, str.List
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b609
mov edx, 0x180
lea rax, [rbp - 0x49]
mov r9, rsi
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
cmp qword [rbp - 0x49], 0xfffffffffffffffd
jbe case.default.0x14009b1b9
mov rcx, qword [rbp + 0x47]
mov dl, 1
call fcn.140063df0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp word [rsi], 0
je 0x14009b609
mov rcx, rsi
call fcn.14001eeb0
mov esi, eax
sub esi, 1
js 0x14009b609
cmp word [rbx], 0
jne 0x14009b667
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b682
mov edx, 0x144
jmp 0x14009b69f
lea rdx, str.List
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b609
mov edx, 0x182
lea rax, [rbp - 0x49]
movsxd r8, esi
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
cmp qword [rbp - 0x49], 0xffffffffffffffff
jmp 0x14009b9b3
cmp word [rsi], 0
je 0x14009b609
mov rcx, rsi
call fcn.14001eeb0
mov esi, eax
sub esi, 1
js 0x14009b609
cmp word [rbx], 0
jne 0x14009b714
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b73d
mov edx, 0x14e
movsxd r8, esi
mov ebx, 9
xor r9d, r9d
jmp 0x14009b7ee
lea rdx, str.List
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b609
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov ebx, 2
movsxd r8, esi
and eax, 0x808
mov ecx, eax
neg ecx
sbb edx, edx
add edx, 0x186
test eax, eax
je 0x14009b735
lea rax, [rbp - 0x49]
mov r9, r8
mov qword [rsp + 0x30], rax
mov edx, 0x185
mov dword [rsp + 0x28], 0x7d0
mov r8d, 1
mov dword [rsp + 0x20], ebx
jmp 0x14009b807
cmp word [rbx], 0
jne 0x14009b7c2
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rbx, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b8b7
mov edx, 0x14d
mov ebx, 9
mov r9, rsi
mov r8, 0xffffffffffffffff
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
cmp qword [rbp - 0x49], 0xffffffffffffffff
je 0x14009b609
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rsi, rax
test rax, rax
je 0x14009b609
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov r14d, eax
test eax, eax
jne 0x14009b85f
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14009b609
lea rax, [rbp - 0x49]
movzx r14d, r14w
mov qword [rsp + 0x30], rax
mov r8d, r14d
bts r8, 0x10
mov dword [rsp + 0x28], 0x7d0
mov r9, rdi
mov dword [rsp + 0x20], 2
mov edx, 0x111
mov rcx, rsi
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
shl ebx, 0x10
mov r9, rdi
mov r8d, ebx
mov edx, 0x111
or r8, r14
mov rcx, rsi
jmp 0x14009b991
lea rdx, str.List
mov rcx, rbx
call fcn.1400d6b70
test rax, rax
je 0x14009b609
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, 0x18f
mov ecx, 0x18c
test eax, 0x808
mov ebx, 2
cmove edx, ecx
je 0x14009b7e4
lea rax, [rbp - 0x41]
mov r9, rsi
mov qword [rsp + 0x30], rax
mov edx, 0x18f
mov dword [rsp + 0x28], 0x7d0
mov r8, 0xffffffffffffffff
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
mov r9, qword [rbp - 0x41]
cmp r9, 0xffffffffffffffff
je 0x14009b609
lea rax, [rbp - 0x49]
mov edx, 0x185
mov qword [rsp + 0x30], rax
mov r8d, 1
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
cmp qword [rbp - 0x49], 0xffffffffffffffff
jne 0x14009b824
jmp 0x14009b609
mov r9, rsi
mov edx, 0xc2
mov r8d, 1
mov rcx, rdi
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x14009b609
mov rax, qword [0x14012f240]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14009b45e
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x140136030], eax
mov rcx, qword [0x14012f240]
mov ecx, dword [rcx + 0x78]
je 0x14009b9ed
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14009b45e
mov edx, 1
call fcn.140001b00
jmp 0x14009b45e