Function at 0x140150360
Capabilities:
Log keystrokes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2f0
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14039e2e8]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov r15, rcx
test dl, dl
jne 0x140150456
call fcn.14015a5f0
movaps xmm6, xmm0
call fcn.14016b790
mov eax, eax
xorps xmm1, xmm1
cvtsi2sd xmm1, rax
divsd xmm1, qword [0x1402d4d48]
comisd xmm1, xmm6
jbe 0x140150456
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov rbx, rax
call fcn.14016b790
mov ecx, eax
xorps xmm6, xmm6
cvtsi2sd xmm6, rcx
divsd xmm6, qword [0x1402d4d48]
call fcn.14015a5f0
movaps xmm3, xmm6
movq r9, xmm6
movaps xmm2, xmm0
movq r8, xmm0
lea rdx, str.Not_Idle_for_long_enough__IdleTime:__f__MinIdle__f
lea rcx, [rsp + 0x50]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, SafeArrayCopy
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x1401507cd
mov byte [r15 + 0x11], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
call fcn.14016e770
test eax, eax
je 0x140150497
mov dword [rsp + 0x70], 0x48
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rsp + 0x70]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x1401504f5
mov rsi, qword [rbp - 0x80]
jmp 0x1401504e7
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, 1
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x1401504f5
call qword [sym.imp.USER32.dll_GetFocus]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, eax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor r8d, r8d
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
test rsi, rsi
je 0x1401504f5
test rdi, rdi
cmove rdi, rsi
jmp 0x140150501
test rdi, rdi
je 0x1401507a4
mov rsi, rdi
mov rcx, rsi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401507a4
test rdi, rdi
je 0x1401507a4
mov rcx, rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1401507a4
mov rdx, rdi
mov rcx, r15
call fcn.14014fb00
test al, al
jne 0x140150783
mov rdx, rsi
mov rcx, r15
call fcn.14014fb00
test al, al
jne 0x140150783
mov rcx, rsi
call fcn.14015a800
test al, al
jne 0x1401506bb
mov rcx, rdi
call fcn.14015a800
test al, al
jne 0x1401506bb
mov r8d, SerializeElements<ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__15]
nop
lea rdx, str.Progman
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_Ordinal_2903]
nop
test eax, eax
jne 0x1401505b1
mov byte [r15 + 0x11], 1
mov qword [r15 + 8], rsi
mov qword [r15], rdi
mov byte [r15 + 0x10], 0
lea rcx, [0x1403c4350]
call fcn.14010c060
test rax, rax
je 0x1401505e4
lea rcx, [0x1403c4350]
call fcn.14010c060
mov dl, 1
mov rcx, rax
call fcn.1401905b0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x60], rax
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r14, rax
call fcn.14015a5f0
movaps xmm6, xmm0
mov rsi, qword [r15 + 8]
mov r8, rsi
lea rdx, [rsp + 0x40]
mov rcx, r15
call fcn.140150910
nop
mov rbx, qword [rax]
mov rdi, qword [r15]
mov r8, rdi
lea rdx, [rsp + 0x58]
mov rcx, r15
call fcn.140150910
nop
movsd qword [rsp + 0x38], xmm6
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, qword [rax]
lea rdx, str.TargetActiveWindow_Active:__s___d___Focus:__s___d___FromHook__d__IdleTime:__f
lea rcx, [rsp + 0x48]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, 0x64
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov al, 1
jmp 0x1401507cf
cmp byte [r15 + 0x10], 0
jne 0x14015077c
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r14, rax
mov rsi, qword [r15 + 8]
mov r8, rsi
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.140150910
nop
mov rbx, qword [rax]
mov rdi, qword [r15]
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.140150910
nop
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rbx
mov r9, rdi
mov r8, qword [rax]
lea rdx, str.Ditto_has_focus___Active:__s___d___Focus:__s___d___FromHook__d
lea rcx, [rsp + 0x58]
call fcn.14015b330
nop
mov rcx, rax
call qword [sym.imp.mfc140u.dll_CDumpContext::operator___3]
nop
mov r9d, 0x4e
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.14015b6c0
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov byte [r15 + 0x10], 1
jmp 0x1401507cd
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x46
lea rcx, str.TargetActiveWindow_shell_tray_icon_has_active
jmp 0x1401507c3
lea rdx, [0x1402d4570]
lea rcx, [rsp + 0x40]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__14]
mov r9d, 0x40
lea rcx, str.TargetActiveWindow_values_invalid
mov r8, rax
xor edx, edx
call fcn.14015b6c0
xor al, al
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1402654f0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret