Function at 0x14012ed10
Capabilities:
Get graphical window text
Log keystrokes via application hook
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x98
mov rax, qword [0x1402a98a8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, r9
mov rdi, rcx
cmp edx, 0x110
ja 0x14012f0a0
je 0x14012ef63
cmp edx, 2
je 0x14012ef40
cmp edx, 0x2b
je 0x14012edc7
cmp edx, 0x4e
jne 0x14012f099
mov eax, dword [r9 + 0x10]
cmp eax, 0xffffff4f
je 0x14012ed9a
cmp eax, 0xfffffffb
je 0x14012ed74
cmp eax, 0xfffffffe
jne 0x14012f099
add rcx, 0x30
call fcn.14012eb60
mov rcx, qword [rdi + 0x18]
mov edx, 0x111
movsxd r9, eax
mov r8d, 0x993
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14012f11e
movsxd rax, dword [r9 + 0x1c]
imul rcx, rax, 0x38
add rcx, qword [rdi + 0x80]
cmp qword [rcx + 0x20], 8
lea rax, [rcx + 8]
jb 0x14012edb7
mov rax, qword [rax]
mov qword [r9 + 0x30], rax
mov eax, dword [rcx + 0x28]
mov dword [r9 + 0x3c], eax
jmp 0x14012f11e
movsxd rax, dword [r9 + 8]
movups xmm0, xmmword [r9 + 0x28]
mov qword [rsp + 0xc8], rbp
mov rbp, qword [r9 + 0x20]
imul rcx, rax, 0x38
movups xmmword [rsp + 0x38], xmm0
mov rax, qword [rdi + 0x80]
mov qword [rsp + 0x90], r12
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x80], r14
lea r14, [rax + 8]
add r14, rcx
cmp qword [r14 + 0x18], 8
jb 0x14012ee15
mov r14, qword [r14]
mov r13d, dword [rcx + rax + 0x28]
lea r9, [0x1401e627c]
mov rcx, qword [rdi + 0x48]
xor r8d, r8d
mov edx, 0x1057
call qword [sym.imp.USER32.dll_SendMessageW]
mov esi, 1
mov qword [rsp + 0x30], rax
mov r15d, 0x404040
lea r12d, [rsi + 3]
test byte [rbx + 0x10], sil
je 0x14012ee60
mov rdx, qword [rdi + 0x60]
xor r15d, r15d
mov rcx, rbp
mov r12d, esi
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [rdi + 0x48]
xor r9d, r9d
mov r8, rsi
mov edx, 0x1002
call qword [sym.imp.USER32.dll_SendMessageW]
lea r8, [rsp + 0x48]
mov edx, r13d
mov rcx, rax
mov rbx, rax
call qword [sym.imp.COMCTL32.dll_ImageList_GetImageInfo]
mov r8d, dword [rsp + 0x64]
mov rcx, rbx
sub r8d, dword [rsp + 0x6c]
sub r8d, dword [rsp + 0x3c]
mov r9d, dword [rsp + 0x38]
mov eax, dword [rsp + 0x44]
mov rdi, qword [rsp + 0x30]
inc eax
add eax, r8d
mov dword [rsp + 0x28], r12d
cdq
add r9d, edi
sub eax, edx
mov dword [rsp + 0x38], r9d
sar eax, 1
mov r8, rbp
mov dword [rsp + 0x64], eax
mov edx, r13d
add eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
call qword [sym.imp.COMCTL32.dll_ImageList_Draw]
lea eax, [rdi + rdi]
mov edx, r15d
sub eax, dword [rsp + 0x60]
mov rcx, rbp
add eax, dword [rsp + 0x68]
add dword [rsp + 0x38], eax
call qword [sym.imp.GDI32.dll_SetTextColor]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r9, [rsp + 0x38]
mov dword [rsp + 0x20], 0x24
mov r8d, eax
mov rdx, r14
mov rcx, rbp
call qword [sym.imp.USER32.dll_DrawTextW]
mov r14, qword [rsp + 0x80]
mov rax, rsi
mov r13, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0xc8]
jmp 0x14012f123
mov rax, qword [rcx + 0x30]
add rcx, 0x30
call qword [rax + InitCommonControls]
mov rcx, qword [rdi + 0xb0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
dec dword [0x1402c04f8]
jmp 0x14012f11e
lea r8, [rcx + 0x80]
xor r9d, r9d
mov rcx, qword [rcx + 0x10]
mov edx, 0x2341
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x88]
movabs rax, 0x4924924924924925
sub rcx, qword [rdi + 0x80]
mov esi, 1
mov r9, qword [rdi + 0xa0]
imul rcx
mov rcx, 0xffffffffffffffff
mov r8, rdx
sar r8, 4
mov rax, r8
shr rax, 0x3f
add r8, rax
cmp byte [rdi + 0xa8], 0
cmove ecx, esi
add ecx, dword [rdi + 0x98]
lea eax, [r8 - 1]
mov edx, eax
cmovns edx, ecx
xor r15d, r15d
cmp edx, eax
lea rcx, [rdi + 0x30]
cmovle r15d, edx
mov rdx, qword [rdi + 8]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r8d
mov r8, qword [rdi + 0x18]
call fcn.14012e590
call fcn.14000c990
lea r8d, [rsi + 0x5f]
lea ecx, [rsi + 0xd]
mov edx, dword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, eax
lea rdx, str.Verdana
lea rcx, [rdi + 0x30]
call fcn.14012ea10
lea rdx, [rsp + 0x38]
lea rcx, [rdi + 0x30]
call fcn.14012e370
lea rdx, [rdi + 0x20]
mov rcx, rdi
movups xmm0, xmmword [rax]
mov rax, qword [rdi]
movups xmmword [rdx], xmm0
call qword [rax + 0x20]
mov rcx, rdi
call fcn.14012b9b0
mov rax, qword [rdi + 0x30]
lea rcx, [rdi + 0x30]
movzx edx, sil
call qword [rax + 0x18]
mov rax, qword [rdi + 0x18]
mov qword [0x1402c0500], rax
call fcn.14000c990
mov r8, qword [rdi + 8]
lea ecx, [rsi + 0xd]
xor r9d, r9d
mov edx, dword [rax + 0x33384]
mov dword [0x1402c04fc], edx
lea rdx, [0x14012ec50]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rdi + 0xb0], rax
mov qword [0x1402c0508], rax
xor eax, eax
jmp 0x14012f123
sub edx, 0x111
je 0x14012f0e1
sub edx, 0xf4
je 0x14012f0c6
cmp edx, 5
jne 0x14012f099
mov rcx, qword [rcx + 0x48]
mov edx, 0x20a
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14012f11e
movsxd r9, dword [rcx + 0x6c]
mov edx, 0x111
mov rcx, qword [rcx + 0x18]
mov r8d, 0x993
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14012f11e
cmp r8, 0x993
jne 0x14012f099
mov rax, qword [rdi + 0x80]
mov edx, 0x804
imul rcx, rbx, 0x38
movsxd r9, dword [rcx + rax + 4]
movsxd r8, dword [rcx + rax]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rdi + 0x18]
mov rdx, 0xffffffffffffffff
call qword [sym.imp.USER32.dll_EndDialog]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401813e0
add rsp, 0x98
pop r15
pop rdi
pop rsi
pop rbx
ret