Function at 0x140001870
Capabilities:
Get graphical window text
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rbp + 7], rax
cmp byte [0x140119eaa], 1
jne 0x140002196
cmp dword [0x140119eac], 0
jne 0x1400018c0
mov dword [0x140117d8c], 0x41
mov dword [reloc.WS2_32.dll_listen], 0xd
mov dword [reloc.WLDAP32.dll_Ordinal_50], 0x2e
call fcn.140053ea0
test al, al
je 0x1400021c5
call fcn.1400530a0
test al, al
je 0x1400021c5
mov qword [rsp + 0x110], rdi
xor ecx, ecx
mov qword [rsp + 0x118], r12
xor r12d, r12d
mov qword [rsp + 0xe8], r14
mov r14d, r12d
mov qword [rsp + 0x100], rbx
call qword [sym.imp.USER32.dll_GetTopWindow]
mov rdi, rax
test rax, rax
je 0x1400019ca
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0xe0], r15
lea r15, str.Rubinum
nop dword [rax + rax]
cmp r14d, 2
jge 0x1400019ba
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextLengthA]
test eax, eax
je 0x1400019a0
lea ebx, [rax + 1]
movsxd rcx, ebx
call fcn.1400aae70
mov r8d, ebx
mov rdx, rax
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rdx, r12
nop word [rax + rax]
movzx ecx, byte [rsi + rdx]
inc rdx
cmp cl, byte [r15 + rdx - 1]
jne 0x1400019a0
cmp rdx, 8
jne 0x140001970
mov edx, 1
mov rcx, rdi
inc r14d
call qword [sym.imp.USER32.dll_SwitchToThisWindow]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
mov rdi, rax
test rax, rax
jne 0x140001930
mov rsi, qword [rsp + 0x108]
mov r15, qword [rsp + 0xe0]
mov r9d, 0x514
mov r8b, 0x66
xor edx, edx
mov cl, 0x67
call fcn.140011570
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov edx, 0x28a
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140011570
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140119eb0], 1
mov r14, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0x110]
jne 0x140001b06
mov ecx, reloc.WS2_32.dll_select
xor edx, edx
lea r8d, [rcx - 9]
lea r9d, [rcx + 0x52]
call fcn.140011640
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
mov cl, 0x67
mov qword [rbp - 0x31], rax
movups xmmword [rbp - 0x51], xmm0
movups xmmword [rbp - 0x41], xmm0
call qword [sym.imp.USER32.dll_VkKeyScanA]
movzx ecx, al
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, Ordinal_45
mov dword [rbp - 0x51], 1
lea rdx, [rbp - 0x51]
mov dword [rbp - 0x45], 8
mov word [rbp - 0x47], ax
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
xor r9d, r9d
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov edx, 0x514
mov cl, 0x66
call fcn.140011570
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, Ordinal_45
mov dword [rbp - 0x45], 0xa
lea rdx, [rbp - 0x51]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov edx, 0x28a
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140011570
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, reloc.WS2_32.dll_select
xor edx, edx
lea r8d, [rcx - 9]
lea r9d, [rcx + 0x52]
call fcn.140011640
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x140011860]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r9d, reloc.WLDAP32.dll_Ordinal_27
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 - 0x1a]
call qword [sym.imp.USER32.dll_RegisterHotKey]
cmp byte [0x140119eaa], 1
jne 0x140002186
movaps xmmword [rsp + 0xd0], xmm6
movsd xmm6, qword [0x140101650]
movaps xmmword [rsp + 0xc0], xmm7
movsd xmm7, qword [0x140101648]
movaps xmmword [rsp + 0xb0], xmm8
movsd xmm8, qword [0x140101658]
nop word [rax + rax]
mov r9d, 0x312
mov dword [rsp + 0x20], 1
mov r8d, r9d
lea rcx, [rbp - 0x29]
xor edx, edx
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
jle 0x140001b9e
cmp dword [rbp - 0x21], 0x312
je 0x1400021ab
mov eax, dword [0x140119ebc]
cmp eax, 1
jne 0x140001c73
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
lea r8d, [rax + 0x20]
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimages_admin_message.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
mov r9d, 0xbe
movsd qword [rsp + 0x28], xmm6
mov edx, 0x4a6
mov dword [rsp + 0x20], 0x186
lea rcx, [rbp - 0x51]
lea r8d, [r9 - 0x78]
call fcn.14000fd10
test eax, eax
je 0x140001ce3
nop
shr rax, 0x20
test eax, eax
je 0x140001ce3
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
mov r8d, reloc.WLDAP32.dll_Ordinal_33
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimages_admin_message.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
mov r9d, 0xbe
movsd qword [rsp + 0x28], xmm6
mov edx, 0x4a6
mov dword [rsp + 0x20], 0x186
lea rcx, [rbp - 0x51]
lea r8d, [r9 - 0x78]
call fcn.14000fd10
test eax, eax
jne 0x140001c00
jmp 0x140001ce3
cmp eax, 2
jne 0x140001ce3
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
lea r8d, [rax + 0x1f]
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimages_admin_message.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
mov r9d, 0xbe
movsd qword [rsp + 0x28], xmm6
mov edx, 0x4a6
mov dword [rsp + 0x20], 0x186
lea rcx, [rbp - 0x51]
lea r8d, [r9 - 0x78]
call fcn.14000fd10
test eax, eax
je 0x140001ce3
shr rax, 0x20
test eax, eax
je 0x140001ce3
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x140119ec0]
cmp eax, 1
jne 0x140001db6
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
lea r8d, [rax + 0x21]
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimagesplayer_message.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
mov r9d, 0xbe
movsd qword [rsp + 0x28], xmm6
mov edx, 0x4a6
mov dword [rsp + 0x20], 0x186
lea rcx, [rbp - 0x51]
lea r8d, [r9 - 0x78]
call fcn.14000fd10
test eax, eax
je 0x140001e26
shr rax, 0x20
test eax, eax
je 0x140001e26
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
mov r8d, Ordinal_35
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimagesplayer_message.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
mov r9d, 0xbe
movsd qword [rsp + 0x28], xmm6
mov edx, 0x4a6
mov dword [rsp + 0x20], 0x186
lea rcx, [rbp - 0x51]
lea r8d, [r9 - 0x78]
call fcn.14000fd10
test eax, eax
jne 0x140001d43
jmp 0x140001e26
cmp eax, 2
jne 0x140001e26
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
lea r8d, [rax + 0x20]
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimagesplayer_message.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
mov r9d, 0xbe
movsd qword [rsp + 0x28], xmm6
mov edx, 0x4a6
mov dword [rsp + 0x20], 0x186
lea rcx, [rbp - 0x51]
lea r8d, [r9 - 0x78]
call fcn.14000fd10
test eax, eax
je 0x140001e26
shr rax, 0x20
test eax, eax
je 0x140001e26
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_MessageBeep]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x140119eb8], 1
jne 0x140001e9d
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimages_restart_here.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
movsd qword [rsp + 0x28], xmm7
lea rcx, [rbp - 0x51]
xor r9d, r9d
mov dword [rsp + 0x20], 0xbe
xor edx, edx
mov r8d, 0x140
call fcn.14000fd10
test eax, eax
je 0x140001e9d
shr rax, 0x20
test eax, eax
je 0x140001e9d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000f820
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x140001f20
xorps xmm0, xmm0
mov qword [rbp - 0x41], r12
mov r8d, Ordinal_30
mov qword [rbp - 0x39], r12
lea rdx, str.settingsimages_autospin.jpg
lea rcx, [rbp - 0x51]
movups xmmword [rbp - 0x51], xmm0
call fcn.1400012a0
mov edx, reloc.WS2_32.dll_WSAStartup
movsd qword [rsp + 0x28], xmm8
mov r9d, 0x276
mov dword [rsp + 0x20], Ordinal_45
lea rcx, [rbp - 0x51]
lea r8d, [rdx - 5]
call fcn.14000fd10
test eax, eax
je 0x140001f20
shr rax, 0x20
test eax, eax
je 0x140001f20
mov dword [rbp - 0x61], Ordinal_143
mov dword [rbp - 0x5d], 0x28a
mov rcx, qword [rbp - 0x61]
call fcn.1400114b0
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x140001f38
cmp dword [reloc.WS2_32.dll_ioctlsocket], r12d
je 0x140001fd4
jmp 0x140001f6e
cmp dword [reloc.WS2_32.dll_ioctlsocket], r12d
je 0x140001fcb
lea rcx, [0x14011a040]
call fcn.1400b1ee0
imul eax, dword [reloc.WS2_32.dll_ioctlsocket], 0x3c
mov rdx, qword [0x14011a040]
sub rdx, qword [0x14011a048]
movsxd rcx, eax
cmp rdx, rcx
jle 0x140001fcb
lea rcx, [0x14011a048]
call fcn.1400b1ee0
call fcn.14000fac0
cmp byte [0x140119eb0], 1
jne 0x140001fcb
mov r9d, 0x64
xor edx, edx
lea r8d, [r9 - 0x5b]
lea ecx, [rdx + 0x12]
call fcn.140011640
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000fac0
mov r9d, 0x64
xor edx, edx
lea r8d, [r9 - 0x5b]
lea ecx, [rdx + 0x12]
call fcn.140011640
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x140001ff2
cmp dword [reloc.WLDAP32.dll_Ordinal_60], r12d
je 0x1400020c1
lea rcx, [0x14011a058]
call fcn.1400b1ee0
jmp 0x1400020c1
cmp dword [reloc.WLDAP32.dll_Ordinal_60], r12d
je 0x1400020c1
lea rcx, [0x14011a050]
call fcn.1400b1ee0
imul eax, dword [reloc.WLDAP32.dll_Ordinal_60], 0x3c
mov rdx, qword [0x14011a050]
sub rdx, qword [0x14011a058]
movsxd rcx, eax
cmp rdx, rcx
jle 0x1400020c1
lea rcx, [0x14011a058]
call fcn.1400b1ee0
mov dword [rbp - 0x59], reloc.WLDAP32.dll_Ordinal_50
mov dword [rbp - 0x55], 0x267
mov rbx, qword [rbp - 0x59]
mov rcx, rbx
call fcn.1400114b0
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000f820
cmp byte [0x140119eb0], 1
jne 0x1400020c1
mov ecx, reloc.WS2_32.dll_select
xor edx, edx
lea r8d, [rcx - 9]
lea r9d, [rcx + 0x52]
call fcn.140011640
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.1400114b0
mov ecx, Ordinal_301
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.14000f820
mov ecx, reloc.WS2_32.dll_select
xor edx, edx
lea r8d, [rcx - 9]
lea r9d, [rcx + 0x52]
call fcn.140011640
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [reloc.WS2_32.dll_accept]
cmp eax, 1
jne 0x1400020e3
lea r8, [0x14011a018]
lea rdx, [0x14011a028]
lea rcx, [0x140119ea8]
jmp 0x1400020fd
cmp eax, 2
jne 0x140002108
lea r8, [0x14011a010]
lea rdx, [0x14011a020]
lea rcx, [0x140119ea9]
call fcn.1400013a0
mov eax, dword [reloc.WS2_32.dll_accept]
cmp byte [0x140119eb0], 1
jne 0x140002150
cmp eax, 1
jne 0x140002122
mov dword [reloc.WS2_32.dll_accept], 2
jmp 0x140002131
cmp eax, 2
jne 0x140002131
mov dword [reloc.WS2_32.dll_accept], 1
mov ecx, reloc.WS2_32.dll_select
xor edx, edx
lea r8d, [rcx - 9]
lea r9d, [rcx + 0x52]
call fcn.140011640
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [reloc.WS2_32.dll_accept], 1
jne 0x140002160
mov byte [reloc.WS2_32.dll_accept], r12b
cmp byte [0x140119eaa], 1
je 0x140001b70
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm6, xmmword [rsp + 0xd0]
movaps xmm8, xmmword [rsp + 0xb0]
mov rbx, qword [rsp + 0x100]
mov r12, qword [rsp + 0x118]
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.1400aaba0
add rsp, 0xf0
pop rbp
ret
lea rcx, [0x140117e20]
call fcn.14000a5d0
mov rcx, rax
call fcn.1400117a0
call fcn.1400b62a0
int3
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.License_Expired
lea rdx, str.Your_license_expired.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.1400b62a0
int3