Function at 0x140104570
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
lea rdi, [rsp + 0x30]
mov ecx, reloc.WSOCK32.dll_ioctlsocket
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x70]
mov byte [rsp + 0x54], 0
cmp qword [rsp + 0x70], 0
jne 0x1401045a4
xor eax, eax
jmp 0x1401048d9
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rsp + 0x30], eax
mov eax, dword [0x1403219e8]
cmp dword [rsp + 0x30], eax
je 0x1401045d9
mov rcx, qword [rsp + 0x70]
call fcn.140103830
movzx eax, al
test eax, eax
je 0x1401045d9
xor eax, eax
jmp 0x1401048d9
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x140104603
mov edx, 9
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x70], rax
jne 0x140104619
mov rax, qword [rsp + 0x70]
jmp 0x1401048d9
movzx eax, byte [0x140321530]
test eax, eax
jne 0x14010464a
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1401023e0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x14010464a
mov rax, qword [rsp + 0x40]
jmp 0x1401048d9
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0
cmp qword [rsp + 0x38], 0
je 0x14010478c
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov byte [rsp + 0x54], 1
mov dword [rsp + 0x4c], eax
cmp byte [rsp + 0x54], 0
jne 0x140104689
lea rcx, str.fore_thread
call fcn.1401352a0
cmp dword [rsp + 0x4c], 0
je 0x140104708
cmp byte [rsp + 0x54], 0
jne 0x1401046a3
lea rcx, str.fore_thread
call fcn.1401352a0
mov eax, dword [rsp + 0x4c]
cmp dword [0x1403219e8], eax
je 0x140104708
mov rcx, qword [rsp + 0x38]
call fcn.140103830
movzx eax, al
test eax, eax
jne 0x140104708
cmp byte [rsp + 0x54], 0
jne 0x1401046d3
lea rcx, str.fore_thread
call fcn.1401352a0
mov r8d, 1
mov edx, dword [rsp + 0x4c]
mov ecx, dword [0x1403219e8]
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x1401046f7
mov dword [rsp + 0x58], 1
jmp 0x1401046ff
mov dword [rsp + 0x58], 0
movzx eax, byte [rsp + 0x58]
mov byte [rsp + 0x48], al
cmp byte [rsp + 0x54], 0
jne 0x14010471b
lea rcx, str.fore_thread
call fcn.1401352a0
cmp dword [rsp + 0x4c], 0
je 0x14010478c
cmp dword [rsp + 0x30], 0
je 0x14010478c
cmp byte [rsp + 0x54], 0
jne 0x14010473c
lea rcx, str.fore_thread
call fcn.1401352a0
mov eax, dword [rsp + 0x30]
cmp dword [rsp + 0x4c], eax
je 0x14010478c
cmp byte [rsp + 0x54], 0
jne 0x140104759
lea rcx, str.fore_thread
call fcn.1401352a0
mov r8d, 1
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x4c]
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x14010477b
mov dword [rsp + 0x5c], 1
jmp 0x140104783
mov dword [rsp + 0x5c], 0
movzx eax, byte [rsp + 0x5c]
mov byte [rsp + 0x49], al
mov dword [rsp + 0x50], 0
jmp 0x1401047a0
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 5
jge 0x140104805
movzx eax, byte [0x140321530]
cmp dword [rsp + 0x50], eax
jne 0x1401047e5
movzx eax, byte [0x140325ade]
test eax, eax
jne 0x1401047e5
mov byte [0x140325ade], 1
mov dword [rsp + 0x28], 0xffc3d450
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov ecx, 1
call fcn.1400376b0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1401023e0
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
je 0x140104803
jmp 0x140104805
jmp 0x140104796
cmp qword [rsp + 0x40], 0
jne 0x14010485f
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov ecx, 2
call fcn.1400376b0
mov dword [rsp + 0x28], 0xffc3d44d
mov byte [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov ecx, 2
call fcn.1400376b0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1401023e0
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x14010488e
cmp byte [rsp + 0x54], 0
jne 0x14010487b
lea rcx, str.fore_thread
call fcn.1401352a0
xor r8d, r8d
mov edx, dword [rsp + 0x4c]
mov ecx, dword [0x1403219e8]
call qword [sym.imp.USER32.dll_AttachThreadInput]
movzx eax, byte [rsp + 0x49]
test eax, eax
je 0x1401048bb
cmp byte [rsp + 0x54], 0
jne 0x1401048aa
lea rcx, str.fore_thread
call fcn.1401352a0
xor r8d, r8d
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x4c]
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp qword [rsp + 0x40], 0
je 0x1401048d7
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, qword [rsp + 0x40]
jmp 0x1401048d9
xor eax, eax
add rsp, 0x60
pop rdi
ret