Function at 0x180001d60
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
cmp edx, 0x111
je 0x180001e08
ja 0x180001db0
cmp edx, 2
je 0x180001de0
cmp edx, 0x110
jne 0x180001e4a
mov rdx, r9
call sym.CredDialogInit
cdqe
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp edx, 0x113
mov eax, 0
jne 0x180001d9a
cmp r8, 1
jne 0x180001d9a
mov rcx, rbx
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, rbx
mov rdx, rax
call sym.CredDialogHideBalloonTip
jmp 0x180001dfa
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, qword [rax + 0x48]
test rcx, rcx
je 0x180001dfa
call qword [sym.imp.user32.dll_DestroyWindow]
mov eax, 1
jmp 0x180001d9a
cmp r8, 0x1000066
je 0x180001e60
ja 0x180001e30
cmp r8, 1
je 0x180001e88
cmp r8, 2
jne 0x180001e4a
mov edx, 2
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x180001dfa
cmp r8, 0x2000066
je 0x180001fe8
cmp r8, 0x3000066
je 0x180001dc3
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, 0x14
call qword [sym.imp.user32.dll_GetKeyState]
test al, 1
jne 0x180002030
mov ecx, 1
call qword [sym.imp.user32.dll_LockSetForegroundWindow]
jmp 0x180001dfa
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov edx, 0x65
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.user32.dll_GetDlgItem]
mov r12, rax
mov rcx, rax
call qword [sym.imp.user32.dll_GetWindowTextLengthW]
lea r13d, [rax + 1]
mov ebp, eax
mov r14, qword gs:[0x30]
mov rdx, qword [r14 + 0x60]
movsxd rax, r13d
lea r8, [rax + rax]
mov rcx, qword [rdx + 0x30]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r8d, r13d
mov rcx, r12
mov rdi, rax
mov rdx, rax
call qword [sym.imp.user32.dll_GetWindowTextW]
cmp word [rdi], 0
je 0x180002018
mov r12, qword [sym.imp.ucrtbase.dll_wcschr]
mov edx, 0x5c
mov rcx, rdi
call r12
test rax, rax
je 0x18000204e
mov edx, dword [rsi + 0x28]
test edx, edx
je 0x180001f22
mov rax, qword [rsi + 0x20]
xor r8d, r8d
mov word [rax], r8w
mov edx, dword [rsi + 0x28]
mov rcx, qword [rsi + 0x20]
cmp word [rcx], 0
je 0x1800020d4
mov rax, rcx
nop dword [rax + rax]
add rax, 2
cmp word [rax], 0
jne 0x180001f38
sub rax, rcx
sar rax, 1
mov r12d, eax
sub edx, eax
cdqe
lea rcx, [rcx + rax*2]
cmp ebp, edx
cmovbe edx, ebp
mov r8d, edx
mov rdx, rdi
add r8, r8
call sym.memcpy
mov eax, dword [rsi + 0x28]
test eax, eax
je 0x180001f86
sub eax, 1
sub eax, r12d
cmp eax, ebp
cmova eax, ebp
xor ecx, ecx
lea edx, [rax + r12]
mov rax, qword [rsi + 0x20]
mov word [rax + rdx*2], cx
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
mov r9d, dword [rsi + 0x38]
mov r8, qword [rsi + 0x30]
mov rcx, rbx
mov edx, 0x66
call qword [sym.imp.user32.dll_GetDlgItemTextW]
mov rcx, rbx
mov edx, 0x68
call qword [sym.imp.user32.dll_IsDlgButtonChecked]
mov edx, 1
mov rcx, rbx
cmp eax, 1
sete al
movzx eax, al
mov dword [rsi + 0x3c], eax
call qword [sym.imp.user32.dll_EndDialog]
jmp 0x180001dfa
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov ecx, 2
mov rsi, rax
call qword [sym.imp.user32.dll_LockSetForegroundWindow]
mov rdx, rsi
mov rcx, rbx
call sym.CredDialogHideBalloonTip
jmp 0x180001dfa
mov rax, qword [r14 + 0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x180001dfa
mov rcx, rbx
mov edx, 0x10
call qword [sym.imp.user32.dll_GetWindowLongPtrW]
mov rcx, rbx
mov rdx, rax
call sym.CredDialogShowCapsLockBalloon
jmp 0x180001e73
mov edx, 0x40
mov rcx, rdi
call r12
test rax, rax
jne 0x180001f0d
mov rdx, qword [rsi]
cmp word [rdx], 0
mov rax, rdx
je 0x180002078
add rax, 2
cmp word [rax], 0
jne 0x18000206e
mov r8d, dword [rsi + 0x28]
sub rax, rdx
mov rcx, qword [rsi + 0x20]
sar rax, 1
cmp eax, r8d
mov r12, rax
cmova eax, r8d
mov r8d, eax
add r8, r8
call sym.memcpy
lea eax, [r12 + 1]
cmp eax, dword [rsi + 0x28]
jae 0x1800020b2
mov rcx, qword [rsi + 0x20]
mov edx, r12d
mov word [rcx + rdx*2], 0x5c
mov edx, dword [rsi + 0x28]
add r12d, 2
cmp r12d, edx
jae 0x180001f22
mov rdx, qword [rsi + 0x20]
mov word [rdx + rax*2], 0
mov edx, dword [rsi + 0x28]
jmp 0x180001f22
xor r12d, r12d
jmp 0x180001f53