Function at 0x140028bb0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
push rdi
mov eax, 0x4260
call fcn.1400a5130
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x4278], rbx
mov qword [rsp + 0x4280], rsi
mov rax, qword [0x14014dcf0]
xor rax, rsp
mov qword [rsp + 0x4250], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rax, str.PASSWORD_OR_KEYFILE_WRONG
lea rcx, str.PASSWORD_WRONG
cmp dword [0x140196f54], esi
cmovne rcx, rax
call fcn.14003a7b0
mov r8, rax
mov edx, 0x4000
lea rcx, [rsp + 0x250]
call section..text
lea ecx, [rsi + 0x14]
call qword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0x2000
test al, 1
je 0x140028cc4
lea rcx, str.PASSWORD_WRONG_CAPSLOCK_ON
call fcn.14003a7b0
mov r11, rax
mov edx, edi
lea rcx, [rsp + 0x250]
nop dword [rax]
cmp word [rcx], si
je 0x140028c70
add rcx, 2
dec rdx
jne 0x140028c60
jmp 0x140028cc4
test rdx, rdx
je 0x140028cc4
mov r8, rdi
sub r8, rdx
mov rcx, rdi
sub rcx, r8
lea rax, [rsp + r8*2 + 0x250]
je 0x140028cbd
lea rdx, [rcx + r8 + 0x7fffdfff]
sub r11, rax
test rdx, rdx
je 0x140028cb8
movzx r8d, word [r11 + rax]
test r8w, r8w
je 0x140028cb8
mov word [rax], r8w
add rax, 2
dec rdx
dec rcx
jne 0x140028c96
jmp 0x140028cbd
test rcx, rcx
jne 0x140028cc1
sub rax, 2
mov word [rax], si
mov word [rsp + 0x40], si
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x42]
call fcn.1400a4ea0
mov edx, 0x40a
mov rcx, qword [0x140196ee0]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
mov r8d, 0x105
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, [rsp + 0x40]
call fcn.14004e5d0
test eax, eax
je 0x140028def
lea rax, str.PASSWORD_OR_KEYFILE_OR_MODE_WRONG
lea rcx, str.PASSWORD_OR_MODE_WRONG
cmp dword [0x140196f54], esi
cmovne rcx, rax
call fcn.14003a7b0
mov r8, rax
mov edx, 0x4000
lea rcx, [rsp + 0x250]
call section..text
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140028d75
lea rcx, str.PASSWORD_WRONG_CAPSLOCK_ON
call fcn.14003a7b0
mov r8, rax
mov edx, 0x4000
lea rcx, [rsp + 0x250]
call fcn.1400012f0
lea rcx, str.SYSENC_MOUNT_WITHOUT_PBA_NOTE
call fcn.14003a7b0
mov r11, rax
mov rdx, rdi
lea rcx, [rsp + 0x250]
nop
cmp word [rcx], si
je 0x140028da0
add rcx, 2
dec rdx
jne 0x140028d90
jmp 0x140028def
test rdx, rdx
je 0x140028def
mov rcx, rdi
sub rcx, rdx
sub rdi, rcx
lea rax, [rsp + rcx*2 + 0x250]
je 0x140028de8
lea rcx, [rdi + rcx + 0x7fffdfff]
sub r11, rax
test rcx, rcx
je 0x140028de3
movzx edx, word [r11 + rax]
test dx, dx
je 0x140028de3
mov word [rax], dx
add rax, 2
dec rcx
dec rdi
jne 0x140028dc3
jmp 0x140028de8
test rdi, rdi
jne 0x140028dec
sub rax, 2
mov word [rax], si
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x250]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x250]
mov rcx, rbx
call fcn.140006260
mov dword [rsp + 0x20], 1
cmp dword [0x140196f54], 0
je 0x140028e70
cmp dword [0x1401a5f74], 0
je 0x140028e70
lea rcx, str.HIDDEN_FILES_PRESENT_IN_KEYFILE_PATH
call fcn.14003a7b0
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.14000b850
mov dword [0x1401a5f74], esi
mov rax, rbx
mov rcx, qword [rsp + 0x4250]
xor rcx, rsp
call fcn.1400a4e70
lea r11, [rsp + 0x4260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret