Function at 0x140058ac0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xc0
mov rax, qword [rbp + 0x87]
mov rdi, r9
mov r9, qword [rbp + 0x7f]
mov rbx, rcx
mov r8, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x6f]
mov qword [rsp + 0x20], rax
call fcn.14006a980
mov qword [rbp - 0x61], rax
mov r14, rax
test rax, rax
je 0x140058da3
movzx ecx, word [rdi]
mov r15d, 2
mov rsi, qword [rbp + 0x67]
xor r13d, r13d
xor r12b, r12b
mov dword [rbp - 0x69], r15d
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x38], 0x80000000
lea r9d, [r15 - 1]
mov dword [rbp - 0x7d], 0x80000000
mov qword [rbp - 0x71], reloc.WSOCK32.dll_recv
mov qword [rbp - 0x59], r13
test cx, cx
je 0x140058cb3
lea r8, [0x140000000]
movzx esi, r9b
nop dword [rax]
movzx ebx, cx
test ebx, 0xffffff80
je 0x140058b80
mov eax, r13d
jmp 0x140058b99
mov edx, 2
mov ecx, ebx
call fcn.1400d7464
lea r8, [0x140000000]
mov r9d, 1
mov ecx, ebx
and ecx, 0xffffffdf
test eax, eax
cmove ecx, ebx
add ecx, 0xffffffbc
cmp ecx, 0x15
ja case.0x140058bc6.74
movsxd rax, ecx
movzx eax, byte [r8 + rax + 0x59194]
mov ecx, dword [r8 + rax*4 + 0x59178]
add rcx, r8
jmp rcx
mov r15d, r13d
jmp case.0x140058bc6.74
mov r15d, r9d
jmp case.0x140058bc6.74
movzx ebx, word [rdi + 2]
lea r14, [rdi + 2]
test ebx, 0xffffff80
je 0x140058bed
mov eax, r13d
jmp 0x140058bf9
mov edx, 2
mov ecx, ebx
call fcn.1400d7464
mov ecx, 0xffdf
movzx edx, bx
and dx, cx
mov ecx, r13d
test eax, eax
movzx eax, sil
cmove dx, bx
cmp dx, 0x41
cmovne ecx, eax
cmovne r14, rdi
movzx esi, cl
mov rdi, r14
jmp 0x140058c71
mov r8d, 3
lea rdx, [0x140111ae0]
mov rcx, rdi
call fcn.1400d2a10
test eax, eax
movzx r12d, r12b
lea rcx, [rdi + 4]
mov r9d, 1
cmovne rcx, rdi
cmove r12d, r9d
mov rdi, rcx
jmp case.0x140058bc6.74
lea rcx, [rdi + 2]
call fcn.1400d278c
mov dword [rsp + 0x38], eax
jmp 0x140058c71
lea rcx, [rdi + 2]
call fcn.1400d278c
mov dword [rbp - 0x7d], eax
mov r9d, 1
movzx ecx, word [rdi + 2]
lea r8, [0x140000000]
add rdi, 2
movzx eax, sil
mov edx, r15d
test cx, cx
jne 0x140058b70
mov rsi, qword [rbp + 0x67]
mov r14, qword [rbp - 0x61]
mov dword [rbp - 0x69], edx
mov byte [rsp + 0x30], al
test r12b, r12b
je 0x140058cb3
mov dword [rbp - 0x69], edx
mov byte [rsp + 0x30], al
jmp 0x140058cca
mov rdx, rsi
mov rcx, r14
call fcn.1400b2c30
mov rdi, rax
test rax, rax
jne 0x140058e7f
xor eax, eax
mov dword [rbp - 0x51], r13d
xorps xmm0, xmm0
mov qword [rbp - 0x2d], rax
mov byte [rbp - 0x29], 1
movups xmmword [rbp - 0x4d], xmm0
mov dword [rbp - 0x25], eax
movups xmmword [rbp - 0x3d], xmm0
movzx ebx, word [rsi]
cmp ebx, 0x20
je 0x140058cf3
cmp ebx, 9
jne 0x140058cf9
add rsi, 2
jmp 0x140058ce6
mov ecx, ebx
test ebx, 0xffffff80
jne 0x140058d0d
mov edx, 2
call fcn.1400d7464
movzx ecx, bx
mov edx, 0xffdf
and cx, dx
test eax, eax
cmove cx, bx
cmp cx, 0x58
jne 0x140058d9f
cmp word [rsi + 2], r13w
lea rbx, [rsi + 2]
je 0x140058d9f
mov rcx, rbx
call fcn.140005a80
mov rcx, rbx
test al, al
je 0x140058d4b
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400d2570
jmp 0x140058d50
call fcn.1400d278c
movzx edx, word [rbx]
mov dword [rbp - 0x51], eax
test dx, dx
je 0x140058d9f
mov r8d, SafeArrayAllocDescriptor
nop dword [rax]
nop word [rax + rax]
lea rcx, [0x1401108a0]
movzx eax, r8w
nop dword [rax + rax]
cmp dx, ax
je 0x140058ddb
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140058d80
movzx edx, word [rbx + 2]
add rbx, 2
test dx, dx
jne 0x140058d70
mov rbx, qword [rbp + 0x47]
mov rax, qword [0x14012fc08]
lea rdx, [0x14011037c]
test byte [rax + 0x140], 1
jne 0x140059148
mov rcx, qword [0x140134210]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
jmp 0x14005915a
movzx ecx, word [rbx + 2]
add rbx, 2
cmp cx, r8w
je 0x140058ddb
cmp cx, 9
je 0x140058ddb
test cx, cx
je 0x140058d9f
call fcn.1400dd2e8
cmp ax, 0x59
jne 0x140058d9f
add rbx, 2
cmp word [rbx], r13w
je 0x140058d9f
mov rcx, rbx
call fcn.140005a80
mov rcx, rbx
test al, al
je 0x140058e25
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400d2570
jmp 0x140058e2a
call fcn.1400d278c
lea rdx, [rbp - 0x11]
mov dword [rbp - 0x4d], eax
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x11]
lea r8, [rbp - 0x51]
add dword [rbp - 0x51], eax
lea rdx, [0x1400619c0]
mov eax, dword [rbp - 0xd]
mov rcx, r14
add dword [rbp - 0x4d], eax
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rax, qword [rbp - 0x39]
lea rdx, [rsp + 0x38]
test rax, rax
mov rdi, r14
cmovne rdi, rax
mov rax, qword [rbp - 0x51]
mov rcx, rdi
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [rbp + 0x57]
cmp edx, 1
jl 0x140059127
cmp dword [rsp + 0x38], 0x80000000
je 0x140058e9e
cmp dword [rbp - 0x7d], 0x80000000
jne 0x140058ee6
lea rdx, [rbp - 0x21]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x140058d9f
cmp dword [rsp + 0x38], 0x80000000
jne 0x140058ecc
mov eax, dword [rbp - 0x19]
sub eax, dword [rbp - 0x21]
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x38], eax
cmp dword [rbp - 0x7d], 0x80000000
jne 0x140058ee3
mov eax, dword [rbp - 0x15]
sub eax, dword [rbp - 0x1d]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp - 0x7d], eax
mov edx, dword [rbp + 0x57]
movzx ebx, byte [rbp + 0x4f]
lea eax, [rbx + 0x62]
cmp al, 1
lea eax, [rbx + 0x64]
setbe r13b
cmp al, 1
setbe r15b
test r13b, r13b
je 0x140058f3c
lea rdx, [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rbp + 0x57]
cmp bl, 0x9f
mov esi, dword [rbp - 0x79]
mov ecx, 0xffffff88
mov eax, 0x78
mov ebx, 0x20a
cmove ecx, eax
imul ecx, edx
shl ecx, 0x10
movsxd rcx, ecx
mov qword [rbp - 0x71], rcx
jmp 0x140058fe7
test r15b, r15b
je 0x140058f68
mov esi, dword [rbp - 0x79]
cmp bl, 0x9c
mov ecx, 0xffffff88
mov eax, 0x78
cmove eax, ecx
mov ebx, 0x20e
imul eax, edx
shl eax, 0x10
movsxd rcx, eax
mov qword [rbp - 0x71], rcx
jmp 0x140058fe7
mov ecx, ebx
sub ecx, 1
je 0x140058fd7
sub ecx, 1
je 0x140058fc5
sub ecx, 2
je 0x140058fbb
sub ecx, 1
je 0x140058fa1
cmp ecx, 1
jne 0x140058d9f
mov ebx, 0x20b
mov qword [rbp - 0x59], 0x20000
mov qword [rbp - 0x71], 0x20040
lea esi, [rbx + 1]
jmp 0x140058fe7
mov ebx, 0x20b
mov qword [rbp - 0x59], 0x10000
mov qword [rbp - 0x71], 0x10020
lea esi, [rbx + 1]
jmp 0x140058fe7
mov ebx, 0x207
lea esi, [rbx + 1]
jmp 0x140058fe7
mov ebx, 0x204
mov qword [rbp - 0x71], 2
lea esi, [rbx + 1]
jmp 0x140058fe7
mov ebx, 0x201
mov qword [rbp - 0x71], 1
lea esi, [rbx + 1]
movzx r14d, word [rbp - 0x7d]
movzx eax, word [rsp + 0x38]
shl r14d, 0x10
or r14, rax
mov byte [rsp + 0x31], 0
cmp byte [rsp + 0x30], 0
je 0x14005905a
mov rcx, qword [rbp - 0x61]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x79], eax
mov r12d, eax
test eax, eax
je 0x14005904b
cmp eax, dword [0x140136620]
je 0x14005904b
mov rcx, qword [rbp - 0x61]
call fcn.1400b3190
test al, al
jne 0x14005904b
mov ecx, dword [0x140136620]
mov r8d, 1
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [rsp + 0x31]
mov rcx, qword [rbp - 0x61]
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov edx, dword [rbp + 0x57]
jmp 0x140059062
mov r12d, dword [rbp - 0x79]
mov dword [rbp - 0x79], r12d
test r13b, r13b
jne 0x1400590e3
test r15b, r15b
jne 0x1400590e3
mov r13d, dword [rbp - 0x69]
mov r12, qword [rbp - 0x59]
mov r15d, edx
cmp r13d, 1
je 0x1400590ad
mov r8, qword [rbp - 0x71]
mov r9, r14
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x14012fc08]
mov ecx, dword [rax + 0x78]
cmp ecx, 0xffffffff
jle 0x1400590a8
mov edx, 1
call fcn.140001940
test r13d, r13d
je 0x1400590d7
mov r9, r14
mov r8, r12
mov edx, esi
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x14012fc08]
mov ecx, dword [rax + 0x78]
cmp ecx, 0xffffffff
jle 0x1400590d7
mov edx, 1
call fcn.140001940
sub r15, 1
jne 0x140059077
mov r12d, dword [rbp - 0x79]
jmp 0x14005910e
mov r8, qword [rbp - 0x71]
mov r9, r14
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x14012fc08]
mov ecx, dword [rax + 0x78]
cmp ecx, 0xffffffff
jle 0x14005910e
mov edx, 1
call fcn.140001940
cmp byte [rsp + 0x31], 0
je 0x140059127
mov ecx, dword [0x140136620]
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [0x140134210]
lea rdx, [0x1400fb96c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400b0830
jmp 0x14005915a
lea r9, [0x1400fb87c]
xor r8d, r8d
mov rcx, rbx
call fcn.140050b90
mov rbx, qword [rsp + 0x118]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret