Function at 0x140085dd0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa0
mov rbx, r8
mov rdi, rcx
mov rcx, rdx
mov qword [rbp - 0x41], rbx
mov rsi, r9
call fcn.140084de0
mov r15d, eax
test eax, eax
je 0x14008641d
mov rdx, qword [rbp + 0x7f]
mov r9, qword [rbp + 0x77]
mov r8, qword [rbp + 0x6f]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbp + 0x67]
call fcn.14006c220
mov r14, rax
test rax, rax
je 0x14008641d
mov rdx, rsi
mov rcx, rax
call fcn.1400c8d30
mov rdi, rax
test rax, rax
je 0x140086419
mov r13d, dword gs:[0x48]
lea eax, [r15 - 1]
cmp eax, 0x10
ja case.default.0x140085e80
movsxd rcx, eax
lea rax, [0x140000000]
mov edx, dword [rax + rcx*4 + 0x86934]
add rdx, rax
jmp rdx
lea rax, [rbp - 0x49]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov edx, 0xf0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
xor esi, esi
cmp r15d, 1
mov eax, esi
sete al
cmp qword [rbp - 0x49], rax
je case.default.0x140085e80
xor edx, edx
mov rcx, r14
xor r12b, r12b
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r15d, eax
test eax, eax
je 0x140085f0f
cmp eax, dword [0x14014c878]
je 0x140085f0f
mov rcx, r14
call fcn.1400c92d0
test al, al
jne 0x140085f0f
mov ecx, dword [0x14014c878]
lea r8d, [rsi + 1]
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
cmp r14, rdi
jne 0x140085f55
mov r14d, 0xfffffff0
mov rcx, rdi
mov edx, r14d
mov rbx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jae 0x140085f58
nop
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
test rax, rax
je 0x140085f58
mov edx, r14d
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowLongW]
bt eax, 0x1e
jb 0x140085f30
jmp 0x140085f58
mov rbx, r14
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetActiveWindow]
lea rdx, [rbp - 0x39]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
jne 0x140085f85
mov ecx, esi
mov qword [rbp - 0x39], rsi
mov eax, esi
mov dword [rbp - 0x31], ecx
mov dword [rbp - 0x2d], eax
mov r8d, esi
jmp 0x140085f92
mov eax, dword [rbp - 0x2d]
mov ecx, dword [rbp - 0x31]
mov esi, dword [rbp - 0x35]
mov r8d, dword [rbp - 0x39]
sub eax, esi
sub ecx, r8d
cdq
mov r8d, 1
sub eax, edx
sar eax, 1
movzx ebx, ax
mov eax, ecx
cdq
shl rbx, 0x10
sub eax, edx
mov edx, 0x201
sar eax, 1
movzx ecx, ax
or rbx, rcx
mov rcx, rdi
mov r9, rbx
call qword [sym.imp.USER32.dll_PostMessageW]
mov r9, rbx
xor r8d, r8d
mov edx, 0x202
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
test r12b, r12b
je case.default.0x140085e80
mov ecx, dword [0x14014c878]
xor r8d, r8d
mov edx, r15d
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp case.default.0x140085e80
mov edx, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x140085e80
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_EnableWindow]
jmp case.default.0x140085e80
mov edx, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x140085e80
xor edx, edx
mov rcx, rdi
call qword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x140085e80
cmp word [rbx], 0
jne 0x140086051
mov eax, 1
jmp 0x140086911
cmp r15d, 7
mov r12d, 0xffffffec
mov r14d, 0xfffffff0
mov rcx, rdi
cmove r12d, r14d
mov edx, r12d
call qword [sym.imp.USER32.dll_GetWindowLongW]
movzx edx, word [rbx]
lea rcx, [0x14012bbd8]
mov esi, eax
call fcn.1400e1554
test rax, rax
jne 0x14008610b
mov rdx, rbx
nop
movzx ecx, word [rdx]
cmp cx, 0x20
je 0x14008609f
cmp cx, 9
jne 0x1400860a5
add rdx, 2
jmp 0x140086090
test cx, cx
je 0x1400860fe
cmp cx, 0x2d
je 0x1400860b6
cmp cx, 0x2b
jne 0x1400860c1
movzx ecx, word [rdx + 2]
lea rax, [rdx + 2]
mov rdx, rax
cmp cx, 0x30
jne 0x1400860fe
movzx eax, word [rdx + 2]
mov r8d, 0xffdf
sub ax, 0x58
test r8w, ax
jne 0x1400860fe
movzx ecx, word [rdx + 4]
call fcn.1400ea440
test eax, eax
je 0x1400860fe
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400ea4ec
mov rbx, rax
jmp 0x1400861ad
mov rcx, rbx
call fcn.1400e9f38
jmp 0x1400861ab
add rbx, 2
mov rcx, rbx
movzx eax, word [rcx]
cmp ax, 0x20
je 0x140086121
cmp ax, 9
jne 0x140086127
add rcx, 2
jmp 0x140086112
test ax, ax
je 0x140086179
cmp ax, 0x2d
je 0x140086138
cmp ax, 0x2b
jne 0x140086142
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x140086179
movzx eax, word [rcx + 2]
mov r8d, 0xffdf
sub ax, 0x58
test r8w, ax
jne 0x140086179
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x140086179
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400ea4ec
jmp 0x140086181
mov rcx, rbx
call fcn.1400e9f38
mov rcx, qword [rbp - 0x41]
movzx ecx, word [rcx]
cmp cx, 0x2b
je 0x1400861a9
cmp cx, 0x2d
je 0x1400861a3
cmp cx, 0x5e
jne 0x14008619e
xor eax, esi
jmp 0x1400861ab
mov ebx, dword [rbp - 0x49]
jmp 0x1400861ad
not eax
and eax, esi
jmp 0x1400861ab
or eax, esi
mov ebx, eax
cmp ebx, esi
je 0x1400861fd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, ebx
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x1400861da
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140086419
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
cmp eax, esi
je 0x140086419
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 1]
call qword [sym.imp.USER32.dll_InvalidateRect]
mov rcx, qword [0x14014a3b0]
lea rdx, [0x14010d31c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c6a70
jmp 0x140086911
xor esi, esi
mov edx, 0x14f
cmp r15d, 9
sete sil
xor r9d, r9d
mov r8, rsi
jmp 0x140086891
movzx eax, word [rbx]
test ax, ax
je 0x1400862f0
mov rcx, rbx
nop word [rax + rax]
cmp ax, 0x20
je 0x14008625c
cmp ax, 9
jne 0x140086266
movzx eax, word [rcx + 2]
add rcx, 2
jmp 0x140086250
test ax, ax
je 0x1400862b8
cmp ax, 0x2d
je 0x140086277
cmp ax, 0x2b
jne 0x140086281
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x1400862b8
movzx eax, word [rcx + 2]
mov r8d, 0xffdf
sub ax, 0x58
test r8w, ax
jne 0x1400862b8
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x1400862b8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400ea654
jmp 0x1400862c0
mov rcx, rbx
call fcn.1400e9e88
mov esi, eax
cmp r15d, 0xb
mov eax, 0x25
mov ebx, 0x27
cmove ebx, eax
xor edx, edx
movzx ecx, bl
call fcn.14001c2b0
movzx eax, ax
shl eax, 0x10
movsxd r15, eax
test esi, esi
jle case.default.0x140085e80
jmp 0x140086319
mov eax, 0x25
cmp r15d, 0xb
mov ebx, 0x27
mov esi, 1
cmove ebx, eax
xor edx, edx
movzx ecx, bl
call fcn.14001c2b0
movzx eax, ax
shl eax, 0x10
movsxd r15, eax
mov r12, r15
mov r14d, esi
mov eax, 0xc0000001
movzx ebx, bl
or r12, 1
or r15, rax
xor esi, esi
mov r9, r12
mov r8, rbx
mov edx, 0x100
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
xor ecx, ecx
mov dword [0x140145a74], esi
cmp dword [0x14014c878], r13d
je 0x14008635d
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140086367
mov edx, 1
call fcn.1400018c0
mov r9, r15
mov dword [0x140145a74], 1
mov r8, rbx
mov edx, 0x101
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageW]
sub r14, 1
jne 0x140086330
jmp case.default.0x140085e80
cmp word [rsi], 0
jne 0x1400863ad
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x1400863c8
mov edx, 0x143
jmp 0x1400863e1
lea rdx, str.List
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x140086419
mov edx, 0x180
lea rax, [rbp - 0x49]
mov r9, rbx
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
cmp qword [rbp - 0x49], 0xfffffffffffffffd
jbe case.default.0x140085e80
mov rdi, qword [rbp + 0x47]
mov rax, qword [0x140145a80]
lea rdx, [0x14012296c]
test byte [rax + 0x140], 1
jne 0x1400868ff
mov rcx, qword [0x14014a3b0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c6a70
jmp 0x140086911
movzx eax, word [rbx]
test ax, ax
je 0x140086419
mov rcx, rbx
cmp ax, 0x20
je 0x14008646c
cmp ax, 9
jne 0x140086476
movzx eax, word [rcx + 2]
add rcx, 2
jmp 0x140086460
test ax, ax
je 0x1400864c8
cmp ax, 0x2d
je 0x140086487
cmp ax, 0x2b
jne 0x140086491
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x1400864c8
movzx eax, word [rcx + 2]
mov r8d, 0xffdf
sub ax, 0x58
test r8w, ax
jne 0x1400864c8
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x1400864c8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400ea654
jmp 0x1400864d0
mov rcx, rbx
call fcn.1400e9e88
lea ebx, [rax - 1]
test ebx, ebx
js 0x140086419
cmp word [rsi], 0
jne 0x1400864f8
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x140086513
mov edx, 0x144
jmp 0x140086530
lea rdx, str.List
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x140086419
mov edx, 0x182
lea rax, [rbp - 0x49]
movsxd r8, ebx
mov qword [rsp + 0x30], rax
xor r9d, r9d
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
cmp qword [rbp - 0x49], 0xffffffffffffffff
jmp 0x1400868b6
movzx eax, word [rbx]
test ax, ax
je 0x140086419
mov rcx, rbx
nop word [rax + rax]
cmp ax, 0x20
je 0x14008658c
cmp ax, 9
jne 0x140086596
movzx eax, word [rcx + 2]
add rcx, 2
jmp 0x140086580
test ax, ax
je 0x1400865e8
cmp ax, 0x2d
je 0x1400865a7
cmp ax, 0x2b
jne 0x1400865b1
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x1400865e8
movzx eax, word [rcx + 2]
mov r8d, 0xffdf
sub ax, 0x58
test r8w, ax
jne 0x1400865e8
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x1400865e8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x10]
call fcn.1400ea654
jmp 0x1400865f0
mov rcx, rbx
call fcn.1400e9e88
lea ebx, [rax - 1]
test ebx, ebx
js 0x140086419
cmp word [rsi], 0
jne 0x140086618
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x140086641
mov edx, 0x14e
movsxd r8, ebx
mov esi, 9
xor r9d, r9d
jmp 0x1400866f0
lea rdx, str.List
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x140086419
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov esi, 2
movsxd r8, ebx
and eax, 0x808
mov ecx, eax
neg ecx
sbb edx, edx
add edx, 0x186
test eax, eax
je 0x140086639
lea rax, [rbp - 0x49]
mov r9, r8
mov qword [rsp + 0x30], rax
lea r8d, [rsi - 1]
mov dword [rsp + 0x28], 0x7d0
mov edx, 0x185
mov dword [rsp + 0x20], esi
jmp 0x140086709
cmp word [rsi], 0
jne 0x1400866c4
mov r8d, SafeArrayAllocDescriptor
lea rdx, [rbp - 0x29]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClassNameW]
lea rsi, [rbp - 0x29]
lea rdx, str.Combo
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x1400867b9
mov edx, 0x14d
mov esi, 9
mov r9, rbx
mov r8, 0xffffffffffffffff
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
cmp qword [rbp - 0x49], 0xffffffffffffffff
je 0x140086419
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetParent]
mov rbx, rax
test rax, rax
je 0x140086419
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
mov r14d, eax
test eax, eax
jne 0x140086761
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140086419
lea rax, [rbp - 0x49]
movzx r14d, r14w
mov qword [rsp + 0x30], rax
mov r8d, r14d
bts r8, 0x10
mov dword [rsp + 0x28], 0x7d0
mov r9, rdi
mov dword [rsp + 0x20], 2
mov edx, 0x111
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
shl esi, 0x10
mov r9, rdi
mov r8d, esi
mov edx, 0x111
or r8, r14
mov rcx, rbx
jmp 0x140086894
lea rdx, str.List
mov rcx, rsi
call fcn.1400c1b50
test rax, rax
je 0x140086419
mov edx, 0xfffffff0
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov edx, 0x18f
mov ecx, 0x18c
and eax, 0x808
mov esi, 2
cmove edx, ecx
test eax, 0x808
je 0x1400866e6
lea rax, [rbp - 0x41]
mov r9, rbx
mov qword [rsp + 0x30], rax
lea edx, [rcx + 3]
mov dword [rsp + 0x28], 0x7d0
mov r8, 0xffffffffffffffff
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
mov r9, qword [rbp - 0x41]
cmp r9, 0xffffffffffffffff
je 0x140086419
lea rax, [rbp - 0x49]
mov edx, 0x185
mov qword [rsp + 0x30], rax
lea r8d, [rsi - 1]
mov dword [rsp + 0x28], 0x7d0
mov rcx, rdi
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
cmp qword [rbp - 0x49], 0xffffffffffffffff
jne 0x140086726
jmp 0x140086419
mov r9, rbx
mov edx, 0xc2
mov r8d, 1
mov rcx, rdi
lea rax, [rbp - 0x49]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x7d0
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x140086419
mov rax, qword [0x140145a80]
cmp dword [rax + 0x78], 0xffffffff
jle 0x1400861fd
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14014c878], eax
mov rax, qword [0x140145a80]
mov ecx, dword [rax + 0x78]
je 0x1400868f0
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400861fd
mov edx, 1
call fcn.1400018c0
jmp 0x1400861fd
lea r9, [0x14010d28c]
xor r8d, r8d
mov rcx, rdi
call fcn.140050010
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret