Function at 0x140009cc0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, 0xfffffff0
mov rbx, rcx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
bt rax, 0x1d
jae 0x140009cfb
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov ecx, 2
call qword [sym.imp.USER32.dll_LockSetForegroundWindow]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
jne 0x140009d27
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTopWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
cmp edi, eax
je 0x140009d50
mov r8d, 1
mov edx, eax
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetActiveWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetFocus]
cmp edi, esi
je case.default.0x140009d9d
xor r8d, r8d
mov edx, esi
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_InvalidateRect]
in eax, dx
mov ebp, 0xb6840aa4
invalid
jnp case.0x140009d9d.41
pop r13
pop rbp
rcr dword [rdi], cl
insd dword [rdi], dx
fsubrp st(5)
pop rbx
mov dl, byte [rbx]
retf 0xbf50
cdq
stosb byte [rdi], al
js 0x1400c4b39
test al, 0xcd
fnstsw word [rsi]
invalid
invalid
invalid
mov al, 0xf3
sub ebx, edx
jbe 0x1400c4b3a
cmc
jb 0x1400c4bce
nop
jl 0x1400c4b0b
invalid
xchg byte [rdi], dl
fcmovnu st(0), st(3)
sbb al, byte [rax - 0xfffbaf3]
jp 0x1400c4b63
invalid
mov al, 0x5c
invalid
pop rdx
invalid
jmp 0x1400c4b85
invalid
pop rsp
jl 0x1400c4c4f
lea ebp, [rdx - 0x55]
mov esp, 0x9e0ec82a
invalid
sahf
invalid
xor cl, byte [rbx]
sub byte [rdi - 0x4c], cl
jge 0x1400c4bda
and dword [rcx], edi
invalid
xor al, 0x35
mov word [rax + 0x6a], gs
cmp byte [rbx], ch
mov bh, 0x4f
invalid
idiv byte [rsi - 0x7c7af02e]
invalid
call qword [rdi + 0xa7a0730]
push rdi
jnp 0x1400c4c06
mov ebx, ebx
fcmovb st(0), st(0)
invalid
jrcxz case.0x140009d9d.34
cmp qword [r11 - 0x73c9a22d], rsp
invalid
jg 0x1400c4c08
pop rbx
pop rbp
xchg dword [rax - 0x7a02d553], ebx
invalid
jmp 0x1400c4c88
adc dword [rax + 0x55], eax
lea edx, [rbp + 0x3337dc4c]
invalid
mov bpl, 0x90
mov cl, 0xf6
xchg byte [rdx], bpl
xchg byte [rdx], ch
xchg byte [rdx], ch
sub bh, bh
je 0x1400c4c52
push qword [rdi + rdi*8 - 0x14]
invalid
in al, dx
invalid
jbe 0x1400c4c7e
jmp rsi
out 0x8b, al
add rax, 0x6f570c1b
and edi, dword [rdx + rbp*8]
outsd dx, dword [rsi]
xor byte [rbp + rbp - 0x1e], bl
mov esi, 0x21490fc8
test rax, 0x74174214
jg 0x1400c4bfc
jp 0x1400c4c5d
fmul qword [rbx + 0xf]
invalid
movhps xmm1, qword [r15 + r9 + 0x12c0599f]
xor edi, dword [rcx + 0x6dc321e0]
adc dh, byte [rbx]
mov ecx, 0x6dc321e0
adc eax, 0xb66c0ffd
cmpsb byte [rsi], byte [rdi]
insb byte [rdi], dx
mov dh, 0xa6
adc bh, byte [rax]
je 0x1400c4d14
mov dh, bh
jle 0x1400c4c98
std
invalid
std
jnp 0x1400c4d11
movabs byte [0x1222683527bbf0eb], al
xor eax, dword [rbx + 0x5667976f]
push rsi
push rsi
sbb al, 0x1d
lodsd eax, dword [rsi]
shr dword [rbx + 0x30], cl
mov dword [0xd703f082], edi
mov edx, 0x7b4a685f
adc al, 0xdf
fisttp word [rbx + rax + 0x5c7d4e2d]
invalid
loope 0x1400c4c48
fisttp word [rbx + rax + 0x5c7d4e2d]
movabs al, byte [0x337b0977229380e1]
xchg ebx, eax
and dh, byte [rdi + 9]
jnp 0x1400c4d01
in eax, 0xfa
adc ebx, dword [rdx]
invalid
invalid
sal byte [rcx + 0x9aa124a], 1
sbb byte [rcx], ah
pop rcx
invalid
leave
sbb al, 0x85
cmp dword [rdx], edx
sahf
ret 0xfea0
and ecx, dword gs:[rbp + 0x55acedff]
sub byte [rdx], cl
std
jnp 0x1400c4c90
invalid
push rdx
std
popfq
mov edi, esi
jl 0x1400c4ce1
iretd
invalid
xlatb
mov esi, eax
xor al, 0x7d
jge case.0x140009d9d.18
out dx, eax
jge case.0x140009d9d.18
out dx, eax
movsd dword [rdi], dword ss:[rsi]
jo 0x1400c4d75
invalid
invalid
sbb al, 0x4d
in eax, dx
invalid
invalid
cld
invalid
jrcxz 0x1400c4d24
int3
sal al, 1
jp 0x1400c4dad
invalid
push rsp
push rsp
out 0x29, al
jmp 0x1b7fb1977
invalid
retf
out dx, al
invalid
test ebx, 0xb5fa77ee
test byte [rax], bl
mov eax, dword [rax + riz*4 - 0x415585cc]
invalid
stosd dword [rdi], eax
mul dword [rdi - 0x81ee2ba]
add dword [rsi], ecx
out dx, eax
sub al, byte [rdx + 0x616cf945]
or al, 1
in eax, 0xdd
ret
lodsb al, byte [rsi]
iretd
mov ah, 0x87
jp case.0x140009d9d.1
jnp 0x1400c4e0a
jg 0x1400c4ddf
test byte [rsi - 0x23], r15b
invalid
js 0x1400c4d6a
js 0x1400c4e1f
invalid
jle 0x1400c4df3
sbb dword [0x14f8221bb], ebx
popfq
lahf
in eax, dx
out dx, eax
call 0xe2ec23d8
not ch
fbld tbyte [rdx + 0x226d46a1]
cld
xchg dword [rcx], eax
add dword [rsi + rdi*4], edi
invalid
push rsp
cmc
invalid
not ch
fbld tbyte [rdx + 0x226d46a1]
cld
xchg dword [rcx], eax
add dword [rsi + rdi*4], edi
invalid
invalid
test eax, 0xf9071b7c
xlatb
invalid
invalid
pop rcx
fidiv dword [rax + 0x11]
retf 0x6358
mov eax, 0xeff5319e
hlt
pop rsi
leave
add bh, byte es:[rcx + 0x5134174b]
jle 0x1400c4e5d
out dx, al
or r12b, r8b
invalid
pop rdi
or dword [rbx - 0x34], ebp
int3
invalid
adc al, 0x85
mov al, 0x36
xor byte [rbx - 0x57eb0313], bpl
cld
adc al, 0xa8
outsb dx, byte [rsi]
xchg esi, eax
or eax, 0x471d5936
out dx, eax
jle 0x1400c581a
invalid
invalid
movabs byte [0x3e0f3e88f6880686], al
mov dh, 0xa7
xor esi, dword [rdx + 0x66480f6c]
push rdi
jle 0x1400c5812
xchg ecx, eax
jb 0x1400c57f4
sbb eax, 0x3afceb89
cmp eax, 0x5d3d3de7
pop rbp
pop rbp
mov edx, 0x45255a7c
invalid
adc al, 0x40
or esi, dword [rbx + 0x3b]
or dword [rax + rax*8 + 0x4607c4aa], ebp
jns 0x1400c587a
sal byte [rcx - 0x5fa3e2e9], 0xb7
sbb byte [rdi], ah
pop rdi
sahf
loopne 0x1400c58ad
invalid
push 0x2b
push rdx
push rbx
fist dword [rsi + rdi*2 + 0x7e60118f]
cmp eax, 0xdbd4e02b
stosd dword [rdi], eax
invalid