Function at 0x14009ffe0
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x1400a02de
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140124588]
mov r15d, eax
je 0x1400a0019
mov rcx, rbx
call fcn.1400a1c80
test al, al
jne 0x1400a02de
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400a003d
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x1400a004f
mov rax, rbx
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
cmp byte [0x140122dc2], 0
jne 0x1400a00c1
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011c180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011c180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
jne 0x1400a00a0
mov rdi, rbx
mov rax, rbx
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
cmp rdi, rbp
je 0x1400a00c1
mov edx, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400a00c1
test rdi, rdi
jne 0x1400a02d1
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r12
xor r12b, r12b
mov qword [rsp + 0x78], r13
xor r13b, r13b
mov qword [rsp + 0x30], r14
test rbp, rbp
je 0x1400a0145
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x1400a014a
cmp dword [0x140124588], eax
je 0x1400a0121
mov rcx, rbp
call fcn.1400a1c80
test al, al
jne 0x1400a0121
mov ecx, dword [0x140124588]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x1400a014a
cmp r14d, r15d
je 0x1400a014a
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x1400a014a
mov r14d, dword [rsp + 0x60]
xor esi, esi
nop dword [rax]
movzx eax, byte [0x140122dc2]
cmp esi, eax
jne 0x1400a0189
cmp byte [0x140125e5d], 0
jne 0x1400a0189
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d450
xor r9d, r9d
mov byte [0x140125e5d], 1
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov byte [rsp + 0x20], r8b
lea ecx, [r8 + 1]
call fcn.14001fb40
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011c180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011c180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x1400a0281
cmp rax, rbp
je 0x1400a01e6
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400a01e6
test rdi, rdi
jne 0x1400a0284
inc esi
cmp esi, 5
jl 0x1400a0150
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fb40
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fb40
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011c180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011c180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x1400a0281
cmp rax, rbp
je 0x1400a027d
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
je 0x1400a0284
xor edi, edi
jmp 0x1400a0284
mov rdi, rbx
mov rsi, qword [rsp + 0x68]
test r12b, r12b
mov r12, qword [rsp + 0x70]
je 0x1400a02a5
mov ecx, dword [0x140124588]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x78]
je 0x1400a02be
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x30]
test rdi, rdi
je 0x1400a02de
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rdi
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret