Function at 0x140059a20
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x18], r8d
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0xb0
mov rax, qword [rbp + 0x87]
mov rbx, r9
mov r9, qword [rbp + 0x7f]
mov rsi, rcx
mov r8, qword [rbp + 0x77]
mov rdx, qword [rbp + 0x6f]
mov qword [rsp + 0x20], rax
call fcn.14006c220
mov qword [rbp - 0x59], rax
mov rdi, rax
test rax, rax
je 0x140059d13
movzx ecx, word [rbx]
xor r13d, r13d
mov rsi, qword [rbp + 0x67]
xor r15b, r15b
mov dword [rbp - 0x75], 2
mov r12d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov byte [rbp - 0x79], 1
mov dword [rbp - 0x71], 0x80000000
mov dword [rbp - 0x6d], 0x80000000
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x51], r13
test cx, cx
je 0x140059bd1
lea rsi, [0x140000000]
mov r12b, 1
movzx edi, cx
test edi, 0xffffff80
je 0x140059ad4
mov eax, r13d
jmp 0x140059ae0
mov edx, 2
mov ecx, edi
call fcn.1400e8e20
mov ecx, edi
and ecx, 0xffffffdf
test eax, eax
cmove ecx, edi
add ecx, 0xffffffbc
cmp ecx, 0x15
ja case.0x140059b0b.74
movsxd rax, ecx
movzx eax, byte [rsi + rax + 0x5a1a4]
mov ecx, dword [rsi + rax*4 + 0x5a188]
add rcx, rsi
jmp rcx
mov dword [rbp - 0x75], r13d
jmp case.0x140059b0b.74
mov dword [rbp - 0x75], 1
jmp case.0x140059b0b.74
movzx edi, word [rbx + 2]
lea r14, [rbx + 2]
test edi, 0xffffff80
je 0x140059b37
mov eax, r13d
jmp 0x140059b43
mov edx, 2
mov ecx, edi
call fcn.1400e8e20
mov ecx, 0xffdf
movzx edx, di
and dx, cx
mov ecx, r13d
test eax, eax
movzx eax, r12b
cmove dx, di
cmp dx, 0x41
cmovne ecx, eax
cmovne r14, rbx
movzx r12d, cl
mov rbx, r14
jmp case.0x140059b0b.74
mov r8d, 3
lea rdx, [0x14012aff0]
mov rcx, rbx
call fcn.1400e5e84
test eax, eax
jne case.0x140059b0b.74
add rbx, 4
mov r15b, 1
jmp case.0x140059b0b.74
lea rcx, [rbx + 2]
call fcn.1400e9e88
mov dword [rbp - 0x71], eax
jmp case.0x140059b0b.74
lea rcx, [rbx + 2]
call fcn.1400e9e88
mov dword [rbp - 0x6d], eax
movzx ecx, word [rbx + 2]
add rbx, 2
test cx, cx
jne 0x140059ac4
mov rsi, qword [rbp + 0x67]
mov rdi, qword [rbp - 0x59]
mov byte [rbp - 0x79], r12b
mov r12, qword [rbp - 0x61]
test r15b, r15b
jne 0x140059be8
mov rdx, rsi
mov rcx, rdi
call fcn.1400c8d30
mov r14, rax
test rax, rax
jne 0x140059e3c
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x11], 1
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
nop dword [rax + rax]
movzx ebx, word [rsi]
cmp ebx, 0x20
je 0x140059c0d
cmp ebx, 9
jne 0x140059c13
add rsi, 2
jmp 0x140059c00
mov ecx, ebx
test ebx, 0xffffff80
je 0x140059c22
mov eax, r13d
jmp 0x140059c2c
mov edx, 2
call fcn.1400e8e20
movzx ecx, bx
mov r14d, 0xffdf
and cx, r14w
test eax, eax
cmove cx, bx
cmp cx, 0x58
jne 0x140059d0f
movzx eax, word [rsi + 2]
lea rbx, [rsi + 2]
test ax, ax
je 0x140059d0f
mov rcx, rbx
nop dword [rax]
cmp ax, 0x20
je 0x140059c6c
cmp ax, 9
jne 0x140059c76
movzx eax, word [rcx + 2]
add rcx, 2
jmp 0x140059c60
test ax, ax
je 0x140059cc1
cmp ax, 0x2d
je 0x140059c87
cmp ax, 0x2b
jne 0x140059c91
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x140059cc1
movzx eax, word [rcx + 2]
sub ax, 0x58
test r14w, ax
jne 0x140059cc1
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x140059cc1
mov r8d, r12d
xor edx, edx
mov rcx, rbx
call fcn.1400ea654
jmp 0x140059cc9
mov rcx, rbx
call fcn.1400e9e88
movzx edx, word [rbx]
mov dword [rbp - 0x39], eax
test dx, dx
je 0x140059d0f
mov r8d, SafeArrayAllocDescriptor
nop word [rax + rax]
lea rcx, [0x140122e70]
movzx eax, r8w
nop dword [rax + rax]
cmp dx, ax
je 0x140059d4b
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140059cf0
movzx edx, word [rbx + 2]
add rbx, 2
test dx, dx
jne 0x140059ce0
mov rsi, qword [rbp + 0x47]
mov rax, qword [0x140145a80]
lea rdx, [0x14012296c]
test byte [rax + 0x140], 1
jne 0x14005a159
mov rcx, qword [0x14014a3b0]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c6a70
jmp 0x14005a16b
movzx ecx, word [rbx + 2]
add rbx, 2
cmp cx, r8w
je 0x140059d4b
cmp cx, 9
je 0x140059d4b
test cx, cx
je 0x140059d0f
call fcn.1400ef99c
cmp ax, 0x59
jne 0x140059d0f
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
je 0x140059d0f
mov rcx, rbx
nop
cmp ax, 0x20
je 0x140059d8c
cmp ax, 9
jne 0x140059d96
movzx eax, word [rcx + 2]
add rcx, 2
jmp 0x140059d80
test ax, ax
je 0x140059de1
cmp ax, 0x2d
je 0x140059da7
cmp ax, 0x2b
jne 0x140059db1
lea rax, [rcx + 2]
mov rcx, rax
movzx eax, word [rax]
cmp ax, 0x30
jne 0x140059de1
movzx eax, word [rcx + 2]
sub ax, 0x58
test r14w, ax
jne 0x140059de1
movzx ecx, word [rcx + 4]
call fcn.1400ea440
test eax, eax
je 0x140059de1
mov r8d, r12d
xor edx, edx
mov rcx, rbx
call fcn.1400ea654
jmp 0x140059de9
mov rcx, rbx
call fcn.1400e9e88
lea rdx, [rbp - 9]
mov dword [rbp - 0x35], eax
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 9]
lea r8, [rbp - 0x39]
add dword [rbp - 0x39], eax
lea rdx, [0x140063220]
mov eax, dword [rbp - 5]
mov rcx, rdi
add dword [rbp - 0x35], eax
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov rax, qword [rbp - 0x21]
lea rdx, [rbp - 0x71]
test rax, rax
mov r14, rdi
cmovne r14, rax
mov rax, qword [rbp - 0x39]
mov rcx, r14
mov qword [rbp - 0x71], rax
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r8d, dword [rbp + 0x57]
cmp r8d, 1
jl 0x14005a138
cmp dword [rbp - 0x71], 0x80000000
je 0x140059e5c
cmp dword [rbp - 0x6d], 0x80000000
jne 0x140059ea3
lea rdx, [rbp - 0x49]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x140059d0f
cmp dword [rbp - 0x71], 0x80000000
jne 0x140059e88
mov eax, dword [rbp - 0x41]
sub eax, dword [rbp - 0x49]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp - 0x71], eax
cmp dword [rbp - 0x6d], 0x80000000
mov r8d, dword [rbp + 0x57]
jne 0x140059ea3
mov eax, dword [rbp - 0x3d]
sub eax, dword [rbp - 0x45]
cdq
sub eax, edx
sar eax, 1
mov dword [rbp - 0x6d], eax
movzx r15d, word [rbp - 0x6d]
movzx edx, byte [rbp + 0x4f]
movzx eax, word [rbp - 0x71]
shl r15d, 0x10
or r15, rax
lea eax, [rdx + 0x62]
cmp al, 1
lea eax, [rdx + 0x64]
setbe r13b
cmp al, 1
setbe sil
test r13b, r13b
je 0x140059ef8
mov edi, dword [rbp - 0x69]
cmp dl, 0x9f
mov eax, 0xffffff88
mov ecx, 0x78
cmove eax, ecx
mov ebx, 0x20a
imul eax, r8d
shl eax, 0x10
cdqe
mov qword [rbp - 0x61], rax
jmp 0x140059fa4
test sil, sil
je 0x140059f25
mov edi, dword [rbp - 0x69]
cmp dl, 0x9c
mov eax, 0xffffff88
mov ecx, 0x78
cmove ecx, eax
mov ebx, 0x20e
imul ecx, r8d
shl ecx, 0x10
movsxd rax, ecx
mov qword [rbp - 0x61], rax
jmp 0x140059fa4
mov ecx, edx
sub ecx, 1
je 0x140059f94
sub ecx, 1
je 0x140059f82
sub ecx, 2
je 0x140059f78
sub ecx, 1
je 0x140059f5e
cmp ecx, 1
jne 0x140059d0f
mov ebx, 0x20b
mov qword [rbp - 0x51], 0x20000
mov qword [rbp - 0x61], 0x20040
lea edi, [rbx + 1]
jmp 0x140059fa4
mov ebx, 0x20b
mov qword [rbp - 0x51], 0x10000
mov qword [rbp - 0x61], 0x10020
lea edi, [rbx + 1]
jmp 0x140059fa4
mov ebx, 0x207
lea edi, [rbx + 1]
jmp 0x140059fa4
mov ebx, 0x204
mov qword [rbp - 0x61], 2
lea edi, [rbx + 1]
jmp 0x140059fa4
mov ebx, 0x201
mov qword [rbp - 0x61], 1
lea edi, [rbx + 1]
cmp byte [rbp - 0x79], 0
mov byte [rbp - 0x78], 0
je 0x14005a000
mov rcx, qword [rbp - 0x59]
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x69], eax
mov r12d, eax
test eax, eax
je 0x140059ff4
cmp eax, dword [0x14014c878]
je 0x140059ff4
mov rcx, qword [rbp - 0x59]
call fcn.1400c92d0
test al, al
jne 0x140059ff4
mov ecx, dword [0x14014c878]
mov r8d, 1
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [rbp - 0x78]
mov rcx, qword [rbp - 0x59]
call qword [sym.imp.USER32.dll_SetActiveWindow]
jmp 0x14005a008
mov r12d, dword [rbp - 0x69]
mov dword [rbp - 0x69], r12d
test r13b, r13b
jne 0x14005a0d7
test sil, sil
jne 0x14005a0d7
mov esi, dword [rbp + 0x57]
mov r13, qword [rbp - 0x61]
mov r12, qword [rbp - 0x51]
mov eax, dword [rbp - 0x75]
cmp eax, 1
je 0x14005a07c
mov r9, r15
mov r8, r13
mov edx, ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x140145a80]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14005a075
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14014c878], eax
mov rax, qword [0x140145a80]
mov ecx, dword [rax + 0x78]
je 0x14005a06b
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005a075
mov edx, 1
call fcn.1400018c0
mov eax, dword [rbp - 0x75]
test eax, eax
je 0x14005a0c7
mov r9, r15
mov r8, r12
mov edx, edi
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x140145a80]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14005a0c4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14014c878], eax
mov rax, qword [0x140145a80]
mov ecx, dword [rax + 0x78]
je 0x14005a0ba
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005a0c4
mov edx, 1
call fcn.1400018c0
mov eax, dword [rbp - 0x75]
sub rsi, 1
jne 0x14005a028
mov r12d, dword [rbp - 0x69]
jmp 0x14005a120
mov r8, qword [rbp - 0x61]
mov r9, r15
mov edx, ebx
mov rcx, r14
call qword [sym.imp.USER32.dll_PostMessageW]
mov rax, qword [0x140145a80]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14005a120
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14014c878], eax
mov rax, qword [0x140145a80]
mov ecx, dword [rax + 0x78]
je 0x14005a116
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005a120
mov edx, 1
call fcn.1400018c0
cmp byte [rbp - 0x78], 0
je 0x14005a138
mov ecx, dword [0x14014c878]
xor r8d, r8d
mov edx, r12d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [0x14014a3b0]
lea rdx, [0x14010d31c]
xor r9d, r9d
mov byte [rsp + 0x20], 1
lea r8, [r9 - 1]
call fcn.1400c6a70
jmp 0x14005a16b
lea r9, [0x14010d28c]
xor r8d, r8d
mov rcx, rsi
call fcn.140050010
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret