Function at 0x140077810
Capabilities:
Get graphical window text
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0xa30]
sub rsp, 0xb30
movaps xmmword [rsp + 0xb20], xmm6
mov rdi, rcx
xor r14d, r14d
mov dword [rbp + 0xa68], r14d
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140077e46
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rbx, str.amdsaTs
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140031e00
lea rsi, [r14 - 1]
test al, al
jne 0x14007789b
mov rax, rsi
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140077880
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140077e51
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rbx, str.a2Nsc11xY19wYWY
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140031e00
test al, al
jne 0x1400778f1
mov rax, rsi
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400778d6
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140077e5c
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rbx, str.bW5jbF1qZ2xp
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140031e00
test al, al
jne 0x14007794b
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140077930
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140032190
nop
mov ecx, 0x60
call fcn.1401833e0
mov rcx, rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], 0x5c
mov qword [rbp - 0x40], 0x5f
movaps xmm0, xmmword [str.eSBfbm4gOHkga2Nsc11xY19wYWYgOHkgcm1uIDgjYiogamNkciA4I2IqIGBtcnJtayA4I2IqIHBnZWZyIDgjYnt7ew]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1401e82a0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1401e82b0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1401e82c0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [0x1401e82d0]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x1401e82e0]
movsd qword [rax + 0x50], xmm1
mov eax, dword [0x1401e82e8]
mov dword [rcx + 0x58], eax
mov byte [rcx + 0x5c], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140077460]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov r15, rax
call fcn.140077e80
mov qword [rbp + 0xa78], r14
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x140077a90
mov r8d, 0x100
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
lea r8, [rbp - 0x78]
mov rdx, rbx
call qword [rax + 0x30]
test eax, eax
jne 0x140077a90
mov eax, 3
mov word [rbp - 0x70], ax
mov dword [rbp - 0x68], 0xc354
mov rcx, qword [rdi + 0x10]
mov rax, qword [rcx]
movups xmm0, xmmword [rbp - 0x70]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm1, qword [rbp - 0x60]
movsd qword [rbp - 0x20], xmm1
lea r9, [rbp - 0x80]
lea r8, [rbp - 0x30]
mov edx, 0x7533
call qword [rax + 0xb8]
test eax, eax
jne 0x140077a86
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea r9, [rbp + 0xa78]
mov r8, qword [rbp - 0x80]
mov edx, 2
call qword [rax + 0x28]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetWindowRect]
call fcn.140056030
movaps xmm6, xmm0
xorps xmm1, xmm1
ucomisd xmm0, xmm1
jp 0x140077ab2
je 0x140077b1a
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0x30]
divsd xmm0, xmm6
call fcn.1401981a8
cvttsd2si eax, xmm0
mov dword [rsp + 0x30], eax
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0x38]
divsd xmm0, xmm6
call fcn.1401981a8
cvttsd2si eax, xmm0
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0x34]
divsd xmm0, xmm6
call fcn.1401981a8
cvttsd2si eax, xmm0
mov dword [rsp + 0x34], eax
xorps xmm0, xmm0
cvtsi2sd xmm0, dword [rsp + 0x3c]
divsd xmm0, xmm6
call fcn.1401981a8
cvttsd2si eax, xmm0
mov dword [rsp + 0x3c], eax
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov dword [rbp + 0xa68], 1
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x70]
call fcn.14004b570
nop
mov r14, qword [rbp - 0x68]
mov rbx, qword [rbp - 0x70]
cmp rbx, r14
je 0x140077bb1
nop word [rax + rax]
movzx r9d, byte [rbx]
add r9b, 2
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
cmp rcx, rdx
jae 0x140077b9a
lea rax, [rcx + 1]
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x60]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x60]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140077ba4
lea rcx, [rsp + 0x60]
call fcn.1400290b0
add rbx, 2
cmp rbx, r14
jne 0x140077b60
mov rbx, qword [rbp - 0x70]
test rbx, rbx
je 0x140077bf1
mov rax, qword [rbp - 0x60]
sub rax, rbx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140077be9
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077e67
mov rcx, rbx
call fcn.140183144
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x3c]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x30]
mov r8d, dword [rsp + 0x34]
lea rcx, [rbp + 0x220]
call fcn.14005fa00
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140077c66
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077c61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077e6d
call fcn.140183144
mov rbx, qword [rdi]
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140077e73
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp + 0xa70], rax
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xa70]
call fcn.140031e00
test al, al
jne 0x140077cb6
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0xa70]
call fcn.140031070
nop
mov rbx, qword [rbx + 0x68]
mov r14, qword [rbp + 0xa70]
lea rcx, [r14 - 0x18]
call fcn.1400318c0
add rax, 0x18
mov qword [rsp + 0x58], rax
mov r8d, 0x20
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.14006cf00
nop
mov eax, esi
lock xadd dword [r14 - 8], eax
sub eax, 1
jg 0x140077d02
mov rcx, qword [r14 - 0x18]
mov rax, qword [rcx]
lea rdx, [r14 - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
cmp byte [rax + 0x171], 0
jne 0x140077d73
nop
mov rdx, qword [rbp + 0xa78]
mov rcx, rdi
call fcn.140078050
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jle 0x140077d51
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x10]
call qword [sym.imp.USER32.dll_DispatchMessageW]
call fcn.140077e80
cmp qword [rdi + 8], rax
jne 0x140077d73
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rdi]
cmp byte [rax + 0x171], 0
je 0x140077d10
mov rcx, qword [rbp + 0xa78]
test rcx, rcx
je 0x140077d85
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, r15
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140077dc7
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140077dc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140077e40
call fcn.140183144
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140077de6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140077e05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140077e21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xb60]
movaps xmm6, xmmword [rsp + 0xb20]
add rsp, 0xb30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140189c24
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
call fcn.140189c24
nop
call fcn.140189c24
int3
mov ecx, 0x80004005
call fcn.140032160
int3