Function at 0x2bbefc190
Capabilities:
Log keystrokes

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
mov rbx, rdx
mov rsi, r9
cmp r8d, 3
je 0x2bbefc1e8
mov rax, qword [0x2bc041fd0]
mov r8, rsi
mov edx, 1
mov rcx, rbx
lea r9, str.window_keySym
mov rax, qword [rax]
call qword [rax + 0x850]
mov eax, 1
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rdx
call sym.tcl9tk90.dll_Tk_MainWindow
mov rbp, qword [0x2bc041fd0]
mov rcx, qword [rsi + 8]
xor edx, edx
mov rdi, rax
mov rax, qword [rbp]
call qword [rax + 0x1468]
mov r8, rdi
mov rcx, rbx
mov rdx, rax
call sym.tcl9tk90.dll_Tk_NameToWindow
mov rdi, rax
test rax, rax
je 0x2bbefc25e
mov rcx, rbx
call sym.TkpGetBindingXEvent
mov rcx, rbx
mov rdx, qword [rsi + 0x10]
lea r8, [rsp + 0x3c]
mov r12, rax
mov rax, qword [rbp]
call qword [rax + 0x140]
mov ebx, eax
test eax, eax
jne 0x2bbefc1cd
mov edx, dword [r12]
movsxd r8, dword [rsp + 0x3c]
cmp edx, 2
je 0x2bbefc268
cmp edx, 3
je 0x2bbefc398
xor eax, eax
jmp 0x2bbefc1d2
cmp r8d, 0xffe9
je 0x2bbefc420
cmp r8d, 0xffea
je 0x2bbefc4c0
cmp r8d, 0xffc7
je 0x2bbefc470
mov rcx, qword [rdi]
mov rdx, r8
call sym.tcl9tk90.dll_XKeysymToKeycode
xor edx, edx
mov ebp, eax
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x2bbefc25e
movdqu xmm0, xmmword [r12]
movdqu xmm1, xmmword [r12 + 0x10]
shl eax, 0x10
movdqu xmm2, xmmword [r12 + 0x20]
mov rdx, qword [r12 + 0x50]
or eax, 0x20000000
movdqu xmm3, xmmword [r12 + 0x30]
movdqu xmm4, xmmword [r12 + 0x40]
movups xmmword [rsp + 0x40], xmm0
movsxd rsi, eax
mov rcx, qword [rdi + 0x28]
mov qword [rsp + 0x90], rdx
movups xmmword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x60], xmm2
movups xmmword [rsp + 0x70], xmm3
movups xmmword [rsp + 0x80], xmm4
call sym.tcl9tk90.dll_Tk_GetHWND
mov r12, qword [sym.imp.USER32.dll_DefWindowProcW]
mov r9d, ebp
mov qword [rsp + 0x20], rsi
mov r13, qword [sym.imp.USER32.dll_CallWindowProcW]
mov rdx, rax
mov r8d, 0x104
mov rcx, r12
call r13
movzx ebp, byte [rsp + 0x97]
mov dword [rsp + 0x3c], 0
test ebp, ebp
je 0x2bbefc25e
nop word cs:[rax + rax]
mov rcx, qword [rdi + 0x28]
movsxd rbx, ebx
movsx rbx, byte [rsp + rbx + 0x90]
call sym.tcl9tk90.dll_Tk_GetHWND
mov qword [rsp + 0x20], rsi
mov r8d, 0x106
mov rcx, r12
mov r9, rbx
mov rdx, rax
call r13
mov eax, dword [rsp + 0x3c]
lea ebx, [rax + 1]
mov dword [rsp + 0x3c], ebx
cmp ebx, ebp
jl 0x2bbefc350
xor eax, eax
jmp 0x2bbefc1d2
cmp r8d, 0xffe9
je 0x2bbefc57e
cmp r8d, 0xffea
je 0x2bbefc532
cmp r8d, 0xffc7
je 0x2bbefc4e6
mov rcx, qword [rdi]
mov rdx, r8
call sym.tcl9tk90.dll_XKeysymToKeycode
xor edx, edx
mov esi, eax
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
test eax, eax
je 0x2bbefc25e
mov rcx, qword [rdi + 0x28]
shl ebx, 0x10
call sym.tcl9tk90.dll_Tk_GetHWND
mov edx, ebx
mov r9d, esi
mov r8d, 0x105
or edx, 0xe0000000
mov rcx, qword [sym.imp.USER32.dll_DefWindowProcW]
movsxd rdx, edx
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
xor eax, eax
jmp 0x2bbefc1d2
xor edx, edx
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi + 0x28]
mov ebx, eax
call sym.tcl9tk90.dll_Tk_GetHWND
shl ebx, 0x10
or ebx, 0x20000000
movsxd rdx, ebx
mov rcx, qword [sym.imp.USER32.dll_DefWindowProcW]
mov r9d, 0x12
mov r8d, 0x104
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
xor eax, eax
jmp 0x2bbefc1d2
xor edx, edx
mov ecx, 0x79
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi + 0x28]
mov ebx, eax
call sym.tcl9tk90.dll_Tk_GetHWND
shl ebx, 0x10
mov rcx, qword [sym.imp.USER32.dll_DefWindowProcW]
mov r9d, 0x79
movsxd rdx, ebx
mov r8d, 0x104
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
xor eax, eax
jmp 0x2bbefc1d2
xor edx, edx
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi + 0x28]
mov ebx, eax
call sym.tcl9tk90.dll_Tk_GetHWND
shl ebx, 0x10
or ebx, 0x21000000
jmp 0x2bbefc441
xor edx, edx
mov ecx, 0x79
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi + 0x28]
mov ebx, eax
call sym.tcl9tk90.dll_Tk_GetHWND
shl ebx, 0x10
mov rcx, qword [sym.imp.USER32.dll_DefWindowProcW]
mov r9d, 0x79
or ebx, 0xc0000000
mov r8d, 0x105
movsxd rdx, ebx
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
xor eax, eax
jmp 0x2bbefc1d2
xor edx, edx
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi + 0x28]
mov ebx, eax
call sym.tcl9tk90.dll_Tk_GetHWND
shl ebx, 0x10
or ebx, 0xe1000000
movsxd rdx, ebx
mov rcx, qword [sym.imp.USER32.dll_DefWindowProcW]
mov r9d, 0x12
mov r8d, 0x105
mov qword [rsp + 0x20], rdx
mov rdx, rax
call qword [sym.imp.USER32.dll_CallWindowProcW]
xor eax, eax
jmp 0x2bbefc1d2
xor edx, edx
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov rcx, qword [rdi + 0x28]
mov ebx, eax
call sym.tcl9tk90.dll_Tk_GetHWND
shl ebx, 0x10
or ebx, 0xe0000000
jmp 0x2bbefc553