Function at 0x140002897
Capabilities:
Log keystrokes

Disassembly:
jmp 0x1400126a0
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x38], r9d
movzx r14d, r8w
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x40], rcx
movzx ebx, word [rsp + 0x108]
movzx r12d, bl
shr r12b, 3
and r12b, 1
movzx r15d, bl
shr r15b, 1
and r15b, 1
movzx ebp, bl
and bpl, 1
mov byte [rsp + 0x31], bpl
movzx esi, bl
shr sil, 4
and sil, 1
mov byte [rsp + 0x32], sil
movzx eax, bx
shr ax, 8
and al, 1
mov word [rsp + 0x34], ax
mov byte [rsp + 0x30], 0
call fcn.14000335f
test al, al
je 0x14001283b
mov ecx, dword [0x1400aa988]
mov rax, qword gs:[0x58]
mov edx, 0x104
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400aa914], ecx
jle 0x140012794
lea rcx, [0x1400aa914]
call fcn.1400011db
cmp dword [0x1400aa914], 0xffffffff
jne 0x140012794
lea rcx, str.input
call fcn.140003e2c
mov byte [0x1400aa910], al
lea rcx, [0x1400aa914]
call fcn.1400015dc
cmp byte [0x1400aa910], 0
je 0x14001283b
mov byte [rsp + 0x30], 1
mov word [rsp + 0x50], r14w
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x54], eax
mov word [rsp + 0x58], bx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x50]
call fcn.140004435
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400127d3
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.keypress:__s
call fcn.140001e10
nop
mov rax, qword [rsp + 0x78]
cmp rax, 0x10
jb 0x14001283b
inc rax
mov rcx, qword [rsp + 0x60]
cmp rax, 0x1000
jb 0x140012836
test cl, 0x1f
je 0x140012809
call fcn.140003f85
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140012818
call fcn.140003f85
int3
sub rcx, rax
cmp rcx, 8
jae 0x140012827
call fcn.140003f85
int3
cmp rcx, 0x27
jbe 0x140012833
call fcn.140003f85
int3
mov rcx, rax
call fcn.140001a28
cmp byte [r13 + 0xeb], 0
je 0x140012918
lea eax, [r14 - 0x23]
cmp ax, 5
ja 0x140012918
test r12b, r12b
jne 0x140012918
test r15b, r15b
jne 0x140012918
test bpl, bpl
jne 0x140012918
test sil, sil
jne 0x140012918
mov rdx, rdi
mov rcx, r13
call fcn.140001389
cmp byte [rsp + 0x30], sil
je 0x140012899
lea rcx, str.sending_keypress_to_console_HWND
call fcn.140001e10
mov rax, qword [r13]
mov rbx, qword [rax]
movzx edi, r14w
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebp, ebp
cmp eax, 0xff
cmova eax, ebp
movzx esi, r14w
shl eax, 0x10
mov r9d, eax
or r9, 1
mov r8d, esi
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rbx, qword [rax]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xff
cmova eax, ebp
shl eax, 0x10
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
mov r8d, esi
mov edx, 0x101
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140012acb
xor ebp, ebp
test r12b, r12b
je 0x14001293e
mov eax, 8
movzx ebp, ax
xor r9d, r9d
lea r8d, [rax + 9]
mov word [rsp + 0x20], ax
lea edx, [rax - 7]
mov rcx, rdi
call fcn.1400014a1
test r15b, r15b
je 0x14001295f
or bp, 2
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], bp
lea edx, [r9 + 1]
mov rcx, rdi
call fcn.1400014a1
mov r13d, 0x100
cmp byte [rsp + 0x31], 0
je 0x14001298f
or bp, 1
movzx eax, bp
or ax, r13w
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], ax
lea edx, [r9 + 1]
mov rcx, rdi
call fcn.1400014a1
test sil, sil
je 0x1400129b0
or bp, 0x10
xor r9d, r9d
lea r8d, [r9 + 0x10]
mov word [rsp + 0x20], bp
lea edx, [r9 + 1]
mov rcx, rdi
call fcn.1400014a1
movzx esi, bp
or si, r13w
cmp byte [rsp + 0x34], 0
cmove si, bp
mov rcx, qword [rsp + 0x40]
cmp byte [rcx + 0xeb], 0
mov rcx, rdi
je 0x1400129ed
movzx r9d, word [rsp + 0x118]
mov r8d, dword [rsp + 0x110]
movzx edx, r14w
call fcn.14000164a
jmp 0x140012a05
mov word [rsp + 0x20], si
mov r9d, dword [rsp + 0x38]
movzx r8d, r14w
mov edx, 1
call fcn.140004417
mov word [rsp + 0x20], si
mov r9d, dword [rsp + 0x100]
movzx r8d, r14w
xor edx, edx
mov rcx, rdi
call fcn.140004417
movzx ebx, si
mov eax, 0xfeff
and bx, ax
cmp byte [rsp + 0x34], 0
cmove bx, si
cmp byte [rsp + 0x32], 0
je 0x140012a59
mov eax, 0xffef
and bx, ax
xor r9d, r9d
lea r8d, [r9 + 0x10]
mov word [rsp + 0x20], bx
xor edx, edx
mov rcx, rdi
call fcn.1400014a1
cmp byte [rsp + 0x31], 0
je 0x140012a85
mov eax, 0xfffe
and bx, ax
movzx eax, bx
or ax, r13w
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], ax
xor edx, edx
mov rcx, rdi
call fcn.1400014a1
test r15b, r15b
je 0x140012aa8
mov eax, 0xfffd
and bx, ax
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], bx
xor edx, edx
mov rcx, rdi
call fcn.1400014a1
test r12b, r12b
je 0x140012acb
mov eax, 0xfff7
and bx, ax
xor r9d, r9d
lea r8d, [r9 + 0x11]
mov word [rsp + 0x20], bx
xor edx, edx
mov rcx, rdi
call fcn.1400014a1
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140003cb0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret