Function at 0x4072d0
Capabilities:
Log keystrokes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
mov esi, dword [rsp + 0xf8]
mov eax, dword [rsp + 0x108]
mov rbp, rcx
mov rdi, rdx
mov ebx, r8d
mov dword [rsp + 0xe8], r9d
mov word [rsp + 0x46], r8w
mov dword [rsp + 0x40], eax
mov eax, esi
mov r12d, esi
and eax, 1
mov r13d, esi
mov r14d, esi
mov word [rsp + 0x3e], ax
mov eax, esi
and r12d, 8
and ax, 0x100
and r13d, 2
and r14d, 0x10
mov word [rsp + 0x44], ax
call fcn.00414460
test al, al
jne 0x407504
xor r15d, r15d
cmp byte [rbp + 0xeb], 0
je 0x40735c
lea eax, [rbx - 0x23]
cmp ax, 5
jbe 0x407470
xor r15d, r15d
test r12w, r12w
jne 0x407690
test r13w, r13w
jne 0x407600
cmp word [rsp + 0x3e], 0
jne 0x40762e
test r14w, r14w
jne 0x407665
or r15w, word [rsp + 0x44]
cmp byte [rbp + 0xeb], 0
jne 0x407442
mov r9d, dword [rsp + 0xe8]
movzx esi, r15w
movzx ebx, bx
mov dword [rsp + 0x20], esi
mov r8d, ebx
mov edx, 1
mov rcx, rdi
call fcn.00407200
mov r9d, dword [rsp + 0xf0]
xor edx, edx
mov dword [rsp + 0x20], esi
mov r8d, ebx
mov rcx, rdi
call fcn.00407200
mov edx, r15d
and dh, 0xfe
cmp word [rsp + 0x44], 0
cmovne r15d, edx
test r14w, r14w
jne 0x407582
cmp word [rsp + 0x3e], 0
jne 0x4075ad
test r13w, r13w
jne 0x4075db
test r12w, r12w
je 0x40742e
mov eax, r15d
xor r9d, r9d
mov r8d, 0x11
and eax, 0xfff7
xor edx, edx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.00407150
nop
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
movzx r9d, word [rsp + 0x40]
mov r8d, dword [rsp + 0x100]
movzx ebx, bx
mov edx, ebx
mov rcx, rdi
movzx esi, r15w
call fcn.004087e0
jmp 0x4073bf
test r12w, r12w
jne 0x40735c
test r13w, r13w
jne 0x40735c
and esi, 1
jne 0x4076c0
test r14w, r14w
jne 0x4076c0
test r15b, r15b
jne 0x407710
xor edx, edx
movzx ecx, bx
mov edi, 0xc0000001
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xff
mov r9d, 1
ja 0x4074ce
shl eax, 0x10
mov r9d, eax
or eax, 0xc0000001
or r9d, 1
mov edi, eax
movzx ebx, word [rsp + 0x46]
mov rax, qword [rbp]
mov edx, 0x100
mov rsi, qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rax]
mov r8, rbx
call rsi
mov rax, qword [rbp]
mov r9, rdi
mov r8, rbx
mov edx, 0x101
mov rcx, qword [rax]
call rsi
jmp 0x40742e
movzx eax, byte [0x004de030]
test al, al
je 0x4076d0
movzx r15d, byte [0x004de038]
test r15b, r15b
je 0x407343
mov eax, dword [rsp + 0xe8]
lea rdx, [rsp + 0x50]
mov word [rsp + 0x50], bx
mov word [rsp + 0x58], si
mov dword [rsp + 0x54], eax
lea rax, [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.0040c580
mov rdx, qword [rsp + 0x60]
lea rcx, str.keypress:__s
call fcn.00413ac0
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x60]
add rax, 0x10
cmp rcx, rax
je 0x407346
call fcn.004aaf10
jmp 0x407346
and r15d, 0xffffffef
xor r9d, r9d
mov r8d, 0x10
movzx edx, r15w
mov rcx, rdi
mov dword [rsp + 0x20], edx
xor edx, edx
call fcn.00407150
cmp word [rsp + 0x3e], 0
je 0x4073fe
and r15d, 0xfffffffe
xor r9d, r9d
mov r8d, 0x12
mov edx, r15d
mov rcx, rdi
or dh, 1
movzx edx, dx
mov dword [rsp + 0x20], edx
xor edx, edx
call fcn.00407150
test r13w, r13w
je 0x407408
and r15d, 0xfffffffd
xor r9d, r9d
mov r8d, 0x12
movzx edx, r15w
mov rcx, rdi
mov dword [rsp + 0x20], edx
xor edx, edx
call fcn.00407150
jmp 0x407408
or r15d, 2
xor r9d, r9d
mov r8d, 0x12
movzx edx, r15w
mov rcx, rdi
mov dword [rsp + 0x20], edx
mov edx, 1
call fcn.00407150
cmp word [rsp + 0x3e], 0
je 0x40737f
mov eax, r15d
mov esi, r15d
xor r9d, r9d
or ax, 0x101
mov r8d, 0x12
mov edx, 1
movzx eax, ax
mov rcx, rdi
or esi, 1
mov dword [rsp + 0x20], eax
mov r15d, esi
call fcn.00407150
test r14w, r14w
je 0x407389
or r15d, 0x10
xor r9d, r9d
mov r8d, 0x10
movzx edx, r15w
mov rcx, rdi
mov dword [rsp + 0x20], edx
mov edx, 1
call fcn.00407150
jmp 0x407389
mov dword [rsp + 0x20], 8
xor r9d, r9d
mov r8d, 0x11
mov edx, 1
mov rcx, rdi
mov r15d, 8
call fcn.00407150
jmp 0x407369
xor r15d, r15d
jmp 0x407373
lea rcx, [0x004de030]
call fcn.004ab580
test eax, eax
je 0x407513
lea rcx, str.input
call fcn.00413d90
lea rcx, [0x004de030]
mov r15d, eax
mov byte [0x004de038], al
call fcn.004ab690
jmp 0x40751b
lea rcx, str.sending_keypress_to_console_HWND
call fcn.00413ac0
jmp 0x4074a0