Function at 0x140009ac0
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x98
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rax, qword [0x140042010]
xor rax, rsp
mov qword [rbp - 9], rax
mov dword [rbp - 0x59], r9d
movzx r15d, r8w
mov rbx, rdx
mov qword [rbp - 0x51], rcx
movzx edi, word [rbp + 0x77]
movzx r13d, dil
shr r13b, 3
and r13b, 1
mov byte [rbp - 0x5e], r13b
movzx r12d, dil
shr r12b, 1
and r12b, 1
movzx r14d, dil
and r14b, 1
mov byte [rbp - 0x60], r14b
movzx esi, dil
shr sil, 4
and sil, 1
mov byte [rbp - 0x5f], sil
movzx eax, di
shr ax, 8
and al, 1
mov word [rbp - 0x5d], ax
mov byte [rbp - 0x61], 0
call fcn.140014120
test al, al
je 0x140009c25
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140043e8c], eax
jle 0x140009ba6
lea rcx, [0x140043e8c]
call fcn.14001777c
cmp dword [0x140043e8c], 0xffffffff
jne 0x140009ba6
lea rcx, str.input
call fcn.1400141c0
mov byte [0x140043e9e], al
lea rcx, [0x140043e8c]
call fcn.14001771c
cmp byte [0x140043e9e], 0
je 0x140009c25
mov byte [rbp - 0x61], 1
mov word [rbp - 0x41], r15w
mov eax, dword [rbp - 0x59]
mov dword [rbp - 0x3d], eax
mov word [rbp - 0x39], di
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x41]
call fcn.14000d6a0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140009bda
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.keypress:__s
call fcn.1400146a0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x140009c25
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a0f5
call fcn.140017530
mov rdi, qword [rbp - 0x51]
cmp byte [rdi + 0xeb], 0
je 0x140009d50
lea eax, [r15 - 0x23]
cmp ax, 5
ja 0x140009d50
test r13b, r13b
jne 0x140009d50
test r12b, r12b
jne 0x140009d50
test r14b, r14b
jne 0x140009d50
test sil, sil
jne 0x140009d50
mov r10, qword [rbx]
mov rcx, qword [rbx + 8]
sub rcx, r10
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
xor r14d, r14d
add rdx, rax
je 0x140009cc1
mov dword [rbp - 0x59], r14d
lea r9, [rbp - 0x59]
mov r8d, edx
mov rdx, r10
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x140009cba
lea rcx, str.WriteConsoleInputW_failed
call fcn.1400146a0
mov rax, qword [rbx]
mov qword [rbx + 8], rax
cmp byte [rbp - 0x61], r14b
je 0x140009cd3
lea rcx, str.sending_keypress_to_console_HWND
call fcn.1400146a0
mov rax, qword [rdi]
mov rbx, qword [rax]
movzx edi, r15w
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xff
cmova eax, r14d
movzx esi, r15w
shl eax, 0x10
mov r9d, eax
or r9, 1
mov r8d, esi
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rbp - 0x51]
mov rax, qword [rcx]
mov rbx, qword [rax]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xff
cmova eax, r14d
shl eax, 0x10
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
mov r8d, esi
mov edx, 0x101
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14000a0d5
xor r14d, r14d
movzx edi, r14w
lea eax, [r14 + 1]
lea ecx, [rax + 0x10]
test r13b, r13b
je 0x140009db3
lea edi, [rax + 7]
mov dword [rbp - 0x41], eax
mov dword [rbp - 0x3d], eax
mov dword [rbp - 0x39], 0x110001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
mov dword [rbp - 0x31], edi
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x140009da2
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], edi
add qword [rbx + 8], 0x14
jmp 0x140009dae
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
mov eax, 1
mov ecx, 0x12
test r12b, r12b
je 0x140009e15
or di, 2
mov dword [rbp - 0x41], 1
mov dword [rbp - 0x3d], eax
mov dword [rbp - 0x39], 0x120001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
movzx eax, di
mov dword [rbp - 0x31], eax
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x140009e04
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009e10
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
mov ecx, 0x12
mov r13d, 0x100
cmp byte [rbp - 0x60], r14b
je 0x140009e7c
or di, 1
mov dword [rbp - 0x41], 1
mov eax, 1
mov dword [rbp - 0x3d], eax
mov dword [rbp - 0x39], 0x120001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
movzx eax, di
or eax, r13d
mov dword [rbp - 0x31], eax
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x140009e70
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009e7c
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
mov ecx, 0x10
test sil, sil
je 0x140009edd
or di, cx
mov dword [rbp - 0x41], 1
mov eax, 1
mov dword [rbp - 0x3d], eax
mov dword [rbp - 0x39], 0x100001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
movzx eax, di
mov dword [rbp - 0x31], eax
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x140009ed1
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009edd
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
movzx esi, di
or si, r13w
cmp byte [rbp - 0x5d], r14b
cmove si, di
mov rcx, qword [rbp - 0x51]
cmp byte [rcx + 0xeb], r14b
mov rcx, rbx
je 0x140009f13
movzx r9d, word [rbp + 0x87]
mov r8d, dword [rbp + 0x7f]
movzx edx, r15w
call fcn.14000a900
jmp 0x140009f2a
mov word [rsp + 0x20], si
mov r9d, dword [rbp - 0x59]
movzx r8d, r15w
mov edx, 1
call fcn.14000a100
mov word [rsp + 0x20], si
mov r9d, dword [rbp + 0x6f]
movzx r8d, r15w
xor edx, edx
mov rcx, rbx
call fcn.14000a100
movzx edi, si
mov eax, 0xfeff
and di, ax
cmp byte [rbp - 0x5d], r14b
cmove di, si
cmp byte [rbp - 0x5f], r14b
je 0x140009fb4
mov eax, 0xffef
and di, ax
mov qword [rbp - 0x41], 1
mov dword [rbp - 0x39], 0x100001
mov ecx, 0x10
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
movzx eax, di
mov dword [rbp - 0x31], eax
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x140009fa8
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009fb4
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
mov r15d, 0x12
cmp byte [rbp - 0x60], r14b
je 0x14000a01b
mov eax, 0xfffe
and di, ax
mov qword [rbp - 0x41], 1
mov dword [rbp - 0x39], 0x120001
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
movzx eax, di
or eax, r13d
mov dword [rbp - 0x31], eax
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x14000a00f
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x14000a01b
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
test r12b, r12b
je 0x14000a078
mov eax, 0xfffd
and di, ax
mov qword [rbp - 0x41], 1
mov dword [rbp - 0x39], 0x120001
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
movzx eax, di
mov dword [rbp - 0x31], eax
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x14000a06c
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x14000a078
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
cmp byte [rbp - 0x5e], r14b
je 0x14000a0d5
mov qword [rbp - 0x41], 1
mov dword [rbp - 0x39], 0x110001
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x35], ax
mov word [rbp - 0x33], r14w
movzx eax, di
and eax, 0xfff7
mov dword [rbp - 0x31], eax
mov rdx, qword [rbx + 8]
cmp qword [rbx + 0x10], rdx
je 0x14000a0c9
movups xmm0, xmmword [rbp - 0x41]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x14000a0d5
lea r8, [rbp - 0x41]
mov rcx, rbx
call fcn.14000a630
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1400174d0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14001bb5c
int3