Function at 0x1400012a0
Capabilities:
Link many functions at runtime
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov r14, r8
mov dword [rsp + 0x44], edx
mov rbx, rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 8], rcx
xor r13d, r13d
mov dword [rsp + 0x40], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov ecx, r13d
mov qword [rsp + 0x58], rcx
mov edi, 0xf
mov edx, edi
mov qword [rsp + 0x60], rdx
mov byte [rsp + 0x48], cl
mov dword [rsp + 0x40], 2
lea rsi, [0x14000a238]
lea r15, [0x14000a260]
movsxd rax, dword [rsi]
movzx r9d, byte [rax + r14]
cmp rcx, rdx
jae 0x14000134f
lea rax, [rcx + 1]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x48]
cmp rdx, rdi
cmova rax, qword [rsp + 0x48]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001359
lea rcx, [rsp + 0x48]
call fcn.140004b20
add rsi, 4
cmp rsi, r15
jge 0x14000136e
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
jmp 0x140001320
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], rdi
cmova rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r15, rax
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x1400013c7
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400013c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400013c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050bc
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x48], 0
test r15, r15
jne 0x1400013f1
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], rdi
mov byte [rbx], 0
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov rcx, r13
mov qword [rsp + 0x78], rcx
mov rdx, rdi
mov qword [rbp - 0x80], rdx
mov byte [rsp + 0x68], cl
mov dword [rsp + 0x40], 4
lea rsi, [0x14000a0f0]
lea r12, [0x14000a130]
movsxd rax, dword [rsi]
movzx r9d, byte [rax + r14]
cmp rcx, rdx
jae 0x140001452
lea rax, [rcx + 1]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x68]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x68]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14000145c
lea rcx, [rsp + 0x68]
call fcn.140004b20
add rsi, 4
cmp rsi, r12
jge 0x140001470
mov rdx, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x78]
jmp 0x140001422
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rdx, qword [rsp + 0x68]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rbp + 8], rax
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x1400014cf
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400014ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400014ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050bc
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], rdi
mov byte [rsp + 0x68], 0
test rsi, rsi
je 0x1400013db
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov rcx, r13
mov qword [rbp - 0x68], rcx
mov rdx, rdi
mov qword [rbp - 0x60], rdx
mov byte [rbp - 0x78], cl
mov dword [rsp + 0x40], 8
lea rsi, [0x14000a1f0]
lea r12, [0x14000a234]
nop dword [rax]
nop dword [rax + rax]
movsxd rax, dword [rsi]
movzx r9d, byte [rax + r14]
cmp rcx, rdx
jae 0x14000154d
lea rax, [rcx + 1]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x78]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x78]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001556
lea rcx, [rbp - 0x78]
call fcn.140004b20
add rsi, 4
cmp rsi, r12
jge 0x140001569
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x68]
jmp 0x140001520
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rdx, qword [rbp - 0x78]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x1400015c5
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050bc
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], rdi
mov byte [rbp - 0x78], 0
test rsi, rsi
je 0x1400013db
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
mov rcx, r13
mov qword [rbp - 0x48], rcx
mov rdx, rdi
mov qword [rbp - 0x40], rdx
mov byte [rbp - 0x58], cl
mov dword [rsp + 0x40], 0x10
lea rsi, [0x14000a260]
lea r12, vtable.type_info.0
nop dword [rax + rax]
movsxd rax, dword [rsi]
movzx r9d, byte [rax + r14]
cmp rcx, rdx
jae 0x14000163d
lea rax, [rcx + 1]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x58]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x58]
mov byte [rcx + rax], r9b
mov byte [rcx + rax + 1], 0
jmp 0x140001646
lea rcx, [rbp - 0x58]
call fcn.140004b20
add rsi, 4
cmp rsi, r12
jge 0x140001659
mov rdx, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
jmp 0x140001610
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0xf
cmova rdx, qword [rbp - 0x58]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x1400016b1
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400016ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400016ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050bc
mov qword [rbp - 0x48], r13
mov qword [rbp - 0x40], rdi
mov byte [rbp - 0x58], 0
test r12, r12
je 0x1400013db
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov rcx, r13
mov qword [rbp - 0x28], rcx
mov rdx, rdi
mov qword [rbp - 0x20], rdx
mov byte [rbp - 0x38], cl
mov dword [rsp + 0x40], 0x20
lea rsi, [0x14000a0c0]
lea r13, [0x14000a0ec]
nop dword [rax]
nop dword [rax + rax]
movsxd rax, dword [rsi]
movzx r9d, byte [rax + r14]
cmp rcx, rdx
jae 0x14000172d
lea rax, [rcx + 1]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x38]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x38]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001736
lea rcx, [rbp - 0x38]
call fcn.140004b20
add rsi, 4
cmp rsi, r13
jge 0x140001749
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x28]
jmp 0x140001700
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 0xf
cmova rdx, qword [rbp - 0x38]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400017a1
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000179c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000179c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050bc
xor eax, eax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rdi
mov byte [rbp - 0x38], al
test r13, r13
jne 0x1400017c8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rdi
mov byte [rbx], al
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov rcx, rax
mov qword [rbp - 8], rax
mov rdx, rdi
mov qword [rbp], rdx
mov byte [rbp - 0x18], al
mov dword [rsp + 0x40], 0x40
lea rsi, [0x14000a130]
lea rbx, [0x14000a15c]
nop word [rax + rax]
movsxd rax, dword [rsi]
movzx r9d, byte [rax + r14]
cmp rcx, rdx
jae 0x14000182d
lea rax, [rcx + 1]
mov qword [rbp - 8], rax
lea rax, [rbp - 0x18]
cmp rdx, 0xf
cmova rax, qword [rbp - 0x18]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140001836
lea rcx, [rbp - 0x18]
call fcn.140004b20
add rsi, 4
cmp rsi, rbx
jge 0x140001849
mov rdx, qword [rbp]
mov rcx, qword [rbp - 8]
jmp 0x140001800
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0xf
cmova rdx, qword [rbp - 0x18]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
mov rdx, qword [rbp]
cmp rdx, 0xf
mov rbx, qword [rbp + 0x10]
jbe 0x1400018a5
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400050bc
xor eax, eax
mov qword [rbp - 8], rax
mov qword [rbp], rdi
mov byte [rbp - 0x18], al
test rsi, rsi
je 0x1400017b3
xor edx, edx
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r15d, eax
mov eax, 4
mov rcx, qword gs:[0x58]
mov rdx, qword [rcx]
mov ecx, dword [rax + rdx]
cmp dword [0x14000ad20], ecx
jle 0x140001913
lea rcx, [0x14000ad20]
call fcn.140005008
cmp dword [0x14000ad20], 0xffffffff
jne 0x140001913
xor ecx, ecx
call qword [rbp + 0x18]
mov qword [0x14000ad18], rax
lea rcx, [0x14000ad20]
call fcn.140004f9c
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x60]
call r12
mov ecx, 0x10
call qword [rbp + 8]
movsx r12d, ax
shr r12d, 0xf
mov ecx, 0x14
call r13
movzx r14d, ax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
mov dword [rbp + 0x50], eax
mov rcx, qword [0x14000ad18]
mov qword [rsp + 0x30], rcx
xor r13d, r13d
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 0xa
lea r9, [rbp + 0x40]
lea r8, [rbp + 0x60]
mov edx, r15d
mov r15d, dword [rsp + 0x44]
mov ecx, r15d
call rsi
test eax, eax
jle 0x140001b1d
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
movsxd rsi, eax
lea rax, [rbp + 0x40]
lea rax, [rax + rsi*2]
lea rcx, [rbp + 0x40]
mov qword [rbp + 0x38], rdi
cmp rcx, rax
jne 0x1400019ba
mov edx, r13d
mov qword [rbp + 0x30], rdx
mov byte [rbp + 0x20], dl
jmp 0x140001ab3
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x140001d06
cmp rsi, 0xf
jbe 0x140001a6a
mov rdi, rsi
or rdi, 0xf
cmp rdi, rax
jbe 0x140001a1a
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005080
mov rcx, rax
test rax, rax
je 0x140001a54
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x38], rdi
jmp 0x140001a6e
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x140001a3c
mov rax, r13
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x38], rdi
jmp 0x140001a6e
cmp rcx, 0x1000
jb 0x140001a5b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001d0c
jmp 0x1400019f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005080
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x38], rdi
jmp 0x140001a6e
mov rax, qword [rbp + 0x20]
lea r9, [rbp + 0x20]
mov r8, rsi
lea rdx, [rbp + 0x40]
cmp rdi, 0xf
jbe 0x140001a87
mov r9, rax
mov rcx, rax
jmp 0x140001a90
mov rcx, r9
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rcx], al
lea rcx, [rcx + 1]
lea rdx, [rdx + 2]
sub r8, 1
jne 0x140001a90
mov qword [rbp + 0x30], rsi
mov byte [r9 + rsi], r13b
mov rdi, qword [rbp + 0x38]
mov rdx, qword [rbp + 0x30]
lea eax, [r15 - 0x41]
cmp eax, 0x19
ja 0x140001b09
xor r14b, r12b
test r14b, 1
jne 0x140001b09
lea r14, [rbp + 0x20]
mov rcx, qword [rbp + 0x20]
cmp rdi, 0xf
cmova r14, rcx
lea r15, [rbp + 0x20]
cmova r15, rcx
add r15, rdx
lea rsi, [rbp + 0x20]
cmp rdi, 0xf
cmova rsi, rcx
cmp rsi, r15
je 0x140001b09
sub r14, rsi
movzx ecx, byte [rsi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + r14], al
inc rsi
cmp rsi, r15
jne 0x140001af4
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbx + 0x10], xmm1
jmp 0x140001cd9
lea eax, [r15 - 1]
cmp eax, 0x1f
ja case.0x140001b43.3
lea rdx, [0x140000000]
movzx eax, byte [rdx + rax + 0x1d3c]
mov ecx, dword [rdx + rax*4 + 0x1d14]
add rcx, rdx
jmp rcx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xb
mov qword [rbx + 0x18], rdi
movsd xmm0, qword [str._BACKSPACE_]
movsd qword [rbx], xmm0
movzx eax, word [0x140007550]
mov word [rbx + 8], ax
movzx eax, byte [0x140007552]
mov byte [rbx + 0xa], al
mov byte [rbx + 0xb], r13b
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], rdi
mov rax, qword [str._ENTER_]
mov dword [rbx], eax
movzx eax, word [0x14000755c]
mov word [rbx + 4], ax
movzx eax, byte [0x14000755e]
mov byte [rbx + 6], al
mov byte [rbx + 7], r13b
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], rdi
mov eax, dword [str._TAB_]
mov dword [rbx], eax
movzx eax, byte [0x140007564]
mov byte [rbx + 4], al
mov byte [rbx + 5], r13b
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xb
mov qword [rbx + 0x18], rdi
movsd xmm0, qword [str._CAPS_LOCK_]
movsd qword [rbx], xmm0
movzx eax, word [0x140007570]
mov word [rbx + 8], ax
movzx eax, byte [0x140007572]
mov byte [rbx + 0xa], al
mov byte [rbx + 0xb], r13b
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 8
mov qword [rbx + 0x18], rdi
movabs rax, 0x5d4550414353455b
mov qword [rbx], rax
mov byte [rbx + 8], r13b
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 1
mov qword [rbx + 0x18], rdi
mov word [rbx], 0x20
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xc
mov qword [rbx + 0x18], rdi
movsd xmm0, qword [str._LEFT_CLICK_]
movsd qword [rbx], xmm0
mov eax, dword [0x140007580]
mov dword [rbx + 8], eax
mov byte [rbx + 0xc], r13b
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0xd
mov qword [rbx + 0x18], rdi
movsd xmm0, qword [str._RIGHT_CLICK_]
movsd qword [rbx], xmm0
mov eax, dword [0x140007590]
mov dword [rbx + 8], eax
movzx eax, byte [0x140007594]
mov byte [rbx + 0xc], al
mov byte [rbx + 0xd], r13b
jmp 0x140001cd9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], rdi
mov byte [rbx], r13b
mov rax, rbx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140004f40
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400011c0
int3
call fcn.140001120
int3