Function at 0x1400aa2c0
Capabilities:
Log keystrokes

Disassembly:
push rbp
push rdi
mov rbp, rsp
sub rsp, 0x58
mov r8, rdx
movzx edx, cl
sub edx, 1
je 0x1400aa719
sub edx, 1
je 0x1400aa44c
cmp edx, 1
jne 0x1400aa845
xor eax, eax
lea rdi, [rbp - 0x38]
mov ecx, Ordinal_41
rep stosb byte [rdi], al
movzx eax, byte [r8]
mov dword [rbp - 0x38], edx
test dl, al
je 0x1400aa340
xor edi, edi
mov dword [rbp - 0x2c], edi
mov edi, 0xad
lea rdx, [rbp - 0x38]
mov word [rbp - 0x30], di
call fcn.1400aa080
mov ecx, reloc.WLDAP32.dll_Ordinal_33
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x2c], 2
mov word [rbp - 0x30], di
call fcn.1400aa080
add rsp, 0x58
pop rdi
pop rbp
ret
test al, 2
je 0x1400aa350
xor edi, edi
mov dword [rbp - 0x2c], edi
mov edi, 0xaf
jmp 0x1400aa30d
test al, 4
je 0x1400aa360
xor edi, edi
mov dword [rbp - 0x2c], edi
mov edi, 0xae
jmp 0x1400aa30d
test al, 8
je 0x1400aa3aa
mov ecx, 0xb3
mov edx, 4
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x2c], 9
mov word [rbp - 0x2e], ax
call fcn.1400aa080
mov ecx, Ordinal_41
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x38]
mov dword [rbp - 0x2c], recv
call fcn.1400aa080
add rsp, 0x58
pop rdi
pop rbp
ret
test al, 0x10
je 0x1400aa3b5
mov ecx, 0xb2
jmp 0x1400aa369
test al, 0x20
je 0x1400aa3c0
mov ecx, 0xb1
jmp 0x1400aa369
test al, 0x40
je 0x1400aa3cb
mov ecx, 0xb0
jmp 0x1400aa369
test al, al
jns 0x1400aa3d6
mov ecx, 0xb4
jmp 0x1400aa369
movzx eax, byte [r8 + 1]
test al, 1
je 0x1400aa3e6
mov ecx, 0xb6
jmp 0x1400aa369
test al, 2
je 0x1400aa3f4
mov ecx, 0xaa
jmp 0x1400aa369
test al, 4
je 0x1400aa402
mov ecx, 0xac
jmp 0x1400aa369
test al, 8
je 0x1400aa410
mov ecx, 0xab
jmp 0x1400aa369
test al, 0x10
je 0x1400aa41e
mov ecx, 0xa8
jmp 0x1400aa369
test al, 0x20
je 0x1400aa42c
mov ecx, 0xa9
jmp 0x1400aa369
test al, 0x40
je 0x1400aa43a
mov ecx, 0xa7
jmp 0x1400aa369
test al, al
jns 0x1400aa845
mov ecx, 0xa6
jmp 0x1400aa369
movzx eax, byte [r8]
xor edi, edi
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x50], r15
mov esi, edi
test al, al
jns 0x1400aa478
mov byte [0x140268418], 0xe7
jmp 0x1400aa4d1
test al, 0x40
je 0x1400aa485
mov byte [0x140268418], 0xe6
jmp 0x1400aa4d1
test al, 0x20
je 0x1400aa492
mov byte [0x140268418], 0xe5
jmp 0x1400aa4d1
test al, 0x10
je 0x1400aa49f
mov byte [0x140268418], 0xe4
jmp 0x1400aa4d1
test al, 8
je 0x1400aa4ac
mov byte [0x140268418], 0xe3
jmp 0x1400aa4d1
test al, 4
je 0x1400aa4b9
mov byte [0x140268418], 0xe2
jmp 0x1400aa4d1
test al, 2
je 0x1400aa4c6
mov byte [0x140268418], 0xe1
jmp 0x1400aa4d1
test al, 1
je 0x1400aa4e0
mov byte [0x140268418], 0xe0
mov esi, 1
nop word [rax + rax]
movzx ecx, byte [r8 + 2]
lea r14, [0x140268418]
test cl, cl
je 0x1400aa4f6
mov byte [rsi + r14], cl
inc esi
movzx ecx, byte [r8 + 3]
test cl, cl
je 0x1400aa505
mov byte [rsi + r14], cl
inc esi
movzx ecx, byte [r8 + 4]
test cl, cl
je 0x1400aa514
mov byte [rsi + r14], cl
inc esi
movzx ecx, byte [r8 + 5]
test cl, cl
je 0x1400aa523
mov byte [rsi + r14], cl
inc esi
movzx ecx, byte [r8 + 6]
test cl, cl
je 0x1400aa532
mov byte [rsi + r14], cl
inc esi
movzx ecx, byte [r8 + 7]
test cl, cl
je 0x1400aa541
mov byte [rsi + r14], cl
inc esi
mov rbx, rdi
lea r15, [0x140268428]
nop dword [rax + rax]
movzx ecx, byte [rbx + r15]
test cl, cl
je 0x1400aa590
mov rax, rdi
nop dword [rax]
cmp byte [rax + r14], cl
je 0x1400aa590
inc rax
cmp rax, 0xe
jl 0x1400aa560
lea rdx, [0x1402683fa]
call fcn.1400aa850
or eax, 0xa
lea rdx, [0x1402683f0]
mov dword [0x1402683fc], eax
call fcn.1400aa080
inc rbx
cmp rbx, 0xe
jl 0x1400aa550
mov r15, qword [rsp + 0x50]
test esi, esi
je 0x1400aa6ca
mov rbx, r14
nop dword [rax]
movzx ecx, byte [0x140268428]
mov eax, 1
test cl, cl
je 0x1400aa5c5
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x140268429]
test cl, cl
je 0x1400aa5d5
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x14026842a]
test cl, cl
je 0x1400aa5e5
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x14026842b]
test cl, cl
je 0x1400aa5f5
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x14026842c]
test cl, cl
je 0x1400aa605
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x14026842d]
test cl, cl
je 0x1400aa615
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x14026842e]
test cl, cl
je 0x1400aa625
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x14026842f]
test cl, cl
je 0x1400aa635
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x140268430]
test cl, cl
je 0x1400aa645
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x140268431]
test cl, cl
je 0x1400aa655
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x140268432]
test cl, cl
je 0x1400aa665
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x140268433]
test cl, cl
je 0x1400aa675
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x140268434]
test cl, cl
je 0x1400aa685
cmp byte [rbx], cl
cmove eax, edi
movzx ecx, byte [0x140268435]
test cl, cl
je 0x1400aa695
cmp byte [rbx], cl
cmove eax, edi
test eax, eax
je 0x1400aa6bd
movzx ecx, byte [rbx]
lea rdx, [0x1402683fa]
call fcn.1400aa850
or eax, 8
lea rdx, [0x1402683f0]
mov dword [0x1402683fc], eax
call fcn.1400aa080
inc rbx
sub rsi, 1
jne 0x1400aa5b0
mov eax, dword [0x140268420]
mov rdi, r14
movsd xmm0, qword [0x140268418]
mov ecx, reloc.WS2_32.dll_ntohl
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov dword [0x140268430], eax
movzx eax, word [0x140268424]
mov word [0x140268434], ax
xor eax, eax
rep stosb byte [rdi], al
movsd qword [0x140268428], xmm0
add rsp, 0x58
pop rdi
pop rbp
ret
xor edi, edi
test byte [r8], 1
je 0x1400aa741
cmp dword [0x140269b80], edi
jne 0x1400aa75d
mov edx, dword [0x14026844c]
and edx, 0xfffffffb
mov dword [0x140269b80], 1
or edx, 2
jmp 0x1400aa766
cmp dword [0x140269b80], edi
je 0x1400aa75d
mov edx, dword [0x14026844c]
and edx, 0xfffffffd
mov dword [0x140269b80], edi
or edx, 4
jmp 0x1400aa766
mov edx, dword [0x14026844c]
and edx, 0xfffffff9
mov dword [0x14026844c], edx
test byte [r8], 2
je 0x1400aa78c
cmp dword [0x140269b7c], edi
jne 0x1400aa7a2
and edx, 0xffffffef
mov dword [0x140269b7c], 1
or edx, 8
jmp 0x1400aa7a5
cmp dword [0x140269b7c], edi
je 0x1400aa7a2
and edx, 0xfffffff7
mov dword [0x140269b7c], edi
or edx, 0x10
jmp 0x1400aa7a5
and edx, 0xffffffe7
mov dword [0x14026844c], edx
test byte [r8], 4
je 0x1400aa7cb
cmp dword [0x140269b78], edi
jne 0x1400aa7e1
and edx, 0xffffffbf
mov dword [0x140269b78], 1
or edx, 0x20
jmp 0x1400aa7e4
cmp dword [0x140269b78], edi
je 0x1400aa7e1
and edx, 0xffffffdf
mov dword [0x140269b78], edi
or edx, 0x40
jmp 0x1400aa7e4
and edx, 0xffffff9f
mov dword [0x14026844c], edx
movsx ecx, byte [r8 + 1]
mov dword [0x140268440], ecx
movsx edi, byte [r8 + 2]
mov dword [0x140268444], edi
test cl, cl
jne 0x1400aa80e
test dil, dil
jne 0x1400aa80e
and edx, 0xfffffffe
jmp 0x1400aa811
or edx, 1
mov dword [0x14026844c], edx
movsx eax, byte [r8 + 3]
imul ecx, eax, 0x3c
mov dword [0x140268448], ecx
test ecx, ecx
je 0x1400aa82f
bts edx, 0xb
jmp 0x1400aa833
btr edx, 0xb
mov dword [0x14026844c], edx
lea rdx, [0x140268438]
call fcn.1400aa080
add rsp, 0x58
pop rdi
pop rbp
ret