Function at 0x140025450
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14002552e
je 0x140025526
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25624]
mov ecx, dword [rdx + rax*4 + 0x255d8]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_ioctlsocket
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_send
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25684]
mov ecx, dword [rdx + rax*4 + 0x2565c]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x1400255bc
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x1400255d0
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
push qword [rdx - 0x53]
movabs eax, dword [0x86c2ddb5f023869b]
rcr byte [rdx - 0x5b7d98c5], 1
fsubr dword [rax]
mov cl, 0x49
jrcxz 0x1402115c2
invalid
shr byte [r11 - 0x4b4372bf], 1
lea ebp, [rbx - 0x53bc4bd6]
mov ah, 0x43
lodsb al, byte [rsi]
mov ah, 0x43
lodsb al, byte [rsi]
movabs byte [0x9e844700a9e4b588], al
cmp dword [rcx + 0x3f], ebx
je 0x1402115ba
xchg ebx, eax
test ecx, 0xf834d9fb
invalid
invalid
test dword [rbp - 0x183ea2a3], edx
xor edi, dword [rsi]
mov dl, byte [rdx]
xor al, 9
invalid
invalid
jmp 0x140211621
adc eax, 0x9b578b26
jb 0x14021165e
pop rdi
scasd eax, dword [rdi]
sti
xor cl, byte [rbp - 0x56]
mov al, 0x5e
add dword [rsi + rsi*8], ebp
loopne 0x14021160f
rcl ebx, 0xfd
jae 0x140211619
sbb eax, 0x612d7cd6
invalid
invalid
in al, 0x28
movsb byte [rdi], byte [rsi]
je 0x140211614
jmp 0x1210977a4
loopne 0x1402115d9
int3
stosd dword [rdi], eax
invalid
rcl esp, 1
invalid
cdq
xor dword [rsi - 0x5f], 0xadd908bb
invalid
adc esp, ecx
jg 0x1402116c7
xchg edi, eax
cmp ah, dl
test byte [rdi - 0x3a], 0x63
imul bl
ja 0x1402115fb
outsb dx, byte [rsi]
xchg qword [rsi + 0x4a96234b], rbp
invalid
adc dword [rbp + 0x62], ebp
invalid
mov gs, word [rsi]
cmp eax, 0xecc44da3
add esi, edi
outsd dx, dword [rsi]
cdq
and dh, byte [rbp + 0x58]
out 0x4d, al
cmp bl, byte [rsi - 0x16]
mov edi, 0x17818d4e
cli
adc al, 0xeb
push rax
outsb dx, byte [rsi]
out dx, eax
jle 0x140211735
lea eax, [rdx + rdx*4]
or al, 0xaf
mov ecx, 0x89ea5f1a
cmp word [rbx], ax
cmp esp, dword [rbp + 0x6e]
sub byte [rdi - 0x7a], dl
xor dword [rdi - 0x139ea578], edi
push rbp
pop rbp
frstor dword [rsi - 0x50538b28]
mov esi, 0xcd74cf41
push rsp
jns 0x14021172f
jne 0x1402116a6
invalid
sub byte [rax - 0x50], ah
sub byte [rdi - 0x3b], al
push rcx
movabs dword [0x1380c883cc29ab61], eax
movsd dword [rdi], dword [rsi]
clc
rol byte [rdx], cl
cld
add ebx, esi
and al, 0x95
pop rbp
cdqe
test al, 0x1a
insd dword [rdi], dx
ror al, cl
adc dword [rbx + riz], ebx
loope 0x1402117cc
jrcxz 0x14021178f
push 0x141a0046
pop rbp
and dword [rax - 0xa00cb25], ebp
jae 0x1402117b1
invalid
and dword [rdx - 6], 0xffffffa3
movabs al, byte [0x18f686f2d931c508]
adc dword [rcx + 0x25], eax
invalid
invalid
jo 0x140211812
invalid
add al, 0x38
pop rsp
or eax, 0x4d1be689
adc dh, ah
sub byte [rbx - 0x212ca256], cl
pop rsi
out dx, eax
invalid
invalid
xor eax, dword [rbx]
invalid