Function at 0x100069e0
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x58
cmp r8d, 0x18
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x40], rdi
mov rdi, rdx
mov ebx, r8d
jb 0x10006c24
mov qword [rsp + 0x48], rsi
call fcn.1000a000
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
shr rdx, 4
test edx, edx
movsxd rsi, edx
jle 0x10006c1f
mov qword [rsp + 0x50], rbp
lea rbx, [rdi + 8]
xor edi, edi
lea rbp, [0x10000000]
nop
nop
nop
mov eax, dword [rbx - 4]
add eax, 0xfffffe00
cmp eax, 8
ja 0x10006a77
movzx ecx, word [rbx + 4]
movzx edx, word [rbx + 6]
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], edx
call qword [sym.imp.USER32.dll_SetCursorPos]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.USER32.dll_WindowFromPoint]
mov rcx, rax
call qword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [rbx - 4]
cmp eax, 0x201
ja 0x10006afc
cmp eax, 0x201
je 0x10006ae1
sub eax, 0x100
je 0x10006ac1
dec eax
je 0x10006aa0
sub eax, 3
je 0x10006ac1
dec eax
jne case.0x10006b14.521
mov ecx, dword [rbx]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ecx, byte [rbx]
xor r9d, r9d
lea r8d, [r9 + 2]
mov edx, eax
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.0x10006b14.521
mov ecx, dword [rbx]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx ecx, byte [rbx]
xor r9d, r9d
mov edx, eax
xor r8d, r8d
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.0x10006b14.521
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 2]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
add eax, 0xfffffdfe
cmp eax, 8
ja case.0x10006b14.521
mov ecx, dword [rbp + rax*4 + 0x6c34]
add rcx, rbp
jmp rcx
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 4]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 8]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x10]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 6]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
xor edx, edx
xor r9d, r9d
lea ecx, [rdx + 6]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x18]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
xor edx, edx
xor r9d, r9d
lea ecx, [rdx + 0x18]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x20]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ecx, [rdx + 0x40]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
jmp case.0x10006b14.521
movsx r9d, word [rbx + 2]
xor r8d, r8d
xor edx, edx
mov ecx, 0x800
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_mouse_event]
add rbx, 0x18
dec rsi
jne 0x10006a40
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x78]
add rsp, 0x58
ret