Function at 0x6f8b1a90
Capabilities:
Log keystrokes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
mov rsi, rdx
lea r12, [rsp + 0x3c]
mov r14, r9
mov r13d, r8d
mov qword [rsp + 0x3c], 0
mov rbx, rcx
mov rcx, r12
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [rsi + 0x10]
mov rdx, r12
mov ebp, dword [rsp + 0x3c]
mov edi, dword [rsp + 0x40]
mov r12d, r14d
mov rcx, qword [rax + 0x30]
call qword [sym.imp.USER32.dll_ScreenToClient]
mov rsi, qword [rsp + 0x1c0]
sar rsi, 0x10
cmp r14, 0x10
mov r14, qword [sym.imp.USER32.dll_MapVirtualKeyA]
movzx esi, sil
jne 0x6f8b1b0c
mov edx, 3
mov ecx, esi
call r14
mov r12d, eax
xor edx, edx
mov ecx, r12d
call r14
mov edx, 2
mov ecx, r12d
mov r15d, eax
call r14
cmp r13b, 1
mov r14d, eax
sbb eax, eax
not eax
add eax, 0xa
mov dword [rbx], eax
call qword [sym.imp.USER32.dll_GetMessageTime]
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x6fa27f40]
movsd qword [rbx + 8], xmm0
call fcn.6f8b1a00
cvtsi2sd xmm0, dword [rsp + 0x3c]
mov dword [rbx + 0x34], esi
lea edx, [r12 + 0xdf90]
mov dword [rbx + 0x30], eax
mov ecx, eax
lea eax, [r12 - 0x70]
mov dword [rbx + 0x38], 0
movsd qword [rbx + 0x20], xmm0
cvtsi2sd xmm0, dword [rsp + 0x40]
movsd qword [rbx + 0x28], xmm0
cvtsi2sd xmm0, ebp
movsd qword [rbx + 0x10], xmm0
cvtsi2sd xmm0, edi
movsd qword [rbx + 0x18], xmm0
cmp eax, 0xb
jbe 0x6f8b1cca
mov rax, qword [rsp + 0x1c0]
lea r8d, [r12 - 0x21]
and eax, 0x1000000
cmp rax, 1
sbb edx, edx
and edx, 0x40
add edx, 0xe031
add edx, r8d
cmp r8d, 7
jbe 0x6f8b1cca
lea edx, [r12 - 0x60]
cmp edx, 9
ja 0x6f8b1be0
lea edx, [r12 + 0xe000]
jmp 0x6f8b1cca
lea edx, [r12 - 0x6a]
cmp edx, 5
ja 0x6f8b1bf7
lea edx, [r12 + 0xe040]
jmp 0x6f8b1cca
lea edx, [r12 - 0xa0]
cmp edx, 5
ja 0x6f8b1c11
lea edx, [r12 + 0xdfb1]
jmp 0x6f8b1cca
cmp r12d, 0x2c
je 0x6f8b1ca9
ja 0x6f8b1c49
cmp r12d, 0x13
je 0x6f8b1cb0
ja 0x6f8b1c3e
cmp r12d, 8
je 0x6f8b1cb7
mov edx, 0xe09d
cmp r12d, 0xc
jmp 0x6f8b1c71
mov edx, 0xe047
cmp r12d, 0x14
jmp 0x6f8b1c71
cmp r12d, 0x90
je 0x6f8b1cbe
ja 0x6f8b1c65
cmp r12d, 0x5b
je 0x6f8b1cc5
mov edx, 0xe058
cmp r12d, 0x5c
jmp 0x6f8b1c71
mov edx, 0xe046
cmp r12d, 0x91
je 0x6f8b1cca
mov edx, r12d
test rax, rax
je 0x6f8b1c8e
sub rdx, 0xd
lea rax, [0x6fa31800]
cmp rdx, 0x21
jbe 0x6f8b1c9f
jmp 0x6f8b1cd7
sub rdx, 0x10
cmp rdx, 0x1e
ja 0x6f8b1cd7
lea rax, [0x6fa31860]
movzx edx, word [rax + rdx*2]
test edx, edx
je 0x6f8b1cd7
jmp 0x6f8b1cca
mov edx, 0xe041
jmp 0x6f8b1cca
mov edx, 0xe043
jmp 0x6f8b1cca
mov edx, 8
jmp 0x6f8b1cca
mov edx, 0xe045
jmp 0x6f8b1cca
mov edx, 0xe057
mov dword [rbx + 0x38], edx
call fcn.6f89e0d0
mov dword [rbx + 0x30], eax
jmp 0x6f8b1d4a
test r14d, r14d
js 0x6f8b1d4a
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x3c
mov edx, r15d
rep stosd dword [rdi], eax
lea rdi, [rsp + 0x46]
mov ecx, 0xa
mov qword [rsp + 0x50], 0
rep stosb byte [rdi], al
lea r9, [rsp + 0x46]
mov ecx, r12d
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x28], 4
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_ToUnicode]
movzx eax, word [rsp + 0x46]
lea edx, [rax - 0xd800]
cmp edx, 0x3ff
mov edx, 0xfffd
cmovbe eax, edx
mov dword [rbx + 0x38], eax
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret