Function at 0x140011110
Capabilities:
Log keystrokes

Disassembly:
jmp 0x140011110
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400cb008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x38], r9d
movzx r12d, r8w
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x40], rcx
movzx ebx, word [rsp + 0xf8]
movzx r15d, bl
shr r15b, 3
and r15b, 1
movzx r14d, bl
shr r14b, 1
and r14b, 1
movzx ebp, bl
and bpl, 1
mov byte [rsp + 0x31], bpl
movzx esi, bl
shr sil, 4
and sil, 1
mov byte [rsp + 0x32], sil
movzx eax, bx
shr ax, 8
and al, 1
mov word [rsp + 0x34], ax
mov byte [rsp + 0x30], 0
call fcn.140003396
test al, al
je 0x140011251
mov ecx, dword [0x1400cc4e8]
mov rax, qword gs:[0x58]
mov edx, 0x104
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400cc474], ecx
jg 0x140011503
cmp byte [0x1400cc470], 0
je 0x140011251
mov byte [rsp + 0x30], 1
mov word [rsp + 0x48], r12w
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x4c], eax
mov word [rsp + 0x50], bx
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x48]
call fcn.140003c6a
nop
cmp qword [rax + 0x18], 0x10
jb 0x140011204
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.keypress:__s
call fcn.140004610
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140011251
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001124c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400114fd
call fcn.140003b75
cmp byte [r13 + 0xeb], 0
je 0x140011329
lea eax, [r12 - 0x23]
cmp ax, 5
ja 0x140011329
test r15b, r15b
jne 0x140011329
test r14b, r14b
jne 0x140011329
test bpl, bpl
jne 0x140011329
test sil, sil
jne 0x140011329
mov rdx, rdi
mov rcx, r13
call fcn.14000448a
cmp byte [rsp + 0x30], sil
je 0x1400112b0
lea rcx, str.sending_keypress_to_console_HWND
call fcn.140004610
mov rax, qword [r13]
mov rbx, qword [rax]
xor edx, edx
mov ecx, r12d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebp, ebp
cmp eax, 0xff
cmova eax, ebp
shl eax, 0x10
mov r9d, eax
or r9, 1
mov r8, r12
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rbx, qword [rax]
xor edx, edx
mov ecx, r12d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xff
cmova eax, ebp
shl eax, 0x10
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
mov r8, r12
mov edx, 0x101
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1400114dc
xor ebp, ebp
test r15b, r15b
je 0x14001134f
mov eax, 8
movzx ebp, ax
xor r9d, r9d
lea r8d, [rax + 9]
mov word [rsp + 0x20], ax
lea edx, [rax - 7]
mov rcx, rdi
call fcn.140002cc5
test r14b, r14b
je 0x140011370
or bp, 2
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], bp
lea edx, [r9 + 1]
mov rcx, rdi
call fcn.140002cc5
mov r13d, 0x100
cmp byte [rsp + 0x31], 0
je 0x1400113a0
or bp, 1
movzx eax, bp
or ax, r13w
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], ax
lea edx, [r9 + 1]
mov rcx, rdi
call fcn.140002cc5
test sil, sil
je 0x1400113c1
or bp, 0x10
xor r9d, r9d
lea r8d, [r9 + 0x10]
mov word [rsp + 0x20], bp
lea edx, [r9 + 1]
mov rcx, rdi
call fcn.140002cc5
movzx esi, bp
or si, r13w
cmp byte [rsp + 0x34], 0
cmove si, bp
mov rcx, qword [rsp + 0x40]
cmp byte [rcx + 0xeb], 0
mov rcx, rdi
je 0x1400113fe
movzx r9d, word [rsp + 0x108]
mov r8d, dword [rsp + 0x100]
movzx edx, r12w
call fcn.1400011e0
jmp 0x140011416
mov word [rsp + 0x20], si
mov r9d, dword [rsp + 0x38]
movzx r8d, r12w
mov edx, 1
call fcn.14000483b
mov word [rsp + 0x20], si
mov r9d, dword [rsp + 0xf0]
movzx r8d, r12w
xor edx, edx
mov rcx, rdi
call fcn.14000483b
movzx ebx, si
mov eax, 0xfeff
and bx, ax
cmp byte [rsp + 0x34], 0
cmove bx, si
cmp byte [rsp + 0x32], 0
je 0x14001146a
mov eax, 0xffef
and bx, ax
xor r9d, r9d
lea r8d, [r9 + 0x10]
mov word [rsp + 0x20], bx
xor edx, edx
mov rcx, rdi
call fcn.140002cc5
cmp byte [rsp + 0x31], 0
je 0x140011496
mov eax, 0xfffe
and bx, ax
movzx eax, bx
or ax, r13w
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], ax
xor edx, edx
mov rcx, rdi
call fcn.140002cc5
test r14b, r14b
je 0x1400114b9
mov eax, 0xfffd
and bx, ax
xor r9d, r9d
lea r8d, [r9 + 0x12]
mov word [rsp + 0x20], bx
xor edx, edx
mov rcx, rdi
call fcn.140002cc5
test r15b, r15b
je 0x1400114dc
mov eax, 0xfff7
and bx, ax
xor r9d, r9d
lea r8d, [r9 + 0x11]
mov word [rsp + 0x20], bx
xor edx, edx
mov rcx, rdi
call fcn.140002cc5
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400029d2
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14000215d
int3
lea rcx, [0x1400cc474]
call fcn.140003f49
cmp dword [0x1400cc474], 0xffffffff
jne 0x1400111c9
lea rcx, str.input
call fcn.140004746
mov byte [0x1400cc470], al
lea rcx, [0x1400cc474]
call fcn.140004106
jmp 0x1400111c9