Function at 0x180008750
Capabilities:
Log keystrokes

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0x50
mov r14, rdx
xor edx, edx
mov eax, r8d
div dword [rcx + 0x7f0]
mov rbp, rcx
mov r13d, eax
test edx, edx
jne 0x180008a58
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r15
xor r15d, r15d
mov r12d, r15d
test eax, eax
jle 0x180008a4e
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
movaps xmmword [rsp + 0x30], xmm6
movss xmm6, dword [0x18001d840]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov rcx, qword [rbp + 0x808]
mov eax, r12d
imul eax, dword [rbp + 0x7f0]
cdqe
mov edx, 0x76
add rax, r14
mov qword [rbp + 0x7e8], rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, qword [rbp + 0x808]
movaps xmm2, xmm6
dec eax
mov edx, 0x75
movd xmm0, eax
mov rax, qword [rbp + 0x7e8]
mov rsi, rax
movd xmm1, dword [rax + 0x10]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
divss xmm2, xmm0
mulss xmm2, xmm1
cvttss2si rbx, xmm2
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
movd xmm1, dword [rsi + 0x14]
dec eax
movaps xmm2, xmm6
movd xmm0, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rsi + 4]
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
mulss xmm2, xmm1
cvttss2si rdi, xmm2
cmp eax, 0x200
ja 0x180008937
je 0x18000892a
sub eax, 0x100
je 0x1800088c6
dec eax
je 0x180008861
sub eax, 3
je 0x1800088c6
dec eax
jne case.default.0x180008956
mov ecx, dword [rsi + 8]
cmp ecx, 0x25
je 0x18000889f
cmp ecx, 0x27
je 0x18000889f
cmp ecx, 0x26
je 0x18000889f
cmp ecx, 0x28
je 0x18000889f
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rbp + 0x7e8]
lea r8d, [r9 + 2]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180008956
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rbp + 0x7e8]
lea r8d, [r9 + 3]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180008956
mov ecx, dword [rsi + 8]
cmp ecx, 0x25
je 0x180008903
cmp ecx, 0x27
je 0x180008903
cmp ecx, 0x26
je 0x180008903
cmp ecx, 0x28
je 0x180008903
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rax, qword [rbp + 0x7e8]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180008956
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rbp + 0x7e8]
lea r8d, [r9 + 1]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180008956
xor r9d, r9d
mov ecx, 0x8001
jmp 0x180008a1b
add eax, 0xfffffdff
cmp eax, 9
ja case.default.0x180008956
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x8a64]
add rcx, rdx
jmp rcx
xor r9d, r9d
mov ecx, 0x8002
jmp 0x180008a1b
xor r9d, r9d
mov ecx, 0x8004
jmp 0x180008a1b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8008
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8010
jmp 0x180008a1b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8006
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8006
jmp 0x180008a1b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8018
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8018
jmp 0x180008a1b
xor r9d, r9d
mov ecx, 0x8020
jmp 0x180008a1b
xor r9d, r9d
mov ecx, 0x8040
jmp 0x180008a1b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8060
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8060
jmp 0x180008a1b
movsx r9d, word [rsi + 0xa]
mov ecx, 0x8800
mov r8d, edi
mov edx, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
inc r12d
cmp r12d, r13d
jl 0x1800087a7
movaps xmm6, xmmword [rsp + 0x30]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r14
pop r13
pop rbp
ret