Function at 0x6b042a70
Capabilities:
Log keystrokes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov rdi, qword [rsp + 0x1d0]
lea r14, [rsp + 0x4c]
mov rbp, rdx
mov r15, r9
mov r13d, r8d
mov qword [rsp + 0x4c], 0
mov rbx, rcx
mov rcx, r14
mov r12d, r15d
call qword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [rsp + 0x50]
mov rdx, r14
mov esi, dword [rsp + 0x4c]
mov dword [rsp + 0x3c], eax
mov rax, qword [rbp + 0x10]
mov rbp, rdi
sar rbp, 0x10
mov rcx, qword [rax + 0x30]
movzx ebp, bpl
call qword [sym.imp.USER32.dll_ScreenToClient]
mov r14, qword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp r15, 0x10
je 0x6b042c20
xor edx, edx
mov ecx, r12d
and edi, 0x1000000
call r14
mov edx, 2
mov ecx, r12d
mov r15d, eax
call r14
mov r14d, eax
xor eax, eax
test r13b, r13b
sete al
add eax, 9
mov dword [rbx], eax
call qword [sym.imp.USER32.dll_GetMessageTime]
pxor xmm0, xmm0
cvtsi2sd xmm0, eax
mulsd xmm0, qword [0x6b0bd450]
movsd qword [rbx + 8], xmm0
call fcn.6b0429a0
pxor xmm0, xmm0
pxor xmm1, xmm1
mov dword [rbx + 0x34], ebp
cvtsi2sd xmm1, dword [rsp + 0x50]
lea edx, [r12 - 0x70]
mov dword [rbx + 0x30], eax
cvtsi2sd xmm0, dword [rsp + 0x4c]
mov dword [rbx + 0x38], 0
lea ecx, [r12 + 0xdf90]
unpcklpd xmm0, xmm1
pxor xmm1, xmm1
movups xmmword [rbx + 0x20], xmm0
pxor xmm0, xmm0
cvtsi2sd xmm1, dword [rsp + 0x3c]
cvtsi2sd xmm0, esi
unpcklpd xmm0, xmm1
movups xmmword [rbx + 0x10], xmm0
cmp edx, 0xb
ja 0x6b042ba8
mov dword [rbx + 0x38], ecx
mov dword [rbx + 0x30], eax
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
cmp rdi, 1
lea r8d, [r12 - 0x21]
sbb edx, edx
and edx, 0x40
add edx, 0xe031
add edx, r8d
cmp r8d, 7
jbe 0x6b042c00
lea edx, [r12 - 0x60]
lea ecx, [r12 + 0xe000]
cmp edx, 9
jbe 0x6b042b8b
lea edx, [r12 - 0x6a]
lea ecx, [r12 + 0xe040]
cmp edx, 5
jbe 0x6b042b8b
lea edx, [r12 - 0xa0]
cmp edx, 5
ja 0x6b042c38
lea edx, [r12 + 0xdfb1]
nop
mov dword [rbx + 0x38], edx
sub edx, 0xe045
cmp edx, 0x13
ja case.0x6b042c1c.57416
lea rcx, [0x6b0bcc5c]
movsxd rdx, dword [rcx + rdx*4]
add rdx, rcx
jmp rdx
mov edx, 3
mov ecx, ebp
call r14
mov r12d, eax
jmp 0x6b042aea
cmp r12d, 0x2c
jbe 0x6b042d00
cmp r12d, 0x90
je 0x6b042ce0
ja 0x6b042cc0
cmp r12d, 0x5b
je 0x6b042f48
cmp r12d, 0x5c
jne case.0x6b042d1e.9
mov dword [rbx + 0x38], 0xe058
nop dword [rax]
and eax, 0xfffffff7
jmp case.0x6b042c1c.57416
and eax, 0xfffffffb
jmp case.0x6b042c1c.57416
and eax, 0xfffffffd
jmp case.0x6b042c1c.57416
and eax, 0xfffffffe
jmp case.0x6b042c1c.57416
mov dword [rbx + 0x38], 0xe047
nop
and eax, 0xffffffbf
jmp case.0x6b042c1c.57416
cmp r12d, 0x91
jne 0x6b042f58
mov dword [rbx + 0x38], 0xe046
nop dword [rax]
and eax, 0xffffffdf
jmp case.0x6b042c1c.57416
mov dword [rbx + 0x38], 0xe045
nop word [rax + rax]
and eax, 0xffffffef
jmp case.0x6b042c1c.57416
cmp r12d, 7
jbe case.0x6b042d1e.9
lea edx, [r12 - 8]
cmp edx, 0x24
ja case.0x6b042d1e.9
lea r8, [0x6b0bccac]
movsxd rdx, dword [r8 + rdx*4]
add rdx, r8
jmp rdx
mov r12d, 0xe09d
mov dword [rbx + 0x38], r12d
jmp case.0x6b042c1c.57416
mov dword [rbx + 0x38], 0xe041
jmp case.0x6b042c1c.57416
mov dword [rbx + 0x38], 0xe043
jmp case.0x6b042c1c.57416
mov edx, r12d
test rdi, rdi
je 0x6b042f64
sub rdx, 0xd
cmp rdx, 0x21
ja 0x6b042d71
lea r8, [0x6b0c0180]
movzx edx, word [r8 + rdx*2]
test edx, edx
jne 0x6b042c00
test r14d, r14d
js 0x6b042b91
xor eax, eax
mov edx, r15d
lea r9, [rsp + 0x56]
mov ecx, r12d
mov qword [rsp + 0x60], 0
lea r8, [rsp + 0x60]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x140], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x158], 0
mov qword [rsp + 0x56], 0
mov word [rsp + 0x5e], ax
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 4
call qword [sym.imp.USER32.dll_ToUnicode]
movzx eax, word [rsp + 0x56]
lea edx, [rax - 0xd800]
cmp edx, 0x3ff
mov edx, 0xfffd
cmovbe eax, edx
mov dword [rbx + 0x38], eax
jmp 0x6b042b91
mov dword [rbx + 0x38], 0xe057
jmp case.0x6b042c1c.57431
mov edx, r12d
test rdi, rdi
jne 0x6b042d71
sub rdx, 0x10
cmp rdx, 0x1e
ja 0x6b042d71
lea r8, [0x6b0c01e0]
mov edx, dword [r8 + rdx*4]
jmp 0x6b042d69