Function at 0x14015be39
Capabilities:
Log keystrokes

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0xd0
mov word [rbp - 0x92], 0x65f
mov byte [rbp - 0x31], 0xaa
cmp byte [rbp - 0x31], 0xbb
jbe 0x14015be99
movzx eax, byte [rbp - 0x31]
cmp eax, 0x5c
je 0x14015be6e
cmp eax, 0xf6
jne 0x14015be99
call fcn.14015baac
jmp 0x14015be99
mov rax, qword [rbp - 0x40]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetListBoxInfo]
call rax
mov dword [rbp - 0x98], eax
mov rdx, qword [0x140170310]
mov eax, dword [rbp - 0x98]
mov ecx, eax
call fcn.14015ba84
nop
lea rax, [rbp - 0x98]
mov qword [rbp - 0x48], rax
movzx eax, word [rbp - 0x92]
add eax, 0xd
mov word [rbp - 0x92], ax
mov rax, qword [0x140170310]
mov qword [rbp - 0x50], rax
mov dword [rbp - 0xa4], 0x6d9dcef
movabs rax, 0x1ea1fc498f95f1f3
mov qword [rbp - 0xa0], rax
movzx eax, word [rbp - 0x92]
movzx eax, ax
cmp eax, 0x84e
jne 0x14015bf59
mov eax, dword [rbp - 0xa4]
sub eax, 0x4cabc677
mov dword [rbp - 0xa4], eax
mov eax, dword [rbp - 0x98]
and eax, 0xdeb80a40
mov edx, eax
mov rax, qword [rbp - 0x48]
mov dword [rax], edx
lea rax, str.Lumpiness_Biotechnologist_detoxification
mov rdx, rax
lea rax, str.Grabs_Reopen_aqualung
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CharPrevW]
call rax
mov qword [rbp - 0x58], rax
movzx eax, word [rbp - 0x92]
movzx edx, ax
mov rax, qword [rbp - 0xa0]
mov rcx, qword [rbp - 0x50]
mov r9d, 0xffffff97
mov r8, rcx
mov rcx, rax
call fcn.1400033f0
jmp 0x14015bfc2
mov rax, qword [rbp - 0x48]
mov eax, dword [rax]
or eax, 0x85a1c1a2
mov edx, eax
mov eax, dword [rbp - 0x98]
cmp edx, eax
je 0x14015bfab
movzx eax, byte [rbp - 0x31]
mov byte [rbp - 0x59], al
lea rax, [rbp - 0xa4]
mov qword [rbp - 0x28], rax
lea rax, [rbp - 0x98]
mov qword [rbp - 0x68], rax
lea rax, [rbp - 0x92]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0xa0]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x98]
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0xa0]
mov qword [rbp - 8], rax
nop
movzx eax, word [rbp - 0x92]
movzx eax, ax
cmp eax, 0xb10
je 0x14015c005
cmp eax, 0xfd5
jne 0x14015c03e
mov rax, qword [rbp - 0x70]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_UpdateWindow]
call rax
mov dword [rbp - 0x74], eax
mov rax, qword [0x140170310]
mov edx, eax
mov rax, qword [rbp - 0x20]
mov ecx, edx
shr rax, cl
mov qword [rbp - 0x50], rax
jmp 0x14015c03e
mov rax, qword [rbp - 0x30]
mov eax, dword [rax]
mov rdx, qword [rbp - 0x20]
mov ecx, eax
call fcn.14015ba84
mov rax, qword [rbp - 0x28]
mov edx, dword [rax]
mov eax, dword [rbp - 0xa4]
mov ecx, eax
shl edx, cl
mov rax, qword [rbp - 0x28]
mov dword [rax], edx
mov rax, qword [rbp - 0x10]
movzx eax, word [rax]
xor eax, 0x7b
mov word [rbp - 0x92], ax
nop
movzx eax, word [rbp - 0x92]
movzx eax, ax
cmp eax, 0x37a
je 0x14015c067
cmp eax, 0x66c
jne 0x14015c0da
lea rax, [rbp - 0xa0]
mov qword [rbp - 0x80], rax
jmp 0x14015c0da
mov eax, dword [rbp - 0x84]
mov dword [rbp - 0x98], eax
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov rax, qword [rbp - 0xa0]
add rdx, rax
mov rax, qword [rbp - 0x18]
mov rax, qword [rax]
cmp rdx, rax
jge 0x14015c0c8
mov rax, qword [rbp - 8]
mov rdx, qword [rax]
mov rax, qword [rbp - 0xa0]
sub rdx, rax
mov rax, qword [rbp - 8]
mov qword [rax], rdx
mov edx, 0x71
mov ecx, 0x78
mov rax, qword [sym.imp.USER32.dll_MapVirtualKeyW]
call rax
mov dword [rbp - 0x88], eax
call fcn.14015bdf7
jmp 0x14015c0d9
mov rax, qword [rbp - 0x28]
mov eax, dword [rax]
add eax, 0xcd0df64
mov dword [rbp - 0xa4], eax
nop
mov eax, dword [rbp - 0xa4]
lea edx, [rax + 0x63ad38a2]
mov rax, qword [rbp - 0x28]
mov dword [rax], edx
mov rax, qword [rbp - 0x28]
mov eax, dword [rax]
sub eax, 0x400d6a5d
mov dword [rbp - 0xa4], eax
mov rax, qword [rbp - 0x30]
mov edx, dword [rax]
mov eax, dword [rbp - 0x98]
and edx, eax
mov rax, qword [rbp - 0x48]
mov dword [rax], edx
mov rax, qword [rbp - 0x90]
mov r8d, 0xd4
mov edx, 0xd4
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetMenuState]
call rax
mov dword [rbp - 0x84], eax
mov eax, 0x7d
add rsp, 0xd0
pop rbp
ret