Function at 0x140025450
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14002552e
je 0x140025526
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25624]
mov ecx, dword [rdx + rax*4 + 0x255d8]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_ioctlsocket
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_send
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25684]
mov ecx, dword [rdx + rax*4 + 0x2565c]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x1400255bc
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x1400255d0
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
rep movsb byte [rdi], byte [rsi]
popfq
movsx rdi, r12w
pop rsi
movsx di, r13b
movzx di, spl
movzx rdi, r14w
pop rdi
jmp 0x1402954ea
ja 0x1402954ea
mov rax, rsp
movsx cx, r11b
movabs rcx, 0x100
movsxd r10, r11d
xchg r10b, r10b
lea r10, [r8 + riz - 0x80]
jmp 0x140281eef
dec r9d
rol r9d, 2
inc r9d
jmp 0x140249aa5
or eax, 0x5c89667e
and eax, 0x4166f500
rcl eax, 0x8b
mov r8d, dword [r9]
add r9, 4
add byte [rax], al
add byte [rdx], bh
invalid
xor r8d, r10d
cmp si, 0x41f5
sub r8d, 0x362671dc
sub eax, 0x362671dc
add byte [rax], al
add byte [rdx], bh
invalid
sub eax, 0x362671dc
not r8d
ror r8d, 3
xor r8d, 0x58992a99
cdq
pop rax
cdq
pop rax
test r10w, 0x7ba5
clc
stc
push r10
or r10b, dl
dec r10b
xor dword [rsp], r8d
add al, 0x24
add al, 0x24
shl r10w, cl
adc r10, rdx
setle r10b
pop r10
movsxd r8, r8d
cmp bpl, r11b
add rdi, r8
push rdi
ret
mov r10d, dword [r8]
btc rdx, 0x5d
btr edx, 0x13
mov edx, dword [r8 + 4]
sub r8, 4
add r9w, di
iretd
rcr r9d, 0xf8
cmp rsp, rbx
not r10d
rol r9, 0xe
not edx
and r10d, edx
iretd
setae r9b
mov dword [r8 + 8], r10d
mov r9b, reloc.OLEAUT32.dll_DispGetParam
pushfq
pop qword [r8]
mov r9d, dword [rbx]
mov ecx, dword [rbx]
mov ecx, dword [rbx]
add rbx, 4
xor r9d, edi
jmp 0x1402513e4
mov rsp, r10
push rdi
movsx rdi, bx
cmovnp rdi, r14
mov di, r14w
push rsi
pushfq
mov dil, 0x56
mov rsi, rax
movzx di, bl
mov rdi, r10
cld
jmp 0x1401c2b52
jmp 0x14026b24e
xor r9d, 0x778b583d
stc
cmp r11w, 0x3ff8
push rdi
sets dil
xor dword [rsp], r9d
pop rdi
test r10d, ecx
clc
movsxd r9, r9d
add rsi, r9
jmp 0x140223292
not r9d
jmp 0x1401f03d9
lea r11, [rsp + 0x140]
clc
stc
cmc
cmp r8, r11
jmp 0x1401ebf8c
and r10, 0xfffffffffffffff0
cmp r8w, 0x2a20
test r8, r13
clc
sub r10, rcx
jmp 0x140213578
jmp rsi