Function at 0x140009a30
Capabilities:
Log keystrokes
Manipulate console buffer

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 7]
sub rsp, 0x98
mov rax, qword [0x140045010]
xor rax, rsp
mov qword [rbp - 0x11], rax
mov dword [rbp - 0x59], r9d
movzx r15d, r8w
mov rbx, rdx
mov qword [rbp - 0x51], rcx
movzx edi, word [rbp + 0x77]
movzx r13d, dil
shr r13b, 3
and r13b, 1
mov byte [rbp - 0x5e], r13b
movzx r12d, dil
shr r12b, 1
and r12b, 1
movzx r14d, dil
and r14b, 1
mov byte [rbp - 0x60], r14b
movzx esi, dil
shr sil, 4
and sil, 1
mov byte [rbp - 0x5f], sil
movzx eax, di
shr ax, 8
and al, 1
mov word [rbp - 0x5d], ax
mov byte [rbp - 0x61], 0
call fcn.140014330
test al, al
je 0x140009b8d
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x140046e6c], eax
jle 0x140009b0e
lea rcx, [0x140046e6c]
call fcn.140017ea8
cmp dword [0x140046e6c], 0xffffffff
jne 0x140009b0e
lea rcx, str.input
call fcn.1400143d0
mov byte [0x140046e7e], al
lea rcx, [0x140046e6c]
call fcn.140017e48
cmp byte [0x140046e7e], 0
je 0x140009b8d
mov byte [rbp - 0x61], 1
mov word [rbp - 0x49], r15w
mov eax, dword [rbp - 0x59]
mov dword [rbp - 0x45], eax
mov word [rbp - 0x41], di
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x49]
call fcn.14000d660
nop
cmp qword [rax + 0x18], 0x10
jb 0x140009b42
mov rax, qword [rax]
mov rdx, rax
lea rcx, str.keypress:__s
call fcn.1400149c0
nop
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x140009b8d
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a053
call fcn.140017cec
mov rdi, qword [rbp - 0x51]
cmp byte [rdi + 0xeb], 0
je 0x140009cae
lea eax, [r15 - 0x23]
cmp ax, 5
ja 0x140009cae
test r13b, r13b
jne 0x140009cae
test r12b, r12b
jne 0x140009cae
test r14b, r14b
jne 0x140009cae
test sil, sil
jne 0x140009cae
mov r10, qword [rbx]
mov rcx, qword [rbx + 8]
sub rcx, r10
movabs rax, 0x6666666666666667
imul rcx
sar rdx, 3
mov rax, rdx
shr rax, 0x3f
xor r14d, r14d
add rdx, rax
je 0x140009c29
mov dword [rbp - 0x59], r14d
lea r9, [rbp - 0x59]
mov r8d, edx
mov rdx, r10
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x140009c22
lea rcx, str.WriteConsoleInputW_failed
call fcn.1400149c0
mov rax, qword [rbx]
mov qword [rbx + 8], rax
cmp byte [rbp - 0x61], r14b
je 0x140009c3b
lea rcx, str.sending_keypress_to_console_HWND
call fcn.1400149c0
mov rax, qword [rdi]
mov rbx, qword [rax]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xff
cmova eax, r14d
shl eax, 0x10
mov r9d, eax
or r9, 1
mov r8, r15
mov edx, pe_nt_image_headers64
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [rdi]
mov rbx, qword [rax]
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp eax, 0xff
cmova eax, r14d
shl eax, 0x10
mov r9d, eax
mov eax, 0xc0000001
or r9, rax
mov r8, r15
mov edx, 0x101
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x14000a033
xor r14d, r14d
movzx edi, r14w
lea eax, [r14 + 1]
lea ecx, [rax + 0x10]
test r13b, r13b
je 0x140009d11
lea edi, [rax + 7]
mov dword [rbp - 0x49], eax
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x41], 0x110001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
mov dword [rbp - 0x39], edi
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140009d00
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], edi
add qword [rbx + 8], 0x14
jmp 0x140009d0c
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
mov eax, 1
mov ecx, 0x12
test r12b, r12b
je 0x140009d73
or di, 2
mov dword [rbp - 0x49], 1
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x41], 0x120001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
movzx eax, di
mov dword [rbp - 0x39], eax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140009d62
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009d6e
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
mov ecx, 0x12
mov r13d, pe_nt_image_headers64
cmp byte [rbp - 0x60], r14b
je 0x140009dda
or di, 1
mov dword [rbp - 0x49], 1
mov eax, 1
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x41], 0x120001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
movzx eax, di
or eax, r13d
mov dword [rbp - 0x39], eax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140009dce
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009dda
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
mov ecx, 0x10
test sil, sil
je 0x140009e3b
or di, cx
mov dword [rbp - 0x49], 1
mov eax, 1
mov dword [rbp - 0x45], eax
mov dword [rbp - 0x41], 0x100001
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
movzx eax, di
mov dword [rbp - 0x39], eax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140009e2f
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009e3b
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
movzx esi, di
or si, r13w
cmp byte [rbp - 0x5d], r14b
cmove si, di
mov rcx, qword [rbp - 0x51]
cmp byte [rcx + 0xeb], r14b
mov rcx, rbx
je 0x140009e71
movzx r9d, word [rbp + 0x87]
mov r8d, dword [rbp + 0x7f]
movzx edx, r15w
call fcn.14000a6e0
jmp 0x140009e88
mov word [rsp + 0x20], si
mov r9d, dword [rbp - 0x59]
movzx r8d, r15w
mov edx, 1
call fcn.14000a060
mov word [rsp + 0x20], si
mov r9d, dword [rbp + 0x6f]
movzx r8d, r15w
xor edx, edx
mov rcx, rbx
call fcn.14000a060
movzx edi, si
mov eax, 0xfeff
and di, ax
cmp byte [rbp - 0x5d], r14b
cmove di, si
cmp byte [rbp - 0x5f], r14b
je 0x140009f12
mov eax, 0xffef
and di, ax
mov qword [rbp - 0x49], 1
mov dword [rbp - 0x41], 0x100001
mov ecx, 0x10
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
movzx eax, di
mov dword [rbp - 0x39], eax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140009f06
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009f12
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
mov r15d, 0x12
cmp byte [rbp - 0x60], r14b
je 0x140009f79
mov eax, 0xfffe
and di, ax
mov qword [rbp - 0x49], 1
mov dword [rbp - 0x41], 0x120001
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
movzx eax, di
or eax, r13d
mov dword [rbp - 0x39], eax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140009f6d
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009f79
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
test r12b, r12b
je 0x140009fd6
mov eax, 0xfffd
and di, ax
mov qword [rbp - 0x49], 1
mov dword [rbp - 0x41], 0x120001
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
movzx eax, di
mov dword [rbp - 0x39], eax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140009fca
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x140009fd6
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
cmp byte [rbp - 0x5e], r14b
je 0x14000a033
mov qword [rbp - 0x49], 1
mov dword [rbp - 0x41], 0x110001
mov ecx, 0x11
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x3d], ax
mov word [rbp - 0x3b], r14w
movzx eax, di
and eax, 0xfff7
mov dword [rbp - 0x39], eax
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x14000a027
movups xmm0, xmmword [rbp - 0x49]
movups xmmword [rdx], xmm0
mov dword [rdx + 0x10], eax
add qword [rbx + 8], 0x14
jmp 0x14000a033
lea r8, [rbp - 0x49]
mov rcx, rbx
call fcn.14000a380
mov rcx, qword [rbp - 0x11]
xor rcx, rsp
call fcn.140017c90
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14001e704
int3