Function at 0x140046a80
Capabilities:
Log keystrokes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov rax, qword [0x140131088]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, r9
mov r14, rcx
mov qword [rbp - 0x11], r9
mov qword [rbp + 0xf], 7
xor r15d, r15d
mov qword [rbp + 7], r15
mov word [rbp - 9], r15w
shr r8, 1
lea rcx, [rbp - 9]
call fcn.140008a20
nop
lea ecx, [r15 + 0x48]
call fcn.14009dbb8
mov qword [rbp - 0x29], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov qword [rax + 0x40], rcx
mov rcx, rax
call fcn.140033370
mov r9, rax
test rax, rax
jne 0x140046b21
mov ebx, r15d
mov qword [rbp - 0x29], r15
jmp 0x140046b4c
mov rax, qword [rax + 0x10]
movsxd rcx, dword [rax + 8]
lea rbx, [r9 + 0x10]
add rbx, rcx
mov qword [rbp - 0x29], rbx
je 0x140046b4c
mov rax, qword [rbx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov byte [rbp - 0x59], 0
lea r8, [rbp - 0x59]
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.1400393e0
mov ecx, 0x78
call fcn.14009dbb8
mov qword [rbp - 0x21], rax
mov rcx, rax
call fcn.140039030
mov rdi, rax
mov qword [rbp - 0x21], rax
test rax, rax
je 0x140046b8c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + reloc.OLEAUT32.dll_VariantClear]
nop
test rbx, rbx
je 0x140046ba6
mov rax, qword [rbx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rdi + 0x38]
test r8, r8
je 0x140046bc4
mov rax, qword [r8 + 8]
movsxd rdx, dword [rax + 4]
lea rcx, [r8 + 8]
add rcx, rdx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [rdi + 0x38], rbx
movzx eax, byte [rbp - 0x59]
mov byte [rdi + 0x48], al
mov rax, qword [rdi + 0x10]
movsxd rax, dword [rax + 8]
add rax, 0x10
add rax, rdi
mov qword [rsp + 0x20], rax
mov rcx, r14
call fcn.140046d10
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x51], 1
mov r14d, 0x1b
mov word [rbp - 0x49], r14w
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x47], ax
mov dword [rbp - 0x45], r15d
lea r8d, [r14 + 0xd]
lea rdx, [rbp - 0x51]
lea ecx, [r14 - 0x1a]
call qword [sym.imp.USER32.dll_SendInput]
lea ecx, [r14 + 0x17]
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
mov dword [rbp - 0x51], 1
mov word [rbp - 0x49], r14w
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov word [rbp - 0x47], ax
mov dword [rbp - 0x45], 2
lea r8d, [r14 + 0xd]
lea rdx, [rbp - 0x51]
lea ecx, [r14 - 0x1a]
call qword [sym.imp.USER32.dll_SendInput]
nop
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
nop
test rbx, rbx
je 0x140046cb2
mov rax, qword [rbx + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rbx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov r8, qword [rbp + 0xf]
cmp r8, 8
jb 0x140046ccc
inc r8
mov rdx, qword [rbp - 9]
lea rcx, [rbp - 9]
call fcn.140008b70
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], r15
mov word [rbp - 9], r15w
mov rcx, qword [rsi]
test rcx, rcx
je 0x140046cec
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov al, 1
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.14009d860
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret