Function at 0x14001c0a0
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
mov rbp, rsp
sub rsp, 0x70
xor edi, edi
lea rax, [0x140090e70]
lea rcx, [0x1400b5958]
mov qword [0x1400b5930], rax
lea rax, [0x140091128]
mov dword [rbp + 0x20], edi
mov qword [0x1400b6160], rdi
mov qword [0x1400b6168], rdi
mov word [0x1400b6170], di
mov qword [0x1400b6158], rax
mov qword [0x1400b5938], rdi
mov qword [0x1400b5940], rdi
mov dword [0x1400b5948], edi
call fcn.140001cc0
lea rcx, [0x1400b5978]
call fcn.140001cc0
lea rcx, [0x1400b5998]
call fcn.140001cc0
lea rcx, [0x1400b59c0]
call fcn.140001cc0
lea rcx, [0x1400b59e0]
call fcn.140001cc0
lea rcx, [0x1400b5a00]
call fcn.140001cc0
lea rcx, [0x1400b5a20]
call fcn.140001cc0
lea rdx, [0x14008b028]
lea rcx, [0x1400b5a20]
call fcn.1400025a8
mov r11, qword [0x1400b5930]
lea r12, [0x1400b5930]
movsxd rax, dword [r11 + 4]
lea rcx, [0x140090e58]
lea esi, [rdi + 1]
mov qword [rax + r12], rcx
mov rax, qword [0x1400b5930]
movsxd rcx, dword [rax + 4]
lea eax, [rdi + 5]
lea edx, [rcx - 0x828]
mov dword [rcx + r12 - 4], edx
lea ecx, [rdi + 0x5b]
xor edx, edx
mov dword [0x1400b5a40], eax
mov dword [0x1400b5a44], eax
mov word [0x1400b5a48], si
mov qword [0x1400b5a50], rdi
mov qword [0x1400b5a58], rdi
mov dword [0x1400b5a60], edi
mov dword [0x1400b5a4c], 4
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [rdi + 0x10]
xor edx, edx
mov byte [0x1400b5a75], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, RegisterTypeLib
mov byte [0x1400b5a72], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
mov ecx, RegisterTypeLib
mov byte [0x1400b5a73], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [rdi + 0x11]
xor edx, edx
mov byte [0x1400b5a74], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea ecx, [rdi + 0x12]
xor edx, edx
mov byte [0x1400b5a70], al
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rcx, [0x1400b5a80]
mov byte [0x1400b5a71], al
call fcn.140001cc0
lea rcx, [0x1400b5aa0]
call fcn.140001cc0
lea rcx, [0x1400b5ac0]
call fcn.140001cc0
mov qword [0x1400b5b18], rdi
mov qword [0x1400b5b20], rdi
mov dword [0x1400b5b28], edi
mov qword [0x1400b5b30], rdi
lea rcx, [0x1400b5b70]
mov qword [0x1400b5b38], rdi
mov dword [0x1400b5b40], edi
mov qword [0x1400b5b48], rdi
mov qword [0x1400b5b50], rdi
mov qword [0x1400b5b58], rdi
mov dword [0x1400b5b60], edi
call fcn.140001cc0
lea rax, [0x14008bbc0]
mov qword [0x1400b5bc8], rax
lea rax, [0x14008bbc0]
lea r11, [0x14008bbc0]
mov qword [0x1400b5be8], rax
lea rax, [0x14008bbc0]
lea rcx, [0x1400b5c60]
mov qword [0x1400b5c08], rax
lea rax, [0x14008bbc0]
mov qword [0x1400b5b90], r11
mov qword [0x1400b5b98], rdi
mov qword [0x1400b5ba0], rdi
mov qword [0x1400b5ba8], rdi
mov qword [0x1400b5c28], rax
mov qword [0x1400b5bb0], rdi
mov qword [0x1400b5bb8], rdi
mov word [0x1400b5bc0], di
mov qword [0x1400b5bd0], rdi
mov qword [0x1400b5bd8], rdi
mov qword [0x1400b5be0], rdi
mov qword [0x1400b5bf0], rdi
mov qword [0x1400b5bf8], rdi
mov qword [0x1400b5c00], rdi
mov qword [0x1400b5c10], rdi
mov qword [0x1400b5c18], rdi
mov qword [0x1400b5c20], rdi
mov qword [0x1400b5c30], rdi
mov qword [0x1400b5c38], rdi
mov qword [0x1400b5c40], rdi
mov dword [0x1400b5c48], edi
mov dword [0x1400b5c50], esi
mov qword [0x1400b5c58], rdi
call fcn.140001cc0
lea rcx, [0x1400b5c98]
mov qword [0x1400b5c80], rdi
call fcn.140001cc0
lea rcx, [0x1400b5cb8]
call fcn.140001cc0
lea rcx, [0x1400b5cd8]
call fcn.140009114
lea rcx, [0x1400b5d50]
call fcn.140009114
lea rcx, [0x1400b5dc8]
call fcn.140001cc0
lea rbx, [0x14008b400]
lea ecx, [rdi + 8]
mov qword [0x1400b5e08], rbx
mov qword [0x1400b5e10], rdi
mov qword [0x1400b5e18], rdi
mov qword [0x1400b5e20], rdi
call fcn.14006f7d8
test rax, rax
je 0x14001c408
mov qword [rax], rdi
jmp 0x14001c40b
mov rax, rdi
lea rcx, [0x1400b5e68]
mov qword [0x1400b5c80], rax
mov qword [0x1400b5e38], rbx
mov qword [0x1400b5e40], rdi
mov qword [0x1400b5e48], rdi
mov qword [0x1400b5e50], rdi
call fcn.140005174
lea rcx, [0x1400b60b0]
call fcn.140001cc0
lea rcx, [0x1400b612c]
xor edx, edx
mov qword [0x1400b60e8], rdi
mov qword [0x1400b60f0], rdi
mov dword [0x1400b60f8], edi
mov qword [0x1400b6108], rdi
mov qword [0x1400b6110], rdi
mov dword [0x1400b6118], edi
call fcn.14001f27c
mov rax, qword [0x1400b5930]
mov dword [0x1400b6138], edi
mov dword [0x1400b6140], esi
mov qword [0x1400b6148], rdi
movsxd rcx, dword [rax + 4]
lea rax, [0x1400b5938]
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], edi
add rcx, rax
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rdi
mov byte [rbp - 0x38], dil
mov dword [rbp - 0x34], edi
mov byte [rbp - 0x30], dil
mov dword [rbp - 0x28], edi
mov dword [rbp - 0x20], esi
mov qword [rbp - 0x18], rdi
mov byte [rbp - 0x10], dil
call fcn.14001ef08
lea rcx, [rbp - 0x28]
call fcn.140017688
lea rcx, [rbp - 0x50]
call fcn.140017688
mov ecx, 0xfffffff6
mov byte [0x1400b5af8], dil
mov qword [0x1400b5ae8], rdi
mov qword [0x1400b5ae0], rdi
mov qword [0x1400b5af0], rdi
mov dword [0x1400b5b6c], edi
mov word [0x1400b6100], di
mov byte [0x1400b6130], dil
mov qword [0x1400b60e0], rdi
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
test rax, rax
je 0x14001c554
cmp rax, 0xffffffffffffffff
je 0x14001c554
mov rcx, rax
call fcn.140016658
mov rcx, rax
mov qword [0x1400b6120], rax
call fcn.1400166d4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001c55b
mov qword [0x1400b6120], rdi
lea r11, [rsp + 0x70]
mov edx, 0xfa
mov ecx, 0xa
mov rbx, qword [r11 + 0x28]
mov dword [0x1400b5afc], esi
mov dword [0x1400b5b00], esi
mov dword [0x1400b5b04], esi
mov dword [0x1400b5e28], esi
mov dword [0x1400b5e2c], esi
mov rsi, qword [r11 + 0x30]
mov word [0x1400b5af9], di
mov byte [0x1400b5afb], dil
mov byte [0x1400b5b14], dil
mov dword [0x1400b6128], 0x64
mov word [0x1400b5e30], di
mov dword [0x1400b5e5c], edx
mov dword [0x1400b5b08], ecx
mov dword [0x1400b5b0c], ecx
mov dword [0x1400b5b10], edx
mov rax, r12
mov rsp, r11
pop r12
pop rdi
pop rbp
ret