Function at 0x140025450
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14002552e
je 0x140025526
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25624]
mov ecx, dword [rdx + rax*4 + 0x255d8]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_ioctlsocket
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_send
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25684]
mov ecx, dword [rdx + rax*4 + 0x2565c]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x1400255bc
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x1400255d0
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbp - 0x28]
cmp eax, dword [rbp + 0x10]
jae 0x140211590
mov eax, dword [rbp - 0x48]
mov ecx, dword [rbp - 0x44]
mov dword [rdi + 0x28], eax
mov dword [rdi + 0x20], eax
mov dword [rdi + 0x2c], ecx
mov dword [rdi + 0x24], ecx
mov ecx, edi
call 0x1401fdb3e
mov edi, eax
test edi, edi
je 0x1402112e3
test ebx, ebx
mov byte [rbp - 4], 4
je 0x140211546
mov eax, dword [rbx]
push rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
jmp 0x140211546
xor eax, eax
cmp dword [rbp + 0x14], eax
setne al
cmp byte [rbp - 0x11], 0
mov dword [rbp - 0x30], eax
je 0x1402112f9
mov ecx, dword [rbp - 0x28]
jmp 0x140211302
mov eax, dword [rbp + 0xc]
mov ecx, dword [rbp - 0x28]
mov ecx, dword [rax + rcx*4]
mov ebx, dword [rbp + 8]
mov edx, dword [rbx + 0x10]
cmp ecx, edx
jae 0x14021132b
lea eax, [rcx + rcx*2]
mov edx, ebx
shl eax, 4
add eax, dword [rdx + 0xc]
mov edx, dword [rax + 0x18]
mov edi, dword [rax + 8]
mov ebx, dword [rax + 0xc]
mov dword [rbp - 0x40], edx
mov edx, dword [rax + 0x1c]
mov dword [rbp - 0x3c], edx
jmp 0x140211357
mov eax, ecx
sub eax, edx
shl eax, 6
add eax, dword [rbx + 0x18]
cmp dword [rax + 4], 8
jne 0x140211345
and dword [rbp - 0x40], 0
and dword [rbp - 0x3c], 0
jmp 0x140211351
mov edx, dword [rax + 0x20]
mov dword [rbp - 0x40], edx
push rbp
ror byte [rbx + 0x55892450], 0xc4
mov edi, dword [rax + 0x18]
mov ebx, dword [rax + 0x1c]
and dword [rbp - 0x20], 0
push qword [rbp - 0x30]
mov eax, dword [rbp + 0x18]
lea edx, [rbp - 0x20]
mov byte [rbp - 4], 6
mov eax, dword [rax]
push rdx
push rcx
push qword [rbp + 0x18]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayLock]
xor ecx, ecx
mov dword [rbp - 0x2c], eax
cmp eax, ecx
je 0x1402113cb
mov eax, dword [rbp - 0x20]
mov byte [rbp - 4], 5
cmp eax, ecx
je 0x14021138c
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x24]
mov byte [rbp - 4], 4
test eax, eax
je 0x14021139d
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
cmp dword [rbp - 0x18], 0
mov byte [rbp - 4], 2
je 0x1402113b0
mov eax, dword [rbp - 0x18]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
and byte [rbp - 4], 0
cmp dword [rbp - 0x1c], 0
je 0x1402113c3
mov eax, dword [rbp - 0x1c]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x2c]
jmp 0x1402115d3
cmp dword [rbp + 0x14], ecx
jne 0x1402113de
cmp dword [rbp - 0x20], ecx
jne 0x1402113de
mov byte [rbp - 4], 5
jmp 0x140211576
mov eax, dword [rbp + 0x18]
push qword [rbp - 0x30]
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
mov dword [rbp - 0x30], eax
je 0x140211441
mov eax, dword [rbp - 0x20]
mov byte [rbp - 4], 5
test eax, eax
je 0x140211402
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x24]
mov byte [rbp - 4], 4
test eax, eax
je 0x140211413
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
cmp dword [rbp - 0x18], 0
mov byte [rbp - 4], 2
je 0x140211426
mov eax, dword [rbp - 0x18]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
and byte [rbp - 4], 0
cmp dword [rbp - 0x1c], 0
je 0x140211439
mov eax, dword [rbp - 0x1c]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x30]
jmp 0x1402115d3
mov eax, dword [rbp + 8]
push 0
push 0
push rbx
mov eax, dword [rax + 0x2c]
push rdi
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_recv]
mov edi, eax
test edi, edi
je 0x140211465
mov eax, dword [rbp - 0x20]
mov byte [rbp - 4], 5
jmp 0x14021152b
push qword [rbp - 0x18]
mov edi, dword [rbp - 0x40]
jge 0x14021142b
mov ebx, dword [rbp - 0x3c]
mov eax, dword [rbp - 0x1c]
xor ecx, ecx
mov dword [rsi + 0x10], edi
and byte [rsi + 0x20], cl
push rcx
push rcx
mov dword [rsi + 0x18], ecx
push qword [rbp - 0x20]
mov dword [rsi + 0x14], ebx
mov dword [rsi + 0x1c], ecx
mov edx, dword [rax]
push qword [rbp - 0x24]
push rax
call qword [rdx + reloc.WSOCK32.dll_ioctlsocket]
test eax, eax
mov dword [rbp - 0x30], eax
je 0x1402114e9
mov eax, dword [rbp - 0x20]
mov byte [rbp - 4], 5
test eax, eax
je 0x1402114a8
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
cmp dword [rbp - 0x24], 0
mov byte [rbp - 4], 4
je 0x1402114bb
mov eax, dword [rbp - 0x24]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
cmp dword [rbp - 0x18], 0
mov byte [rbp - 4], 2
je 0x1402114ce
mov eax, dword [rbp - 0x18]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
and byte [rbp - 4], 0
cmp dword [rbp - 0x1c], 0
je 0x1402114e1
mov eax, dword [rbp - 0x1c]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x30]
jmp 0x1402115d3
mov eax, dword [rbp - 0x20]
test eax, eax
je 0x1402114fa
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
and dword [rbp - 0x20], 0
mov eax, dword [rbp - 0x34]
add eax, 0x20
mov ecx, dword [rax]
cmp ecx, edi
jne 0x140211511
mov eax, dword [rax + 4]
cmp eax, ebx
jne 0x140211511
xor ecx, ecx
jmp 0x140211514
push 2
pop rcx
mov eax, dword [rbp + 0x18]
push rcx
push rax
mov edx, dword [rax]
call qword [rdx + 0x1c]
mov edi, eax
mov eax, dword [rbp - 0x20]
test edi, edi
mov byte [rbp - 4], 5
je 0x14021156c
test eax, eax
je 0x140211535
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x24]
mov byte [rbp - 4], 4
test eax, eax
je 0x140211546
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x18]
mov byte [rbp - 4], 2
test eax, eax
je 0x140211557
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x1c]
and byte [rbp - 4], 0
test eax, eax
je 0x140211568
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
push rcx
invalid
push rcx
or byte [rbx - 0x7a981439], cl
sal byte [rsi + rax - 0x75], 8
mov eax, edi
jmp 0x1402115d3
test eax, eax
je 0x140211576
mov ecx, dword [rax]
push rax
call qword [rcx + reloc.WSOCK32.dll_htonl]
mov eax, dword [rbp - 0x40]
inc dword [rbp - 0x28]
fadd dword [r9]
mov r8d, 0x8bc4458b
jge 0x14021154d
fadd dword [r9]
mov r8d, 0x8bc4458b
jge 0x14021154d
mov ebx, dword [rbp - 0x24]
adc dword [rbp - 0x44], eax
jmp 0x1402112a1
test ebx, ebx
mov byte [rbp - 4], 4
je 0x14021159e
mov eax, dword [rbx]
push rbx
call qword [rax + reloc.WSOCK32.dll_htonl]
cmp dword [rbp - 0x18], 0
mov byte [rbp - 4], 2
je 0x1402115b1
mov eax, dword [rbp - 0x18]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
and byte [rbp - 4], 0
cmp dword [rbp - 0x1c], 0
je 0x1402115c4
mov eax, dword [rbp - 0x1c]
push rax
mov ecx, dword [rax]
call qword [rcx + reloc.WSOCK32.dll_htonl]
xor eax, eax
jmp 0x1402115d3
mov eax, 0x1001d4a6
ret
mov ecx, dword [rbp - 0xc]
pop rdi
pop rsi
mov dword fs:[0x1402115df], ecx
pop rbx
leave
ret 0x14
adc al, 0
adc al, 0
cmp dword [rsp + 8], 0
mov ecx, dword [rsp + 4]
setne al
mov byte [rcx + 0x5d], al
xor eax, eax
ret 8
or byte [rax], al
or byte [rax], al
mov eax, 0x100e2e96
call 0x1402d4538
push rcx
push 0x68
call 0x1401f76fd
invalid
invalid
invalid
call [rcx - 0x75]
enter 0x4d89, 0xfffffffffffffff0
xor eax, eax
cmp ecx, eax
mov dword [rbp - 4], eax
je 0x14021161e
invalid
call 0x14021162a
mov ecx, dword [rbp - 0xc]
mov dword fs:[0x140211628], ecx
leave
ret