Function at 0x1401dd260
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x30
mov r12d, dword [rcx + 0xc]
xor ebp, ebp
mov edi, r12d
mov word [r8], bp
and edi, 0x1f
mov word [rdx], bp
mov rbx, r9
mov rsi, rdx
mov r15, rcx
mov dword [0x140462224], ebp
cmp dword [rcx], ebp
je 0x1401dd667
movzx r11d, word [rcx + 6]
mov ecx, r11d
sub ecx, 0x10
je 0x1401dd667
sub ecx, 1
je 0x1401dd667
cmp ecx, 1
je 0x1401dd667
mov qword [rsp + 0x50], r14
mov r14d, edi
and r14d, 0x10
cmp r11d, 9
jne 0x1401dd2ec
test r14d, r14d
je 0x1401dd2ec
mov word [rdx], 0xce
mov word [r8], recv
jmp 0x1401dd3d8
mov ecx, 0x25
lea rax, [0x1403b3be0]
lea r9, str.eeeep
nop
cmp word [rax - 8], r11w
jne 0x1401dd344
movzx r10d, word [rax]
mov word [rsi], r10w
test r14d, r14d
je 0x1401dd31a
movzx edx, word [rax + 4]
jmp 0x1401dd33c
test dil, 0xc
je 0x1401dd32e
test edi, 0xfffffff3
jne 0x1401dd32e
movzx edx, word [rax + 8]
jmp 0x1401dd33c
movzx edx, r10w
test dil, 3
je 0x1401dd33f
movzx edx, word [rax + 0xc]
mov word [rsi], dx
test dx, dx
jne 0x1401dd373
dec ecx
sub rax, 0x18
cmp rax, r9
jge 0x1401dd300
cmp dword [0x140461f4c], 2
jne 0x1401dd524
movzx eax, word [0x140461fb2]
mov word [r15 + 0xa], ax
mov dword [0x140461f4c], ebp
jmp 0x1401dd60e
movsxd rax, ecx
lea r12, [0x1403b3860]
lea rcx, [rax + rax*2]
lea r9, [rcx*8]
cmp dword [r9 + r12 + 4], ebp
je 0x1401dd3d8
mov word [r8], dx
mov word [rsi], 0xce
test rbx, rbx
je 0x1401dd3d8
lea eax, [r11 - 0x70]
cmp ax, 0xb
ja 0x1401dd3fb
test dil, 3
je 0x1401dd3c0
or dword [rbx], 8
test r14d, r14d
jne 0x1401dd3c0
movzx eax, word [r9 + r12 + 8]
mov word [r8], ax
test dil, 0xc
je 0x1401dd3d8
or dword [rbx], 4
test r14d, r14d
jne 0x1401dd3d8
movzx eax, word [r9 + r12 + 8]
mov word [r8], ax
mov eax, 1
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r12
pop rdi
ret
sub r11w, 0x23
cmp r11w, 5
ja 0x1401dd4fd
lea rsi, [r12 + 0xc]
mov dword [rbx], ebp
movzx eax, word [r9 + r12 + 8]
lea r11, [r9 + r12]
add rsi, r9
mov word [r8], ax
mov r10d, edi
mov edx, ebp
cmp edi, 0x10
jne 0x1401dd436
movzx eax, word [rsi]
and r10d, 0xc
jmp 0x1401dd46f
and r10d, 0xc
je 0x1401dd473
test edi, 0xfffffff3
jne 0x1401dd473
movzx eax, word [r9 + r12 + 0x10]
mov word [r8], ax
movzx eax, word [r15 + 6]
cmp ax, 0x26
je 0x1401dd45f
cmp ax, 0x28
jne 0x1401dd473
mov dword [rbx], 4
mov edx, 4
movzx eax, word [r11 + 8]
mov word [r8], ax
test r10d, r10d
setne cl
test dil, 0x10
setne al
test al, cl
je 0x1401dd499
mov dword [rbx], 4
mov edx, 4
movzx eax, word [r9 + r12 + 0xc]
mov word [r8], ax
test dil, 3
je 0x1401dd3d8
movzx eax, word [r9 + r12 + 0x14]
or edx, 8
mov word [r8], ax
mov dword [rbx], edx
test edi, 0xfffffffc
je 0x1401dd4f3
test r14d, r14d
je 0x1401dd4c7
movzx eax, word [rsi]
jmp 0x1401dd3d4
test r10d, r10d
je 0x1401dd3d8
movzx eax, word [r15 + 6]
mov ecx, 0xfffd
sub ax, 0x26
test cx, ax
je 0x1401dd4ee
movzx eax, word [r9 + r12 + 0x10]
jmp 0x1401dd3d4
or edx, 4
mov dword [rbx], edx
movzx eax, word [r11 + 8]
jmp 0x1401dd3d4
mov word [r8], r10w
test r14d, r14d
je 0x1401dd509
or dword [rbx], 2
test dil, 0xc
je 0x1401dd512
or dword [rbx], 4
test dil, 3
je 0x1401dd3d8
or dword [rbx], 8
jmp 0x1401dd3d8
cmp word [r15 + 0xa], bp
jne 0x1401dd60e
xor edx, edx
lea rcx, [0x140462290]
mov r8d, 0x100
call fcn.140002810
xor edx, edx
lea ecx, [rdx + 0x20]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [rsp + 0x28], ebp
lea r9, [0x140461fb0]
mov edx, eax
mov dword [rsp + 0x20], 2
lea r8, [0x140462290]
mov ecx, 0x20
call qword [sym.imp.USER32.dll_ToUnicode]
test r12b, 0x10
je 0x1401dd582
mov byte [0x1404622a0], 0x80
test r12b, r12b
jns 0x1401dd58e
mov byte [0x1404622a4], 1
and r12d, 9
cmp r12b, 9
jne 0x1401dd5af
mov byte [0x140462335], 0x80
mov word [0x1404622a1], 0x8080
mov byte [0x140462332], 0x80
movzx edx, word [r15 + 8]
lea r9, [0x140461fb0]
movzx ecx, word [r15 + 6]
lea r8, [0x140462290]
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_ToUnicode]
mov dword [0x140461f4c], eax
test eax, eax
jle 0x1401dd5f1
movzx eax, word [0x140461fb0]
mov word [r15 + 0xa], ax
jmp 0x1401dd60e
jns 0x1401dd607
movzx ecx, bp
mov word [rsi], bp
test cx, cx
setne bpl
mov eax, ebp
jmp 0x1401dd3dd
test eax, eax
movzx eax, bp
jle 0x1401dd613
movzx eax, word [r15 + 0xa]
mov word [rsi], ax
movzx ecx, ax
test rbx, rbx
je 0x1401dd659
mov edx, edi
and edx, 3
je 0x1401dd62e
test dil, 0xc
jne 0x1401dd62e
or dword [rbx], 8
test r14d, r14d
je 0x1401dd63c
cmp ax, 0x20
ja 0x1401dd63c
or dword [rbx], 2
test dil, 0xc
je 0x1401dd659
test edx, edx
jne 0x1401dd659
cmp ax, 0x20
jb 0x1401dd659
mov edx, 0x80
cmp ax, dx
jae 0x1401dd659
or dword [rbx], 4
test cx, cx
setne bpl
mov eax, ebp
jmp 0x1401dd3dd
xor eax, eax
jmp 0x1401dd3e2