Function at 0x14006ad60
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, r9
mov r9, qword [rsp + 0x88]
mov r10, r8
mov r8, qword [rsp + 0x80]
mov rdi, rdx
mov rsi, rcx
mov rdx, rax
mov rcx, r10
call fcn.140086740
mov rbx, rax
test rax, rax
je 0x14006b142
mov rdx, rdi
mov rcx, rax
call fcn.1400e9630
mov rdi, rax
test rax, rax
je 0x14006b142
mov qword [rsp + 0x70], r13
xor edx, edx
mov rcx, rbx
mov qword [rsp + 0x78], r14
xor r14b, r14b
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r13d, eax
test eax, eax
je 0x14006ae00
cmp eax, dword [0x1401430c0]
je 0x14006ae00
mov rcx, rbx
call fcn.1400e9c60
test al, al
jne 0x14006ae00
mov ecx, dword [0x1401430c0]
mov r8d, 1
mov edx, r13d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r14b
mov rcx, rdi
call qword [sym.imp.USER32.dll_SetFocus]
test rax, rax
je 0x14006b114
mov rbx, qword [0x140140268]
mov qword [rsp + 0x68], r12
movzx eax, byte [rbx + 0x23]
test al, al
jne 0x14006ae47
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140103674]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
jmp 0x14006b08f
lea r12, [0x140103674]
mov qword [rsp + 0x60], rbp
cmp qword [rbx + 8], r12
jne 0x14006ae62
mov rbp, qword [rbx + 0x10]
shr rbp, 1
jmp 0x14006ae67
mov ebp, 1
lea rcx, [rbp + 1]
lea rsi, [rcx + rcx]
cmp al, 2
jne 0x14006ae83
mov rdx, rbp
mov rcx, r12
call fcn.140006bc0
jmp 0x14006b08a
mov r8, qword [0x14013b0d0]
cmp rsi, r8
jbe 0x14006aeb4
cmp rsi, qword [rbx + 0x18]
jbe 0x14006aeb4
lea r8, [0x1401035ac]
lea rdx, [0x140124720]
lea rcx, [0x140143150]
call fcn.14005f7b0
jmp 0x14006b08a
cmp rcx, 2
jae 0x14006aece
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 3]
call fcn.1400e74d0
jmp 0x14006b08a
movzx eax, byte [rbx + 0x21]
test al, 2
je 0x14006aeeb
mov rcx, qword [rbx]
and al, 0x3d
mov byte [rbx + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r8, qword [0x14013b0d0]
mov rcx, qword [rbx + 0x18]
and byte [rbx + 0x21], 0x82
cmp rsi, rcx
jbe 0x14006b060
movzx r9d, byte [rbx + 0x20]
movzx eax, r9b
cmp r9b, 1
jbe 0x14006af1e
cmp al, 2
je 0x14006af5b
mov rdi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x30]
jmp 0x14006b054
mov edi, 0x80
cmp rsi, rdi
ja 0x14006af5b
cmp rsi, 8
ja 0x14006af35
mov edi, 8
jmp 0x14006af41
mov eax, reloc.WSOCK32.dll_recv
cmp rsi, rax
cmovbe rdi, rax
mov rcx, rdi
call fcn.1400dd290
test rax, rax
je 0x14006b08a
mov byte [rbx + 0x20], 1
jmp 0x14006b054
cmp rsi, 0x20
jae 0x14006af6b
mov edi, SafeArrayAllocDescriptor
jmp 0x14006b015
mov edi, 0x208
cmp rsi, rdi
jb 0x14006b015
cmp rsi, 0x50000
jae 0x14006afd1
pxor xmm0, xmm0
cvtsi2sd xmm0, rsi
test rsi, rsi
jns 0x14006af98
addsd xmm0, qword [0x1401279a8]
mulsd xmm0, qword [0x1401279e0]
movsd xmm1, qword [0x1401279d8]
xor eax, eax
comisd xmm0, xmm1
jbe 0x14006afc7
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14006afc7
movabs rdx, 0x8000000000000000
mov rax, rdx
cvttsd2si rdi, xmm0
add rdi, rax
jmp 0x14006b015
cmp rsi, 0x320000
jae 0x14006afe3
lea rdi, [rsi + 0x8000]
jmp 0x14006b015
cmp rsi, 0xc80000
jae 0x14006b00e
movabs rax, 0x47ae147ae147ae15
mov rdi, rsi
mul rsi
sub rdi, rdx
shr rdi, 1
add rdi, rdx
shr rdi, 6
add rdi, rsi
jmp 0x14006b015
lea rdi, [rsi + 0x20000]
cmp rdi, r8
cmova rdi, r8
cmp r9b, 2
jne 0x14006b036
test rcx, rcx
je 0x14006b036
mov rcx, qword [rbx + 8]
mov sil, 1
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x14006b039
xor sil, sil
test rdi, rdi
js 0x14006b0c5
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_malloc]
test rax, rax
je 0x14006b0c5
mov byte [rbx + 0x20], 2
and byte [rbx + 0x21], 0x7f
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], rdi
mov rcx, qword [rbx + 8]
cmp rcx, r12
je 0x14006b077
lea r8, [rbp + rbp]
mov rdx, r12
call qword [sym.imp.MSVCR100.dll_memmove]
mov rax, qword [rbx + 8]
lea rcx, [rbp + rbp]
xor edx, edx
mov word [rcx + rax], dx
mov qword [rbx + 0x10], rcx
mov rbp, qword [rsp + 0x60]
mov rax, qword [0x14013b0f8]
mov r12, qword [rsp + 0x68]
cmp dword [rax + 0x78], 0xffffffff
jle 0x14006b114
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1401430c0], eax
jne 0x14006b104
mov rax, qword [0x14013b0f8]
mov edx, 1
mov ecx, dword [rax + 0x78]
call fcn.140001b80
jmp 0x14006b114
xor edx, edx
test sil, sil
je 0x14006b0dd
lea rax, [0x140141fa8]
mov qword [rbx + 0x18], rdx
mov qword [rbx + 8], rax
jmp 0x14006b0e4
mov rax, qword [rbx + 8]
mov word [rax], dx
mov qword [rbx + 0x10], rdx
lea r8, [0x1401035ac]
lea rcx, [0x140143150]
lea rdx, str.Out_of_memory.
call fcn.14005f7b0
jmp 0x14006b08a
mov rcx, qword [0x14013b0f8]
mov ecx, dword [rcx + 0x78]
call qword [sym.imp.KERNEL32.dll_Sleep]
test r14b, r14b
mov r14, qword [rsp + 0x78]
je 0x14006b130
mov ecx, dword [0x1401430c0]
xor r8d, r8d
mov edx, r13d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, 1
mov r13, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
mov dl, 1
mov rcx, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbx
jmp fcn.14005e3f0