Function at 0x140033db6
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbp
push r15
mov rax, 8
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x140033dd4
sub rsp, 0x28
call fcn.14012b830
mov dword [section..data], 0x500046
mov dword [section..data], 0x500047
mov dword [rsp + 0x40], 0xffffffff
mov dword [section..data], 0x500048
sub rsp, 0x18
mov rdx, 1
lea rax, [rsp + 0x70]
push rax
xor r9, r9
mov r8, 7
mov rcx, 0x28
sub rsp, 0x20
call fcn.14010f258
add rsp, 0x40
mov qword [rsp + 0x58], rax
mov dword [section..data], 0x50004a
push 2
movzx rax, byte [rsp + 0xa8]
mov rcx, rax
pop rdx
call sub.USER32.dll_MapVirtualKeyW
mov r15, rax
and r15, r15
jne 0x140033ed2
mov dword [section..data], 0x50004b
mov dword [rsp + 0x28], 1
mov dword [section..data], 0x50004d
push 0
movzx rax, byte [rsp + 0xa8]
mov rcx, rax
pop rdx
call sub.USER32.dll_MapVirtualKeyW
mov dword [rsp + 0x30], eax
mov dword [section..data], 0x50004e
movsxd r15, dword [rsp + 0x30]
and r15, 0xffff
mov rax, r15
mov word [rsp + 0x38], ax
mov dword [section..data], 0x50004f
jmp 0x140033eff
mov dword [section..data], 0x50004f
mov dword [section..data], 0x500050
mov dword [rsp + 0x28], 0
mov dword [section..data], 0x500051
mov word [rsp + 0x38], 0
mov dword [section..data], 0x500052
mov dword [section..data], 0x500054
cmp dword [rsp + 0x98], 0
je 0x140033f2f
mov dword [section..data], 0x500055
mov dword [rsp + 0x50], 1
mov dword [section..data], 0x500056
mov dword [section..data], 0x500058
movsxd r15, dword [rsp + 0x80]
movsxd rcx, dword [rsp + 0x88]
add r15, rcx
movsxd rcx, dword [rsp + 0x90]
add r15, rcx
movsxd rcx, dword [rsp + 0x50]
add r15, rcx
add r15, r15
mov rax, r15
mov dword [rsp + 0x48], eax
mov dword [section..data], 0x500059
cmp byte [rsp + 0xa0], 0
je 0x140033fa1
mov dword [section..data], 0x50005a
movsxd r15, dword [rsp + 0x48]
add r15, 2
mov rax, r15
mov dword [rsp + 0x48], eax
mov dword [section..data], 0x50005b
mov dword [section..data], 0x50005d
movsxd rax, dword [rsp + 0x48]
inc rax
lea rdx, [rsp + 0x58]
mov rcx, rax
call fcn.14010f484
mov dword [section..data], 0x50005f
cmp dword [rsp + 0x80], 0
je 0x1400340c6
mov dword [section..data], 0x500060
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x500061
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x500062
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], reloc.WS2_32.dll_recvfrom
mov dword [section..data], 0x500063
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x500064
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 4
mov dword [section..data], 0x500065
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x500066
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x500067
mov dword [section..data], 0x500069
cmp dword [rsp + 0x88], 0
je 0x1400341cc
mov dword [section..data], 0x50006a
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x50006b
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x50006c
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], reloc.WS2_32.dll_select
mov dword [section..data], 0x50006d
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x50006e
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 4
mov dword [section..data], 0x50006f
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x500070
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x500071
mov dword [section..data], 0x500073
cmp dword [rsp + 0x90], 0
je 0x1400342d2
mov dword [section..data], 0x500074
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x500075
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x500076
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [section..data], 0x500077
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x500078
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 4
mov dword [section..data], 0x500079
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x50007a
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x50007b
mov dword [section..data], 0x50007d
movsxd r15, dword [rsp + 0x98]
cmp r15, 1
jne 0x1400343dc
mov dword [section..data], 0x50007e
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x50007f
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x500080
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], 0x5b
mov dword [section..data], 0x500081
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x500082
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 4
mov dword [section..data], 0x500083
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x500084
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x500085
mov dword [section..data], 0x500087
movsxd r15, dword [rsp + 0x98]
cmp r15, 2
jne 0x1400344e6
mov dword [section..data], 0x500088
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x500089
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x50008a
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], 0x5c
mov dword [section..data], 0x50008b
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x50008c
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 4
mov dword [section..data], 0x50008d
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x50008e
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x50008f
mov dword [section..data], 0x500091
cmp byte [rsp + 0xa0], 0
je 0x140034702
mov dword [section..data], 0x500092
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x500093
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x500094
movzx rax, byte [rsp + 0xa0]
push rax
movsxd r15, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
imul r15, r15, 0x28
add rbp, r15
pop rax
mov word [rbp + 8], ax
mov dword [section..data], 0x500095
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x500096
movsxd r15, dword [rsp + 0x28]
or r15, 4
mov rax, r15
push rax
movsxd r15, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
imul r15, r15, 0x28
add rbp, r15
pop rax
mov dword [rbp + 0xc], eax
mov dword [section..data], 0x500097
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x500098
movsx rax, word [rsp + 0x38]
push rax
movsxd r15, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
imul r15, r15, 0x28
add rbp, r15
pop rax
mov word [rbp + 0xa], ax
mov dword [section..data], 0x50009a
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x50009b
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x50009c
movzx rax, byte [rsp + 0xa0]
push rax
movsxd r15, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
imul r15, r15, 0x28
add rbp, r15
pop rax
mov word [rbp + 8], ax
mov dword [section..data], 0x50009d
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x50009e
movsxd r15, dword [rsp + 0x28]
or r15, 6
mov rax, r15
push rax
movsxd r15, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
imul r15, r15, 0x28
add rbp, r15
pop rax
mov dword [rbp + 0xc], eax
mov dword [section..data], 0x50009f
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x5000a0
movsx rax, word [rsp + 0x38]
push rax
movsxd r15, dword [rsp + 0x48]
mov rbp, qword [rsp + 0x60]
imul r15, r15, 0x28
add rbp, r15
pop rax
mov word [rbp + 0xa], ax
mov dword [section..data], 0x5000a1
mov dword [section..data], 0x5000a3
cmp dword [rsp + 0x90], 0
je 0x140034808
mov dword [section..data], 0x5000a4
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x5000a5
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x5000a6
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [section..data], 0x5000a7
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x5000a8
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 6
mov dword [section..data], 0x5000a9
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x5000aa
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x5000ab
mov dword [section..data], 0x5000ad
cmp dword [rsp + 0x88], 0
je 0x14003490e
mov dword [section..data], 0x5000ae
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x5000af
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x5000b0
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], reloc.WS2_32.dll_select
mov dword [section..data], 0x5000b1
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x5000b2
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 6
mov dword [section..data], 0x5000b3
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x5000b4
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x5000b5
mov dword [section..data], 0x5000b7
cmp dword [rsp + 0x80], 0
je 0x140034a14
mov dword [section..data], 0x5000b8
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x5000b9
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x5000ba
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], reloc.WS2_32.dll_recvfrom
mov dword [section..data], 0x5000bb
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x5000bc
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 6
mov dword [section..data], 0x5000bd
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x5000be
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x5000bf
mov dword [section..data], 0x5000c1
movsxd r15, dword [rsp + 0x98]
cmp r15, 2
jne 0x140034b1e
mov dword [section..data], 0x5000c2
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x5000c3
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x5000c4
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], 0x5c
mov dword [section..data], 0x5000c5
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x5000c6
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 4
mov dword [section..data], 0x5000c7
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x5000c8
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x5000c9
mov dword [section..data], 0x5000cb
movsxd r15, dword [rsp + 0x98]
cmp r15, 1
jne 0x140034c28
mov dword [section..data], 0x5000cc
movsxd r15, dword [rsp + 0x40]
inc r15
mov rax, r15
mov dword [rsp + 0x40], eax
mov dword [section..data], 0x5000cd
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp], 1
mov dword [section..data], 0x5000ce
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 8], 0x5b
mov dword [section..data], 0x5000cf
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov qword [rbp + 0x18], 0
mov dword [section..data], 0x5000d0
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0xc], 4
mov dword [section..data], 0x5000d1
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov dword [rbp + 0x10], 0
mov dword [section..data], 0x5000d2
movsxd r15, dword [rsp + 0x40]
mov rbp, qword [rsp + 0x58]
imul r15, r15, 0x28
add rbp, r15
mov word [rbp + 0xa], 0
mov dword [section..data], 0x5000d3
mov dword [section..data], 0x5000d5
push 0x28
mov rbp, qword [rsp + 0x60]
lea rax, [rbp]
push rax
movsxd rax, dword [rsp + 0x58]
mov rcx, rax
pop rdx
pop r8
call sub.USER32.dll_SendInput
mov dword [section..data], 0x5000d7
xor rax, rax
push rax
mov rcx, qword [rsp + 0x60]
sub rsp, 0x28
call fcn.14010f5ac
add rsp, 0x28
pop rax
add rsp, 0x68
pop r15
pop rbp
ret