Function at 0x1400b7fb0
Capabilities:
Log keystrokes
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
add rcx, 0xfffffffffffffff8
mov rbx, rdx
cmp rcx, 0xd6
ja case.0x1400b7fe3.10
lea rdx, [0x140000000]
movzx eax, byte [rdx + rcx + 0xb864c]
mov ecx, dword [rdx + rax*4 + 0xb84c0]
add rcx, rdx
jmp rcx
mov rax, qword gs:[0x58]
mov ecx, dword [0x1400f87e0]
mov edx, 0x28
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1400f796c], eax
jg 0x1400b8481
sar rbx, 0x10
mov eax, 0x2a
movzx ecx, bl
mov edx, 0x26
cmp ecx, dword [0x1400f7968]
cmove eax, edx
add rsp, 0x20
pop rbx
ret
shr rbx, 0x10
mov eax, 0x27
bt bx, 8
mov ecx, 0x2b
cmovb eax, ecx
add rsp, 0x20
pop rbx
ret
shr rbx, 0x10
mov eax, 0x25
bt bx, 8
mov ecx, 0x29
cmovb eax, ecx
add rsp, 0x20
pop rbx
ret
mov eax, 0x28
add rsp, 0x20
pop rbx
ret
mov eax, 0x2c
add rsp, 0x20
pop rbx
ret
mov eax, 0x2d
add rsp, 0x20
pop rbx
ret
mov eax, 0x30
add rsp, 0x20
pop rbx
ret
mov eax, 0x34
add rsp, 0x20
pop rbx
ret
mov eax, 0x37
add rsp, 0x20
pop rbx
ret
mov eax, 0x38
add rsp, 0x20
pop rbx
ret
mov eax, 0x2e
add rsp, 0x20
pop rbx
ret
mov eax, 0x2f
add rsp, 0x20
pop rbx
ret
mov eax, 0x31
add rsp, 0x20
pop rbx
ret
mov eax, 0x32
add rsp, 0x20
pop rbx
ret
mov eax, 0x33
add rsp, 0x20
pop rbx
ret
mov eax, 0x35
add rsp, 0x20
pop rbx
ret
mov eax, 0x36
add rsp, 0x20
pop rbx
ret
mov eax, 0x24
add rsp, 0x20
pop rbx
ret
mov eax, 0x39
add rsp, 0x20
pop rbx
ret
mov eax, 0x3a
add rsp, 0x20
pop rbx
ret
mov eax, 0x3b
add rsp, 0x20
pop rbx
ret
mov eax, 0x3c
add rsp, 0x20
pop rbx
ret
mov eax, 0x3d
add rsp, 0x20
pop rbx
ret
mov eax, 0x3e
add rsp, 0x20
pop rbx
ret
mov eax, 0x3f
add rsp, 0x20
pop rbx
ret
mov eax, 0x40
add rsp, 0x20
pop rbx
ret
mov eax, 0x41
add rsp, 0x20
pop rbx
ret
mov eax, 0x42
add rsp, 0x20
pop rbx
ret
mov eax, 0x43
add rsp, 0x20
pop rbx
ret
mov eax, 0x44
add rsp, 0x20
pop rbx
ret
mov eax, 0x45
add rsp, 0x20
pop rbx
ret
mov eax, 0x46
add rsp, 0x20
pop rbx
ret
mov eax, 0x64
add rsp, 0x20
pop rbx
ret
mov eax, 0x55
add rsp, 0x20
pop rbx
ret
mov eax, 0x56
add rsp, 0x20
pop rbx
ret
mov eax, 0x57
add rsp, 0x20
pop rbx
ret
mov eax, 0x58
add rsp, 0x20
pop rbx
ret
mov eax, 0x59
add rsp, 0x20
pop rbx
ret
mov eax, 0x5a
add rsp, 0x20
pop rbx
ret
mov eax, 0x5b
add rsp, 0x20
pop rbx
ret
mov eax, 0x5c
add rsp, 0x20
pop rbx
ret
mov eax, 0x5d
add rsp, 0x20
pop rbx
ret
mov eax, 0x5e
add rsp, 0x20
pop rbx
ret
mov eax, 0x5f
add rsp, 0x20
pop rbx
ret
mov eax, 0x60
add rsp, 0x20
pop rbx
ret
mov eax, 0x61
add rsp, 0x20
pop rbx
ret
mov eax, 0x62
add rsp, 0x20
pop rbx
ret
mov eax, 0x63
add rsp, 0x20
pop rbx
ret
mov eax, 0x47
add rsp, 0x20
pop rbx
ret
mov eax, 0x48
add rsp, 0x20
pop rbx
ret
mov eax, 0x49
add rsp, 0x20
pop rbx
ret
mov eax, 0x4a
add rsp, 0x20
pop rbx
ret
mov eax, 0x4b
add rsp, 0x20
pop rbx
ret
mov eax, 0x4c
add rsp, 0x20
pop rbx
ret
mov eax, 0x4d
add rsp, 0x20
pop rbx
ret
mov eax, 0x4e
add rsp, 0x20
pop rbx
ret
mov eax, 0x4f
add rsp, 0x20
pop rbx
ret
mov eax, 0x50
add rsp, 0x20
pop rbx
ret
mov eax, 0x51
add rsp, 0x20
pop rbx
ret
mov eax, 0x52
add rsp, 0x20
pop rbx
ret
mov eax, 0x53
add rsp, 0x20
pop rbx
ret
mov eax, 0x54
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov eax, 0x19
add rsp, 0x20
pop rbx
ret
mov eax, 4
add rsp, 0x20
pop rbx
ret
mov eax, 0x11
add rsp, 0x20
pop rbx
ret
mov eax, 0x13
add rsp, 0x20
pop rbx
ret
mov eax, 0x18
add rsp, 0x20
pop rbx
ret
mov eax, 0x14
add rsp, 0x20
pop rbx
ret
mov eax, 8
add rsp, 0x20
pop rbx
ret
mov eax, 0xe
add rsp, 0x20
pop rbx
ret
mov eax, 0xf
add rsp, 0x20
pop rbx
ret
mov eax, 0x10
add rsp, 0x20
pop rbx
ret
mov eax, 0x12
add rsp, 0x20
pop rbx
ret
mov eax, 3
add rsp, 0x20
pop rbx
ret
mov eax, 5
add rsp, 0x20
pop rbx
ret
mov eax, 6
add rsp, 0x20
pop rbx
ret
mov eax, 7
add rsp, 0x20
pop rbx
ret
mov eax, 9
add rsp, 0x20
pop rbx
ret
mov eax, 0xa
add rsp, 0x20
pop rbx
ret
mov eax, 0xb
add rsp, 0x20
pop rbx
ret
mov eax, 0xc
add rsp, 0x20
pop rbx
ret
mov eax, 0x16
add rsp, 0x20
pop rbx
ret
mov eax, 0x17
add rsp, 0x20
pop rbx
ret
mov eax, 2
add rsp, 0x20
pop rbx
ret
mov eax, 0x15
add rsp, 0x20
pop rbx
ret
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov eax, 0xd
add rsp, 0x20
pop rbx
ret
mov eax, 0x1a
add rsp, 0x20
pop rbx
ret
mov eax, 0x1b
add rsp, 0x20
pop rbx
ret
mov eax, 0x1c
add rsp, 0x20
pop rbx
ret
mov eax, 0x1d
add rsp, 0x20
pop rbx
ret
mov eax, 0x1e
add rsp, 0x20
pop rbx
ret
mov eax, 0x1f
add rsp, 0x20
pop rbx
ret
mov eax, 0x20
add rsp, 0x20
pop rbx
ret
mov eax, 0x21
add rsp, 0x20
pop rbx
ret
mov eax, 0x22
add rsp, 0x20
pop rbx
ret
mov eax, 0x23
add rsp, 0x20
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
lea rcx, [0x1400f796c]
call fcn.1400bede0
cmp dword [0x1400f796c], 0xffffffff
jne 0x1400b800c
xor edx, edx
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
lea rcx, [0x1400f796c]
mov dword [0x1400f7968], eax
call fcn.1400bed74
jmp 0x1400b800c