Function at 0x140025450
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14002552e
je 0x140025526
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25624]
mov ecx, dword [rdx + rax*4 + 0x255d8]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_ioctlsocket
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_send
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25684]
mov ecx, dword [rdx + rax*4 + 0x2565c]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x1400255bc
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x1400255d0
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
in al, 0x2f
in al, 0x67
adc ebp, dword [rsi + 0x32785a40]
pop rdx
js 0x140211571
cld
jno 0x14021158b
jmp 0x140211564
adc ebx, dword [rbp + 0x43]
pop rbp
pop rsi
add al, 4
pop rdx
invalid
movsb byte [rdi], byte [rsi]
pop rsi
loope 0x140211582
invalid
jg 0x140211535
invalid
invalid
invalid
ret 0x7430
sub byte [rdi], 0xab
add eax, dword [rsi + rdx*2 - 0x1b]
and al, 0x3b
adc esi, dword [0xe505d17b]
cmp cl, byte [rbx - 0x2a]
adc dh, byte [rsi + 0x42276a9f]
push 0x27
cmp al, 0xd0
sub ebx, dword [rdx - 0x65a57745]
pop rsp
invalid
invalid
fdivr st(7)
invalid
fbld tbyte [rdi]
adc bl, bh
jae 0x14021155c
jge 0x14021157f
mov bl, 0x78
cmp eax, 0xcd5e37c4
add ebp, ecx
push 0x66
or eax, 0x23aff354
push rsp
repe scasd eax, dword [rdi]
and ebx, ecx
int3
pop rsi
test dword [rbx + 0xa6d321a], 0x491efff4
movabs byte ds:[0xef42fce86ecc8b45], al
mov ecx, esp
outsb dx, byte [rsi]
call 0x1471058fa
push rsp
repe scasd eax, dword [rdi]
and ebx, ecx
int3
mov ecx, esp
outsb dx, byte [rsi]
call 0x1471058fa
sub al, 0x5b
sbb dword [rbx + 0x731ef872], eax
push rax
push rcx
xor eax, 0xd19996e1
push rbx
mov eax, 0xe23b0f5f
rol byte ds:[rax], cl
xchg edx, eax
push rdx
cmp eax, 0x5e448613
pop rsi
push rdi
xor eax, 0xe0f82437
mov esp, 0x99d67c85
cdq
loop 0x140211695
loopne 0x1402115ce
nop
jnp 0x140211628
invalid
cwde
sub dword [rbp - 0x5ce5cfa8], esi
mov ecx, 0x89474f3f
cmp bh, byte [rbp - 0x57]
and al, 0xe7
cmp eax, 0x5bdf7349
ret