Function at 0x180003390
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x28
cmp byte [0x18006a558], 0
je case.default.0x180003420
mov edx, dword [0x18006a560]
mov ecx, dword [0x18006a55c]
call fcn.180051ad0
test eax, eax
je case.default.0x180003420
cmp byte [0x18006a0b0], 0
jne case.default.0x180003420
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x18006adc0], rax
jne case.default.0x180003420
xor edx, edx
lea ecx, [rdx + 0x20]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov cl, 0x20
call qword [sym.imp.USER32.dll_keybd_event]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov rdx, qword [0x18006aea8]
add rdx, 0x10
cmp rdx, rax
ja case.default.0x180003420
xor edx, edx
mov qword [0x18006aea8], rax
lea ecx, [rdx + 0x20]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
xor r9d, r9d
mov cl, 0x20
mov edx, eax
lea r8d, [r9 + 2]
add rsp, 0x28
jmp qword [sym.imp.USER32.dll_keybd_event]
add rsp, 0x28
ret
lea r9, [rax + r9 - 0x3d2e]
movzx ecx, ax
add rcx, rax
movzx eax, byte [rdi + rax*8 - 0x1e990]
mov r8d, ecx
lea rdi, [rdi + rcx - 0x7a63]
movzx r10d, cx
xor al, r11b
dec al
neg al
sar rcx, cl
adc al, 0x3d
ror al, 1
mov edx, 0xe499da00
or edx, r10d
sbb al, 0x92
add rsi, rdx
inc dl
sbb r10, r10
xor r11b, al
dec si
inc r10
jne 0x1800bfb91
mov eax, 0xeb09a91c
push rax
pop rax
mov edx, dword [rdi]
add rdi, 4
shr rax, 0x9e
xor edx, r11d
dec edx
lea r10, [rax + rax + 0x3d21f238]
and al, r10b
mov esi, eax
ror edx, 1
sar rsi, 0x5d
neg edx
jmp 0x1800d0bca
movzx eax, r8b
rol ecx, 1
mov ebp, 0xc0ad7a9e
rol bpl, 0x41
xadd al, dl
not ecx
sub ecx, 0xf1a99880
bswap rax
rol ecx, 1
push r8
ror ax, 0x4e
call fcn.1800a0871
xadd si, r10w
adc rbx, rdx
movzx edx, bpl
dec dx
movzx esi, byte [rsi + rdi - 0xc213]
jns 0x1800c426c
mov qword [rsp + rbp - 0x5fa4ecb0], r11
lea rax, [rdx + 0x329b9722]
bswap rsi
or rdx, 0x4d9fcdbe
xor dword [rsp + rbp - 0x5fa4ecb0], r8d
sar rdx, cl
or eax, 0x7b3f0c34
pop r11
movsxd r8, r8d
call fcn.1800c3f79
mov qword [r9 + rbp*2 - 0x694c], r10
jmp 0x1800c350f
ror edx, 2
mov qword [rsp + rsi - 0x49965f72], r11
xor dword [rsp + rcx*2 - 0x66], edx
dec rax
mov qword [rsp + rsi - 0x49965f82], 0xffffffffb6a5e33a
call fcn.18009dbce
sal sil, 7
jns 0x1800c2fb0
or eax, ebp
lea r11, [r11*8 + 0x5219ce87]
pop r11
adc bp, 0xe908
xchg edx, ebp
lea r8, [rcx*4 + 0x58832890]
movsxd rsi, esi
adc rbx, rsi
mov bp, word [r9 + rax*4 - 0xbf279d0]
jmp 0x1800cacab
add rax, rsp
mov dword [rax + rcx], ebp
inc rdx
lea rax, [rdx*2 + 0x92c030]
lea rbp, [r10 + rdx*2 + 0x38b0d28]
mov eax, dword [rdi + rcx*4]
sub rdx, r10
lea rdi, [rdi + rcx*2 + 4]
jge 0x1800a1057
mov r8d, 0xff190d8e
mov ecx, dword [rdi]
mov edx, r8d
and r8w, 0xbd98
adc rdi, 4
jmp 0x1800c9297
rol r8d, 1
lea rbp, [rsi + rdx*4 + 0x5782e3b1]
rol esi, 0xa3
sub r8d, 0xb00c9200
not esi
push r11
xor ebp, edx
xor dword [rsp], r8d
lea rcx, [rdx*8 + 0x36abcc98]
shr bp, 0xc1
pop r11
or cx, cx
add bp, dx
movsxd r8, r8d
add rbx, r8
not ebp
sar dx, 0x67
movsx r8d, sil
mov rbp, qword [r9 + rbp - 0x3812f1cf]
or r8d, 0xbca8ef9e
sub dx, 0x4399
sbb r9, 0xfffffffffffffff0
sar sil, 0xe5
sal cl, 0xa5
movzx r8d, byte [rdi + 6]
sar esi, 0x5c
movzx eax, sil
movzx r10d, si
lea rdi, [rdi + rax - 0xf8]
add sil, cl
call fcn.18009d98e
mov ecx, dword [rdi]
mov esi, 0x49034e0a
jmp 0x1800cf909
pop r10
mov edx, dword [rbp + rdi - 0x349a]
add r10d, 0x4d16d198
xor edx, r11d
shl r10d, 0xc1
neg edx
dec r10d
lea edx, [rdx + rbp*4 - 0x78109bbf]
add r10b, bpl
mov eax, 0xfb97082f
jnp 0x1800d4e4b
add al, 0x44
movzx eax, bp
adc ebp, eax
sub dl, bl
test al, 0xf6
fimul dword [rbx - 0x73]
mov word [rax], es
add dl, byte [rcx - 0x3ff03b7a]
lodsb al, byte [rsi]
or al, 0x7b
invalid
add ah, bl
invalid
test byte [rsi + rax], dl
out dx, al
invalid
sub al, 0x40
not ax
mov qword [rsp + rax - 0xaf2b], r8
mov byte [rbp + rax*2 - 0x15ea6], sil
movabs eax, dword [0xc6f8be9815dfffe]
dec byte [rax - 0x77]
pushfq
add al, 0xad
push rax
invalid
inc edx
xor byte [rax], al
movabs eax, dword [0xc6f8be9815dfffe]
dec byte [rax - 0x77]
pushfq
add al, 0xad
push rax
invalid
movabs al, byte [0xa05b13543dbc8d48]
lea r10, [rbp*8 - 0x31fa7ed3]
lea rsi, [r10*2 + 0x290884a6]
xor r8d, r11d
add dword [0x1b4999108], 0x884a655
sub dword [rbp + 0x33], eax
ret
inc esi
bswap r8d
setno cl
inc word [rsp + rbp - 0x5fa4ecb0]
sal byte [rsp + rbp - 0x5fa4ecac], 0x45
lea r8d, [rbp + r8 - 0x40fe62fd]
adc ebx, dword [rbx - 0x60]
lea r8d, [rbp + r8 - 0x40fe62fd]
bswap r8d
movsx edx, byte [rsp + rbp - 0x5fa4ecb0]
sub al, 0x50
adc ebx, dword [rbx - 0x60]
sub al, 0x50
adc ebx, dword [rbx - 0x60]
bswap rdx
neg r8d
sal r10w, cl
bswap r8d
neg byte [rsp + rbp - 0x5fa4ecb0]
setno sil
jne 0x1800b1aba
invalid
invalid
invalid
invalid
xor r8d, 0xa080a43d
neg r10
xadd dx, ax
adc dl, r10b
lea r8d, [r10 + r8 + 0x2ae439c8]
dec sil
mov ebp, ecx
push r11
xor dword [rsp + rsi - 0xe3a6300], r8d
mov r11d, r10d
xchg rbp, rcx
pop r11
movsxd r8, r8d
neg ax
call fcn.1800bcb4a
add bpl, byte [rsp + rbp*2 - 0x950b]
xor dword [rsp + rcx - 0x28005ef4], r10d
dec si
pop rbp
mov r11, qword [rsp + rbp*2 - 0x5000be00]
movsxd r10, r10d
js 0x1800bf011
xor ecx, r11d
jmp 0x1800a8eee
call fcn.1800a6093
lea rdi, [rdi + rsi - 0x49034e06]
call fcn.1800b3a12
push r8
lea rbp, [rsp + rbp + 0x18]
mov qword [r10 + rbp], rcx
movsx esi, r8b
jae 0x1800bc213
pop r10
mov esi, dword [rdi + r10*2 - 0x1a6]
lea rdi, [r10 + rdi - 0xcf]
bswap r8
xchg qword [rsp + r10*4 - 0x347], r10
movzx ecx, al
xor esi, r11d
rol esi, 1
pop rax
pop rax
call fcn.1800ab9e2
and bpl, 0x3a
neg rax
dec rsi
lea r8, [rsi + r10*8 + 0x3e9e3011]
dec rax
lea rdx, [r8*2 - 0x38c3e166]
sub ebp, edx
xor r11, rax
push rcx
shr dword [rsp + rcx - 0x23fce438], cl
mov rsi, rax
jp 0x1800b9a83
mov r8d, dword [rdi + rsi*4 - 0x38e98c30]
lea rdi, [rdi + rsi*2 - 0x1c74c614]
movsx edx, si
setge sil
lea rcx, [rsi + rax*8 - 0x5d4a16f0]
xor r8d, r11d
ror rdx, cl
movsx r10d, cl
ror r8d, 1
neg r8d
xor r8d, 0x2404ce2a
add r10b, 0x1b
rol ecx, cl
lea r8d, [r8 + rax*2 - 0x29a31f48]
ror rcx, cl
js 0x1800c56e2
not edx
lea rcx, [rbp + rsi*4 + 0x4d196597]
xadd r10d, r8d
lea rbp, [rsi*2 + 0x213fc21f]
dec edx
push r8
mov qword [rsp + rbp*2 - 0x427f843e], r11
sub rax, 0x6c1c9eac
xor dword [rsp + rbp*2 - 0x427f843e], edx
xchg rbp, r10
and rbp, 0x3c26d0ae
pop r11
ror al, 0x63
xadd rax, rcx
add ebp, eax
movsxd rdx, edx
ja 0x1800ac442
xadd r8d, r10d
xor r11b, bpl
rol eax, 0x2a
jb 0x1800d36b5
mov esi, 0xe6833d32
mov ebp, dword [r9]
movzx eax, si
jmp 0x1800a04a7