Function at 0x140014d20
Capabilities:
Log keystrokes

Disassembly:
movzx r8d, cx
mov eax, r8d
cmp r8d, 0x11c
ja 0x140014d96
cmp eax, 0x11c
je 0x140014d93
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140014dbb.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x14e28]
mov ecx, dword [rdx + rax*4 + 0x14de0]
add rcx, rdx
jmp rcx
mov al, 0xa0
ret
mov al, 0xa2
ret
mov al, 0xa4
ret
mov al, 0x6a
ret
mov al, 0x6d
ret
mov al, 0x6b
ret
mov al, 0x2e
ret
mov al, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
ret
mov al, 0x2d
ret
mov al, 0x26
ret
mov al, 0x28
ret
mov al, 0x25
ret
mov al, 0x27
ret
mov al, 0x24
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
ret
mov al, 0x21
ret
mov al, SafeArrayAllocDescriptor
ret
mov al, 0xd
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140014dbb.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x14e7c]
mov ecx, dword [rdx + rax*4 + 0x14e60]
add rcx, rdx
jmp rcx
mov al, 0xa1
ret
mov al, 0xa3
ret
mov al, 0xa5
ret
mov al, 0x90
ret
mov al, 0x6f
ret
mov al, 0x5d
ret
movzx ecx, r8b
mov edx, 1
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor eax, eax
jmp 0x1401bc3f6
add bh, al
and al, 0x20
add al, byte [rax]
add byte [rax], al
call qword [reloc.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1401bbd5c
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x1401bbd5c
cmp byte [rbx + 0x23], 0
jne 0x1401bbd17
mov rax, qword [rbx + 0x10]
jmp 0x1401bbd1a
mov rax, rbx
cmp byte [rax + 0x23], 2
jne 0x1401bbd47
cmp qword [0x14026081c], 0
je 0x1401bbd47
lea rcx, [0x140260804]
call 0x1401617b4
mov rdx, qword [rbp + 8]
mov rcx, rbx
call 0x140172344
jmp 0x1401bc3c3
and byte [rax + 0x21], 0x86
mov rcx, rbx
mov rdx, qword [rbp + 8]
call 0x140172344
jmp 0x1401bc3c3
cmp byte [rbx + 0x23], 0
jne 0x1401bbd68
mov rax, qword [rbx + 0x10]
jmp 0x1401bbd6b
mov rax, rbx
cmp byte [rax + 0x23], 2
jne 0x1401bbdd5
cmp qword [0x14026081c], 0
je 0x1401bbdd5
lea rcx, [0x140260804]
call 0x1401617b4
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rbx
call 0x1401e70f4
mov rax, qword [0x1402572dc]
lea rdx, [0x14023aeb4]
cmp byte [rax + 0x150], 0
jne 0x1401bc3e4
mov rcx, qword [0x14025b714]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call 0x1401e70f4
jmp 0x1401bc3f6
and byte [rax + 0x21], 0x86
jmp 0x1401bbd87
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rbx
call 0x1401e70f4
jmp 0x1401bc3f6
mov qword [rbp + 8], r8
mov edi, esi
test rax, rax
je 0x1401bbf2b
lea rax, [rbp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov r8, rdi
mov dword [rsp + 0x28], 0x1388
mov edx, r15d
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [reloc.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1401bbddb
mov rax, qword [rbp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x1401bbddb
mov r8, qword [rbp + 8]
inc rdi
add r8, rax
mov qword [rbp + 8], r8
cmp rdi, qword [rbp + 0x28]
jb 0x1401bbed5
mov r9b, 1
mov byte [rsp + 0x20], 1
xor edx, edx
mov rcx, rbx
call 0x1401e70f4
cmp eax, 1
jne 0x1401bbcbd
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call 0x14015dcd4
mov rdx, qword [rbp + 0x28]
mov rdi, rax
lea rcx, [rdx - 1]
mov qword [rbp + 8], rcx
test rdx, rdx
je 0x1401bbfd7
mov r15d, 0xa
nop dword [rax]
lea rax, [rbp + 0x30]
mov r9, rdi
mov qword [rsp + 0x30], rax
mov r8, rsi
mov dword [rsp + 0x28], 0x1388
mov edx, r12d
mov rcx, r14
mov dword [rsp + 0x20], 2
call qword [reloc.USER32.dll_SendMessageTimeoutW]
test rax, rax
je 0x1401bbfb6
mov rax, qword [rbp + 0x30]
cmp rax, 0xffffffffffffffff
je 0x1401bbfb6
add qword [rbp + 8], rax
lea rdi, [rdi + rax*2]
mov rcx, qword [rbp + 0x28]
lea rax, [rcx - 1]
cmp rsi, rax
jae 0x1401bbfcf
mov word [rdi], r15w
add rdi, 2
mov rcx, qword [rbp + 0x28]
inc rsi
cmp rsi, rcx
jb 0x1401bbf74
cmp byte [rbx + 0x23], 0
jne 0x1401bbd17
mov rax, qword [rbx + 0x10]
jmp 0x1401bbd1a
mov rcx, qword [0x14025b714]
lea rdx, [0x140227898]
xor r9d, r9d
mov byte [rsp + 0x20], 1
or r8, 0xffffffffffffffff
call 0x1401e70f4
jmp 0x1401bc3f6
lea r9, [0x14024393c]
xor r8d, r8d
mov rcx, r13
call 0x140191c94
mov rbx, qword [rbp + 0xb0]
mov rsi, qword [rbp + 0xb8]
mov rdi, qword [rbp + 0xc0]
lea rsp, [rbp + 0x80]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret