Function at 0x1400236a0
Capabilities:
Log keystrokes

Disassembly:
cmp word [rbx], 0x2c
jne 0x14001ffa3
nop word [rax + rax]
movzx eax, word [rbx + 2]
add rbx, 2
cmp ax, 0x20
je 0x14001ff80
cmp ax, 9
je 0x14001ff80
test ax, ax
je 0x140020315
cmp ax, 0x2c
je 0x14001ff80
movzx edx, word [rbx]
mov r14, rbx
test dx, dx
je 0x14001ffe0
nop
lea rcx, [0x1400f6390]
mov eax, SafeArrayAllocDescriptor
nop dword [rax]
cmp dx, ax
je 0x14001fff4
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14001ffc0
movzx edx, word [r14 + 2]
add r14, 2
test dx, dx
jne 0x14001ffb0
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r14, [rbx + rcx*2 - 2]
movzx r15d, word [r14]
mov rdi, rbx
mov word [r14], r8w
nop
movzx eax, word [rdi]
cmp ax, 0x20
je 0x14002000f
cmp ax, 9
jne 0x140020015
add rdi, 2
jmp case.0x140024ee3.4
movzx eax, word [rdi]
test ax, ax
je 0x140020185
cmp ax, 0x2d
je 0x14002002d
cmp ax, 0x2b
jne 0x140020031
add rdi, 2
cmp word [rdi], 0x30
jne 0x140020065
movzx eax, word [rdi + 2]
cmp ax, 0x78
je 0x140020047
cmp ax, 0x58
jne 0x140020065
movzx ecx, word [rdi + 4]
call fcn.1400d6b84
test eax, eax
je 0x140020062
add rdi, 4
mov eax, 1
xor r8d, r8d
jmp 0x140020068
xor r8d, r8d
mov eax, r8d
movzx esi, word [rdi]
mov ebp, r8d
mov r13d, r8d
movsxd r12, eax
cmp esi, 0x20
je 0x140020150
nop dword [rax]
cmp esi, 9
je 0x14002014a
test esi, esi
je 0x1400201d0
cmp esi, 0x2e
jne 0x1400200b2
test ebp, ebp
jne 0x14002016b
test r12, r12
jne 0x14002016b
lea ebp, [rsi - 0x2d]
xor r8d, r8d
jmp 0x140020137
test r12, r12
je 0x1400200d0
movzx ecx, si
call fcn.1400d94d4
xor r8d, r8d
test eax, eax
mov ecx, r8d
sete cl
test ecx, ecx
je 0x140020131
jmp 0x1400200d8
lea eax, [rsi - 0x30]
cmp eax, 9
jbe 0x14002012e
movzx esi, si
test esi, 0xffffff80
jne 0x1400200f6
mov edx, 2
mov ecx, esi
call fcn.1400d79f4
test eax, eax
je 0x1400200f6
and esi, 0xffffffdf
cmp si, 0x45
jne 0x14002016b
test ebp, ebp
je 0x14002016b
test r13d, r13d
je 0x14002016b
movzx eax, word [rdi + 2]
cmp ax, 0x2d
je 0x140020115
cmp ax, 0x2b
jne 0x140020119
add rdi, 2
movzx eax, word [rdi + 2]
cmp ax, 0x30
jb 0x14002016b
cmp ax, 0x39
ja 0x14002016b
xor r8d, r8d
jmp 0x140020137
xor r8d, r8d
mov r13d, 1
movzx esi, word [rdi + 2]
add rdi, 2
cmp esi, 0x20
jne 0x140020080
jmp 0x140020150
xor r8d, r8d
nop dword [rax]
movzx eax, word [rdi]
cmp ax, 0x20
je 0x14002015f
cmp ax, 9
jne 0x140020165
add rdi, 2
jmp 0x140020150
cmp word [rdi], 0
je 0x1400201d3
mov r13, qword [rsp + 0x78]
mov r12, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x70]
mov r8b, 1
mov rcx, rbx
movzx edx, r8b
call fcn.14001ce90
test al, al
je 0x140020293
mov byte [r13], al
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
xor r8d, r8d
mov word [r14], r15w
mov rbx, r14
movzx eax, word [rbx]
cmp ax, 0x20
je 0x1400201ca
cmp ax, 9
jne 0x1400202f6
add rbx, 2
jmp 0x1400201b7
xor r8d, r8d
test r13d, r13d
je 0x14002016b
test ebp, ebp
mov eax, r8d
setne al
inc eax
je 0x14002016b
mov rdi, qword [rsp + 0x68]
mov rcx, rbx
cmp dword [rdi], 0x80000000
jne 0x140020222
call fcn.1400057c0
mov rcx, rbx
test al, al
je 0x140020214
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400d91d0
mov rsi, qword [rsp + 0x70]
mov dword [rdi], eax
jmp 0x1400201a5
call fcn.1400d6ef0
mov rsi, qword [rsp + 0x70]
mov dword [rdi], eax
jmp 0x1400201a5
mov rsi, qword [rsp + 0x70]
cmp dword [rsi], 0x80000000
jne 0x140020259
call fcn.1400057c0
mov rcx, rbx
test al, al
je 0x14002024d
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400d91d0
mov dword [rsi], eax
jmp 0x1400201a5
call fcn.1400d6ef0
mov dword [rsi], eax
jmp 0x1400201a5
call fcn.1400057c0
mov rcx, rbx
test al, al
je 0x14002027f
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1400d91d0
mov rcx, qword [rsp + 0x88]
mov dword [rcx], eax
jmp 0x1400201ad
call fcn.1400d6ef0
mov rcx, qword [rsp + 0x88]
mov dword [rcx], eax
jmp 0x1400201ad
movzx edi, word [rbx]
test edi, 0xffffff80
jne 0x1400202b1
mov edx, 2
mov ecx, edi
call fcn.1400d79f4
test eax, eax
je 0x1400202b1
and edi, 0xffffffdf
movzx eax, di
cmp eax, 0x44
je 0x1400202dd
cmp eax, 0x52
je 0x1400202d3
cmp eax, 0x55
jne 0x1400201a0
mov dword [rbp], 1
jmp 0x1400201a0
mov byte [r12], 1
jmp 0x1400201a0
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x88]
xor r8d, r8d
mov dword [rbp], r8d
jmp 0x1400201b0
cmp word [rbx], 0
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x90]
mov r13, qword [rsp + 0x78]
jne 0x14001ff70
mov eax, dword [rdi]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x60]
cmp eax, 0x80000000
je 0x140020338
cmp dword [rsi], 0x80000000
jne 0x140020338
mov dword [rcx], eax
mov dword [rdi], 0x80000000
add rsp, 0x28
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx edi, cl
movzx ebx, dl
lea rsi, [0x140000000]
lea eax, [rdi - 0x13]
cmp eax, 0x92
ja case.0x1400236de.45
cdqe
movzx eax, byte [rsi + rax + 0x238b0]
mov ecx, dword [rsi + rax*4 + 0x23844]
add rcx, rsi
jmp rcx
mov eax, 0x2a
jmp 0x1400237a9
mov eax, 0x136
jmp 0x1400237a9
mov eax, 0x1d
jmp 0x1400237a9
mov eax, 0x11d
jmp 0x1400237a9
mov eax, reloc.WSOCK32.dll_getservbyport
jmp 0x1400237a9
mov eax, 0x138
jmp 0x1400237a9
mov eax, 0x15b
jmp 0x1400237a9
mov eax, 0x15c
jmp 0x1400237a9
mov eax, 0x45
jmp 0x1400237a9
mov eax, 0x52
jmp 0x1400237a9
mov eax, 0x4f
jmp 0x1400237a9
mov eax, 0x50
jmp 0x1400237a9
mov eax, 0x51
jmp 0x1400237a9
mov eax, 0x4b
jmp 0x1400237a9
mov eax, 0x4c
jmp 0x1400237a9
mov eax, 0x4d
jmp 0x1400237a9
mov eax, 0x47
jmp 0x1400237a9
mov eax, 0x48
jmp 0x1400237a9
mov eax, 0x49
jmp 0x1400237a9
mov eax, 0x53
jmp 0x1400237a9
mov eax, 0x145
jmp 0x1400237a9
mov eax, 0x135
jmp 0x1400237a9
mov eax, reloc.WSOCK32.dll_getservbyname
jmp 0x1400237a9
mov eax, 0x4a
jmp 0x1400237a9
mov eax, 0x4e
jmp 0x1400237a9
mov eax, 0x137
test bl, bl
jne 0x1400237ff
movzx eax, ax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r11d, eax
test ax, ax
je 0x1400237ff
lea eax, [rdi - 3]
cmp eax, 0xb4
ja case.0x1400237f0.5
cdqe
movzx eax, byte [rsi + rax + 0x23950]
mov ecx, dword [rsi + rax*4 + 0x23944]
add rcx, rsi
jmp rcx
mov ecx, 0x100
or r11w, cx
test bl, bl
je 0x140023830
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, r11w
test bl, bl
je 0x140023834
mov ecx, 0x100
or eax, ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, r11w
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov ebp, 0x5656224e
fcompi st(3)
invalid
fistp dword [rsi + 0x2a]
invalid
xchg edx, eax
iretd
invalid
cmp eax, 0xd6f0a382
rcr ecx, 1
movabs dword [0xb4b85f79dcf9caa1], eax
sub eax, 0x8a1768e2
and eax, 0x5b612373
pop rcx
or byte [rcx], 0x6a
push rcx
int 0x5b
push rbx
mov bl, 0x53
movabs eax, dword [0x2c284e809afce5fc]
xchg byte [0x1bf836dca], cl
int1
mov dl, ch
invalid
lodsb al, byte [rsi]
jmp 0xe335e619
invalid
wait
cmp dword [rsp + riz*2], esp
out 0x22, eax
xchg esp, eax
invalid