Function at 0x180032b90
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov r10, qword [rsp + 0x130]
lea eax, [r9 - 9]
mov dword [rsp + 0x88], eax
mov ebp, r9d
mov rsi, rdx
cmp r9d, eax
jbe case.0x180032c9c.72
mov eax, dword [rsp + 0x118]
xor ebx, ebx
mov r11d, dword [rsp + 0x118]
mov edx, dword [rsp + 0x118]
mov r12, qword [rsp + 0x80]
mov r9d, dword [rsp + 0x118]
mov rcx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x128]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x118], r9d
mov r8d, dword [rsp + 0x118]
mov edi, dword [rsp + 0x118]
mov r15d, dword [rsp + 0x118]
mov r14d, dword [rsp + 0x118]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x6c], eax
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x4c], r11d
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x40], edx
nop dword [rax]
lea eax, [rbp - 0x37]
cmp eax, 0x1c
ja case.0x180032c9c.57
lea rcx, [0x180000000]
movzx eax, byte [rcx + rax + 0x33494]
mov ecx, dword [rcx + rax*4 + 0x3346c]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov eax, dword [rsi]
lea rsi, [0x180000000]
mov rsi, qword [rsi + rax*8 + 0x9b880]
cmp dword [rsi], ebx
je 0x180032df1
nop word [rax + rax]
mov edi, 0xfb
cmp edi, 0xfb
je 0x180032d09
cmp edi, 0x234c
je 0x180032cf7
cmp edi, 0x459d
jne 0x180032db4
mov eax, dword [rsp + 0x68]
or dword [r12 + 8], r11d
or eax, 0x20
or dword [r12 + 0xc], eax
jmp 0x180032db4
test r12, r12
jne 0x180032db4
mov eax, dword [rsp + 0x48]
jmp 0x18003344f
mov eax, dword [rsi]
lea rdx, [rsp + 0x78]
and eax, 7
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x4c], eax
mov r8d, 0x20
mov eax, dword [rsi + 4]
xor ecx, ecx
mov qword [rsp + 0x78], rax
mov r12, rbx
mov qword [rsp + 0x70], rbx
call fcn.180028420
cmp rax, 1
jne 0x180032d76
mov rcx, qword [r13 + 0x78]
test rcx, rcx
je 0x180032d67
cmp dword [rcx], 1
jne 0x180032d54
mov eax, dword [rsi + 4]
cmp dword [rcx + 0x20], eax
je 0x180032d5f
mov rcx, qword [rcx + 0x60]
test rcx, rcx
jne 0x180032d47
jmp 0x180032d67
mov r12, rcx
mov qword [rsp + 0x70], rcx
mov edi, 0xfb
mov ebp, 0x49
test r12, r12
jne 0x180032daf
xor edx, edx
mov r8d, 0x11a
mov rcx, r13
call fcn.18004cb10
mov ecx, dword [rsi + 4]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], ecx
mov r8d, 0xf3
mov rcx, rax
mov qword [rsp + 0x70], rax
mov r12, rax
call fcn.180025730
dec qword [r13 + 0x88]
mov r11d, dword [rsp + 0x4c]
add edi, 0x2251
cmp edi, 0x66f3
jbe 0x180032cc5
mov ecx, dword [rsp + 0x48]
add rsi, 8
inc ecx
mov dword [rsp + 0x48], ecx
cmp dword [rsi], ebx
jne 0x180032cc0
mov edx, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x118]
mov dword [rsp + 0x58], ecx
jmp 0x180033126
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x58], ecx
jmp 0x180033126
mov eax, dword [rsi]
dec eax
mov dword [rsp + 0x48], ebx
cmp eax, 0x36
jbe case.0x180032c9c.57
mov dword [rsp + 0x58], ebx
jmp case.0x180032c9c.72
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x80], rax
test rax, rax
je 0x18003342a
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r8d, r8d
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov edx, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x118]
jmp case.0x180032c9c.57
mov rcx, qword [rsp + 0x120]
mov r8d, 2
test byte [0x18009b87c], r8b
mov edx, ebx
mov dword [rsp + 0x40], ebx
mov r15d, ebx
mov r9d, ebx
mov dword [rsp + 0x118], ebx
mov eax, dword [rcx + 0xc]
lea r10d, [r8 + 2]
mov dword [rsp + 0x90], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x94], eax
mov eax, dword [rcx + 0x14]
movsd xmm0, qword [rsp + 0x90]
mov dword [rsp + 0xa8], eax
mov rax, qword [rsp + 0x100]
movsd qword [rsp + 0xa0], xmm0
mov ecx, dword [rax]
je 0x180032eeb
test cl, 0x10
mov eax, r8d
cmovne eax, r10d
test cl, 0x20
mov dword [rsp + 0x44], eax
mov eax, r8d
cmovne eax, r10d
shr ecx, 5
not ecx
mov dword [rsp + 0x50], eax
and ecx, 1
mov dword [rsp + 0x6c], ecx
jmp case.0x180032c9c.57
test cl, 0x10
mov eax, r10d
cmovne eax, r8d
test cl, 0x20
mov dword [rsp + 0x44], eax
mov eax, r10d
cmovne eax, r8d
shr ecx, 5
and ecx, 1
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x6c], ecx
jmp case.0x180032c9c.57
mov rsi, qword [rsp + 0x110]
lea r12, [rsp + 0xa0]
add rsi, 0x4c
mov qword [rsp + 0x78], 3
mov r13, rsi
nop word [rax + rax]
mov ecx, 0xc2
nop word [rax + rax]
mov eax, ecx
sub eax, 0xbf
je 0x1800330f3
sub eax, 1
je 0x18003315d
sub eax, 1
je 0x180032f83
cmp eax, 1
jne 0x1800330f8
mov eax, dword [r12]
and eax, 7
mov dword [rsi + 8], eax
jmp 0x1800330f8
mov r14d, dword [r12]
mov eax, r14d
and eax, 0xff000000
mov dword [rsi + 0xc], ebx
cmp eax, 0xc000000
ja 0x18003305b
je 0x1800330cd
cmp eax, 0x6000000
ja 0x180033015
je 0x180032ffe
cmp eax, 0x1000000
je 0x1800330a3
cmp eax, 0x2000000
je 0x180032ff3
cmp eax, 0x3000000
je 0x180032fe0
cmp eax, 0x4000000
je 0x1800330cd
cmp eax, 0x5000000
je 0x1800330e1
jmp 0x1800330e7
cmp r8d, 4
mov r15d, ebx
sete r15b
inc r15d
jmp 0x1800330e7
mov r15d, 1
jmp 0x1800330e7
mov r15d, 4
mov eax, 6
cmp r8d, r15d
cmove r15d, eax
jmp 0x1800330e7
cmp eax, 0x7000000
je 0x180033050
cmp eax, 0x8000000
je 0x1800330e1
cmp eax, 0x9000000
je 0x180033050
cmp eax, 0xa000000
je 0x180033045
cmp eax, 0xb000000
je 0x1800330e1
jmp 0x1800330e7
mov r15d, 6
jmp 0x1800330e7
mov r15d, 8
jmp 0x1800330e7
cmp eax, 0x30000000
ja 0x1800330b8
je 0x1800330cd
cmp eax, 0xd000000
je 0x1800330a3
cmp eax, 0xe000000
je 0x18003309b
cmp eax, 0xf000000
je 0x180033087
add eax, 0xf0000000
test eax, 0xefffffff
je 0x1800330cd
jmp 0x1800330e7
cmp edi, 4
mov r15d, 2
mov eax, 4
cmove r15d, eax
jmp 0x1800330e7
mov r15d, 2
jmp 0x1800330e7
cmp r8d, 4
mov r15d, 2
mov eax, 4
cmove r15d, eax
jmp 0x1800330e7
lea ecx, [rax - 0x40000000]
test ecx, 0xcfffffff
jne 0x1800330d5
cmp eax, 0x60000000
je 0x1800330d5
mov r15d, 4
jmp 0x1800330e7
add eax, 0x70000000
test eax, 0xefffffff
jne 0x1800330e7
mov r15d, 0x10
mov ecx, 0xc1
and r14d, 0xff0000
mov ebp, 0x40
dec ecx
cmp ecx, 0xbe
ja 0x180032f50
add r13, 0x10
add r12, 4
add rsi, 0x10
sub qword [rsp + 0x78], 1
jne 0x180032f40
mov r13, qword [rsp + 0x128]
mov rsi, qword [rsp + 0x108]
dec ebp
cmp ebp, dword [rsp + 0x88]
jbe case.0x180032c9c.72
mov r12, qword [rsp + 0x70]
mov r10, qword [rsp + 0x130]
mov r8d, dword [rsp + 0x44]
mov r11d, dword [rsp + 0x4c]
mov edi, dword [rsp + 0x50]
jmp 0x180032c70
cmp r14d, 0xb0000
jg 0x1800332e2
je 0x180033391
cmp r14d, 0x60000
jg 0x1800331c8
je 0x180033391
cmp r14d, 0x10000
je 0x1800331f0
lea eax, [r14 - 0x20000]
test eax, 0xfffeffff
je 0x180033391
cmp r14d, 0x40000
je 0x180033306
cmp r14d, 0x50000
jne 0x1800333db
mov edi, dword [rsp + 0x50]
mov ecx, 0xc0
mov dword [rsi], 1
jmp 0x1800330f8
lea eax, [r14 - 0x70000]
test eax, 0xfffeffff
je 0x180033251
cmp r14d, 0x90000
je 0x180033306
cmp r14d, 0xa0000
jne 0x1800333db
mov edi, 0x3a
mov eax, edi
sub eax, 0x39
je 0x180033367
cmp eax, 1
jne 0x18003324a
lea eax, [r9 + rdx]
movsxd r8, r15d
movsxd rcx, eax
mov edx, 0xf4
add rcx, r10
call fcn.180050c20
mov edx, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x118]
add edx, r15d
mov r10, qword [rsp + 0x130]
mov dword [rsp + 0x40], edx
mov dword [rsi], 7
cmp r14d, 0xa0000
jne 0x18003324a
or dword [rsi + 0xc], 9
dec edi
cmp edi, 0x38
ja 0x1800331f5
lea eax, [r9 + rdx]
movsxd r8, r15d
movsxd rdx, eax
mov eax, dword [r12]
and eax, 0xff000000
lea rcx, [r10 + rdx]
cmp eax, 0xd000000
jne 0x18003327b
mov edx, 0xf4
call fcn.180050c20
jmp 0x180033288
add rdx, qword [rsp + 0x128]
call fcn.180050810
mov edx, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x118]
add edx, r15d
mov r10, qword [rsp + 0x130]
mov r8d, dword [rsp + 0x44]
mov dword [rsp + 0x40], edx
cmp r14d, 0x80000
jne 0x1800332d1
mov edi, dword [rsp + 0x50]
cmp r15d, 1
mov eax, ebx
mov ecx, 0xc0
setne al
add eax, 3
mov dword [rsi], eax
or dword [rsi + 0xc], 1
jmp 0x1800330f8
or dword [rsi], 2
mov ecx, 0xc0
mov edi, dword [rsp + 0x50]
jmp 0x1800330f8
cmp r14d, 0x110000
jg 0x1800333b3
lea eax, [r14 - 0xc0000]
test eax, 0xfffaffff
jne 0x18003337a
cmp r14d, 0x100000
je 0x18003337a
mov eax, dword [rsp + 0x6c]
xor r9d, r9d
mov dword [rsp + 0x60], eax
xor edx, edx
lea rax, [rsp + 0x60]
mov dword [rsp + 0x118], 1
mov qword [rsp + 0x38], rax
mov r8d, 0xe7
mov rax, qword [rsp + 0x128]
mov rcx, r13
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rbx
call fcn.18001bf00
mov edx, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x118]
add edx, eax
mov r10, qword [rsp + 0x130]
mov dword [rsp + 0x40], edx
mov r8d, dword [rsp + 0x44]
mov edi, dword [rsp + 0x50]
mov ecx, 0xc0
jmp 0x1800330f8
lea eax, [r14 - 0xe0000]
test eax, 0xfffcffff
jne 0x1800333db
cmp r14d, 0x110000
je 0x1800333db
mov edi, dword [rsp + 0x50]
mov r9d, 1
mov dword [rsp + 0x118], r9d
mov ecx, 0xc0
mov dword [rsi], 1
jmp 0x1800330f8
cmp r14d, 0x120000
je 0x180033415
cmp r14d, 0x130000
je 0x180033400
cmp r14d, 0x140000
je 0x1800331b4
cmp r14d, 0x180000
je 0x1800333eb
mov edi, dword [rsp + 0x50]
mov ecx, 0xc0
mov dword [rsi], ebx
jmp 0x1800330f8
mov edi, dword [rsp + 0x50]
mov eax, 2
mov dword [rsi], eax
mov ecx, 0xc0
jmp 0x1800330f8
or dword [rsi + 0xc], 0x10b
mov ecx, 0xc0
mov edi, dword [rsp + 0x50]
jmp 0x1800330f8
or dword [rsi + 0xc], 0x40b
mov ecx, 0xc0
mov edi, dword [rsp + 0x50]
jmp 0x1800330f8
mov rax, rbx
jmp 0x180033458
mov eax, dword [r13 + 0xa0]
jmp 0x18003344f
mov rcx, qword [rsp + 0x80]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
jmp 0x180033458
lea eax, [r9 + rdx]
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x58]
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret