Function at 0x140025450
Capabilities:
Log keystrokes

Disassembly:
push rbx
sub rsp, 0x20
movzx ebx, cx
mov eax, ebx
cmp ebx, 0x11c
ja 0x14002552e
je 0x140025526
sub eax, 0x1d
cmp eax, 0x36
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25624]
mov ecx, dword [rdx + rax*4 + 0x255d8]
add rcx, rdx
jmp rcx
mov al, 0xa0
add rsp, 0x20
pop rbx
ret
mov al, 0xa2
add rsp, 0x20
pop rbx
ret
mov al, 0xa4
add rsp, 0x20
pop rbx
ret
mov al, 0x6a
add rsp, 0x20
pop rbx
ret
mov al, 0x6d
add rsp, 0x20
pop rbx
ret
mov al, 0x6b
add rsp, 0x20
pop rbx
ret
mov al, 0x2e
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_ioctlsocket
add rsp, 0x20
pop rbx
ret
mov al, 0x2d
add rsp, 0x20
pop rbx
ret
mov al, 0x26
add rsp, 0x20
pop rbx
ret
mov al, 0x28
add rsp, 0x20
pop rbx
ret
mov al, 0x25
add rsp, 0x20
pop rbx
ret
mov al, 0x27
add rsp, 0x20
pop rbx
ret
mov al, 0x24
add rsp, 0x20
pop rbx
ret
mov al, reloc.OLEAUT32.dll_SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, 0x21
add rsp, 0x20
pop rbx
ret
mov al, SafeArrayAllocDescriptor
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_send
add rsp, 0x20
pop rbx
ret
mov al, 0xd
add rsp, 0x20
pop rbx
ret
sub eax, 0x11d
cmp eax, 0x40
ja case.0x140025553.286
lea rdx, [0x140000000]
cdqe
movzx eax, byte [rdx + rax + 0x25684]
mov ecx, dword [rdx + rax*4 + 0x2565c]
add rcx, rdx
jmp rcx
mov al, 0xa1
add rsp, 0x20
pop rbx
ret
mov al, 0xa3
add rsp, 0x20
pop rbx
ret
mov al, 0xa5
add rsp, 0x20
pop rbx
ret
mov al, 0x5b
add rsp, 0x20
pop rbx
ret
mov al, 0x5c
add rsp, 0x20
pop rbx
ret
mov al, 0x90
add rsp, 0x20
pop rbx
ret
mov al, reloc.WSOCK32.dll_WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov al, 0x5d
add rsp, 0x20
pop rbx
ret
mov al, 0x2c
add rsp, 0x20
pop rbx
ret
bt bx, 8
jae 0x1400255bc
movzx ecx, bl
mov edx, 1
or ecx, 0xe000
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
jne 0x1400255d0
movzx ecx, bl
mov edx, 1
add rsp, 0x20
pop rbx
jmp qword [sym.imp.USER32.dll_MapVirtualKeyW]
add rsp, 0x20
pop rbx
ret
push 0xffffffffffffffb6
mov byte [rcx + 0x23d74b65], cl
in eax, 2
xlatb
xlatb
and esp, ebp
add dl, bh
lodsd eax, dword [rsi]
leave
push 0x31f2842b
int 0x16
xor dword [rcx + 0x247ae96c], esi
jp 0x14021154a
invalid
imul esp, dword [rsi], 0xffffffca
invalid
cmp dword [rbp + 0x41c1fbe0], 0xfffffff0
pop rsi
jo 0x140211571
clc
and al, 0x38
stc
cmp cl, bh
cmp al, 0x83
jge 0x140211513
insb byte [rdi], dx
sar byte [rsi], cl
jrcxz 0x14021150c
movsb byte [rdi], byte [rsi]
sti
sal dword [rsi], 0xad
lodsd eax, dword ss:[rsi]
cmp ebp, edx
xlatb
invalid
test al, 0x39
mov ch, 0xe6
sub byte [rdx - 3], bh
jo 0x140211511
lodsb al, byte [rsi]
jne 0x14021152d
xlatb
push rcx
ret 0x6775
jmp 0x14021160a
outsb dx, byte [rsi]
cld
pop rbx
jp 0x14021162c
popfq
movsd dword [rdi], dword [rsi]
int 0x75
hlt
hlt
jo 0x140211564
push rbx
test al, 0x7d
ja 0x140211573
stosb byte [rdi], al
jae 0x140211558
enter 0xffffffffffffb73a, 0x39
invalid
sti
mov bl, byte [rsi]
invalid
in al, dx
invalid
xor dl, ch
mov eax, 0x4f7f7491
push 0x7d
je 0x14021168b
push 0x7d
and al, 0xd9
mov bl, 0xd2
jbe 0x1402115c5
xchg edx, eax
adc edi, ecx
jle 0x14021162f
movabs al, byte [0x63623cf6b3d9a65c]
in eax, dx
jns 0x1402115bd
mov esi, 0x7b815345
invalid
int3
pop rbx
push rax
out dx, al
call 0x118b48255
pop rax
sub eax, 0x77fb127d
sbb ch, ah
push rbx
xchg edi, eax
xchg esp, eax
lahf
adc eax, 0x35077fbb
cmp eax, 0x94b81f92
pop rdx
xor bl, dl
cmp r11d, esi
movabs dword [0x48f5d2d962622db0], eax
sar r9b, 0x35
sbb dword [rbp - 0x53], ebp
mov r9d, 0x4c45b35e
sub al, 0x5b
mov edx, 0xb813a91e
invalid
in eax, dx
invalid