Function at 0x140017800
Capabilities:
Log keystrokes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x378
cmp qword [0x140125f68], 0
lea rax, [0x140100a28]
mov rdi, rcx
lea r11, [0x140100a30]
movzx ecx, byte [0x140125d27]
mov ebx, edx
lea rdx, [rsp + 0x150]
cmovne r11, rax
call fcn.140022b70
movzx ecx, byte [0x140125d29]
lea rdx, [rsp + 0x250]
mov r10, rax
call fcn.140022b70
mov qword [rsp + 0x28], r11
lea r8, [0x140100a40]
mov r9, rax
mov qword [rsp + 0x20], r10
mov rcx, rdi
mov edx, ebx
call fcn.14009ce30
cmp qword [0x140125e08], 0
jne 0x140017895
lea r8, [0x140100b00]
mov edx, ebx
mov rcx, rdi
call fcn.14009ce30
lea r8, [0x140100bf0]
mov edx, ebx
mov rcx, rdi
call fcn.14009ce30
mov rbx, qword [0x140125b40]
test rbx, rbx
je 0x140017c82
mov edx, dword [0x14011f190]
xor r8d, r8d
mov qword [rsp + 0x3a8], rbp
movsxd rbp, dword [0x140125b6c]
mov qword [rsp + 0x368], r12
lea r12, [0x1400fbbd0]
mov qword [rsp + 0x360], r13
mov r13d, r8d
test edx, edx
jle 0x140017c6a
mov qword [rsp + 0x370], rsi
lea r9, [0x14011f3a8]
mov qword [rsp + 0x358], r14
lea r11, [0x140000000]
mov qword [rsp + 0x350], r15
mov r10d, 0xff
mov r15, rbp
nop
cmp ebp, edx
jl 0x14001792a
mov ebp, r8d
mov r15, r8
mov rsi, r12
movsxd rax, ebp
imul r14, r15, 0xd4
imul r12, rax, 0xd4
movzx edi, byte [r14 + rbx]
add r12, 0xc
add r12, rbx
cmp dil, 0xe7
jne 0x1400179e4
movzx r9d, word [r14 + rbx + 2]
mov rax, r12
sub rsi, r12
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017977
add rax, 2
test cx, cx
jne 0x140017960
mov eax, r8d
jmp 0x14001797c
sbb eax, eax
or eax, 1
movss xmm0, dword [r14 + rbx + 8]
lea rdx, [0x1400fbbd0]
test eax, eax
lea r8, [0x1401010d0]
mov eax, 0x75
mov ecx, WSAAsyncSelect
cmovne rdx, r12
cmp byte [r14 + rbx + 6], 0
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0x398]
cmovne ecx, eax
movzx eax, word [r14 + rbx + 4]
mov dword [rsp + 0x38], r9d
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x390]
mov dword [rsp + 0x20], eax
call fcn.14009ce30
jmp 0x140017c1d
test dil, dil
jne 0x140017a49
cmp word [r14 + rbx + 2], 0
je 0x140017c41
movzx eax, word [r14 + rbx + 2]
mov edx, eax
mov word [rsp + 0x50], r8w
mov ebx, eax
movzx ecx, ax
sub edx, 0x45
je 0x140017a44
sub edx, 0xf1
je 0x140017a1b
cmp edx, 0xf
jne 0x140017a1f
and cx, r10w
bt cx, 8
jae 0x140017a32
and cx, r10w
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
jmp 0x140017a86
mov dil, reloc.WSOCK32.dll_send
jmp 0x140017a97
movzx ebx, word [r14 + rbx + 2]
mov word [rsp + 0x50], r8w
test bx, bx
jne 0x140017a97
cmp dil, 0xd
je 0x140017a73
mov dl, 1
movzx ecx, dil
call fcn.140023e90
movzx ebx, ax
test ax, ax
jne 0x140017a86
xor edx, edx
movzx ecx, dil
call fcn.140023e90
movzx ebx, ax
test ax, ax
je 0x140017abf
xor r8d, r8d
lea r9, [0x14011f3a8]
lea r11, [0x140000000]
lea eax, [rdi + 0x64]
cmp al, 3
jbe 0x140017abf
mov rdx, r8
lea rax, [0x14011f2d8]
cmp word [rax], bx
je 0x140017afd
inc rdx
add rax, 0x10
cmp rax, r9
jl 0x140017aa8
mov word [rsp + 0x50], r8w
xor ebx, ebx
mov rdx, rbx
lea rax, [0x14011f3a8]
lea rcx, [0x14011fa58]
cmp byte [rax], dil
je 0x140017b39
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140017ad2
movzx ecx, dil
call fcn.140023020
mov word [rsp + 0x50], ax
test ax, ax
je 0x140017b30
mov word [rsp + 0x52], bx
jmp 0x140017b68
add rdx, rdx
lea rcx, [rsp + 0x50]
mov r8d, 0x7f
mov rdx, qword [r11 + rdx*8 + 0x11f2d0]
call fcn.1400cf354
xor ebx, ebx
mov word [rsp + 0x14e], bx
cmp word [rsp + 0x50], bx
je 0x140017ac1
lea r10, [rsp + 0x50]
jmp 0x140017b7b
mov eax, ebx
mov word [rsp + 0x50], bx
jmp 0x140017b68
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x11f3a0]
call fcn.1400cf354
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x14e], bx
test ax, ax
lea r10, [rsp + 0x50]
lea rax, [0x140101128]
cmove r10, rax
mov r9, qword [0x140125b40]
mov rax, r12
sub rsi, r12
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017ba6
add rax, 2
test cx, cx
jne 0x140017b90
mov eax, ebx
jmp 0x140017bab
sbb eax, eax
or eax, 1
movzx ecx, word [r14 + r9 + 2]
lea r8, [0x1400fbbd0]
movss xmm0, dword [r14 + r9 + 8]
test eax, eax
mov eax, 0x75
mov edx, WSAAsyncSelect
cmovne r8, r12
cmp byte [r14 + r9 + 6], 0
mov qword [rsp + 0x48], r8
lea r8, [0x140101140]
mov qword [rsp + 0x40], r10
cmovne edx, eax
movzx eax, word [r14 + r9 + 4]
movzx r9d, byte [r14 + r9]
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0x398]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x390]
call fcn.14009ce30
mov edx, dword [0x14011f190]
lea r11, [0x140000000]
mov rbx, qword [0x140125b40]
lea r9, [0x14011f3a8]
mov r10d, 0xff
xor r8d, r8d
inc r13d
inc ebp
inc r15
cmp r13d, edx
jl 0x140017920
mov r15, qword [rsp + 0x350]
mov r14, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x370]
mov r12, qword [rsp + 0x368]
mov rbp, qword [rsp + 0x3a8]
mov r13, qword [rsp + 0x360]
add rsp, 0x378
pop rdi
pop rbx
ret