Function at 0x140017810
Capabilities:
Log keystrokes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x378
cmp qword [0x140125f68], 0
lea rax, [0x140100a28]
mov rdi, rcx
lea r11, [0x140100a30]
movzx ecx, byte [0x140125d27]
mov ebx, edx
lea rdx, [rsp + 0x150]
cmovne r11, rax
call fcn.140022b80
movzx ecx, byte [0x140125d29]
lea rdx, [rsp + 0x250]
mov r10, rax
call fcn.140022b80
mov qword [rsp + 0x28], r11
lea r8, [0x140100a40]
mov r9, rax
mov qword [rsp + 0x20], r10
mov rcx, rdi
mov edx, ebx
call fcn.14009c920
cmp qword [0x140125e08], 0
jne 0x1400178a5
lea r8, [0x140100b00]
mov edx, ebx
mov rcx, rdi
call fcn.14009c920
lea r8, [0x140100bf0]
mov edx, ebx
mov rcx, rdi
call fcn.14009c920
mov rbx, qword [0x140125b40]
test rbx, rbx
je 0x140017c92
mov edx, dword [0x14011f190]
xor r8d, r8d
mov qword [rsp + 0x3a8], rbp
movsxd rbp, dword [0x140125b6c]
mov qword [rsp + 0x368], r12
lea r12, [0x1400fbbd0]
mov qword [rsp + 0x360], r13
mov r13d, r8d
test edx, edx
jle 0x140017c7a
mov qword [rsp + 0x370], rsi
lea r9, [0x14011f3a8]
mov qword [rsp + 0x358], r14
lea r11, [0x140000000]
mov qword [rsp + 0x350], r15
mov r10d, 0xff
mov r15, rbp
nop
cmp ebp, edx
jl 0x14001793a
mov ebp, r8d
mov r15, r8
mov rsi, r12
movsxd rax, ebp
imul r14, r15, 0xd4
imul r12, rax, 0xd4
movzx edi, byte [r14 + rbx]
add r12, 0xc
add r12, rbx
cmp dil, 0xe7
jne 0x1400179f4
movzx r9d, word [r14 + rbx + 2]
mov rax, r12
sub rsi, r12
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017987
add rax, 2
test cx, cx
jne 0x140017970
mov eax, r8d
jmp 0x14001798c
sbb eax, eax
or eax, 1
movss xmm0, dword [r14 + rbx + 8]
lea rdx, [0x1400fbbd0]
test eax, eax
lea r8, [0x1401010d0]
mov eax, 0x75
mov ecx, WSAAsyncSelect
cmovne rdx, r12
cmp byte [r14 + rbx + 6], 0
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0x398]
cmovne ecx, eax
movzx eax, word [r14 + rbx + 4]
mov dword [rsp + 0x38], r9d
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x390]
mov dword [rsp + 0x20], eax
call fcn.14009c920
jmp 0x140017c2d
test dil, dil
jne 0x140017a59
cmp word [r14 + rbx + 2], 0
je 0x140017c51
movzx eax, word [r14 + rbx + 2]
mov edx, eax
mov word [rsp + 0x50], r8w
mov ebx, eax
movzx ecx, ax
sub edx, 0x45
je 0x140017a54
sub edx, 0xf1
je 0x140017a2b
cmp edx, 0xf
jne 0x140017a2f
and cx, r10w
bt cx, 8
jae 0x140017a42
and cx, r10w
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
jmp 0x140017a96
mov dil, reloc.WSOCK32.dll_send
jmp 0x140017aa7
movzx ebx, word [r14 + rbx + 2]
mov word [rsp + 0x50], r8w
test bx, bx
jne 0x140017aa7
cmp dil, 0xd
je 0x140017a83
mov dl, 1
movzx ecx, dil
call fcn.140023ea0
movzx ebx, ax
test ax, ax
jne 0x140017a96
xor edx, edx
movzx ecx, dil
call fcn.140023ea0
movzx ebx, ax
test ax, ax
je 0x140017acf
xor r8d, r8d
lea r9, [0x14011f3a8]
lea r11, [0x140000000]
lea eax, [rdi + 0x64]
cmp al, 3
jbe 0x140017acf
mov rdx, r8
lea rax, [0x14011f2d8]
cmp word [rax], bx
je 0x140017b0d
inc rdx
add rax, 0x10
cmp rax, r9
jl 0x140017ab8
mov word [rsp + 0x50], r8w
xor ebx, ebx
mov rdx, rbx
lea rax, [0x14011f3a8]
lea rcx, [0x14011fa58]
cmp byte [rax], dil
je 0x140017b49
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140017ae2
movzx ecx, dil
call fcn.140023030
mov word [rsp + 0x50], ax
test ax, ax
je 0x140017b40
mov word [rsp + 0x52], bx
jmp 0x140017b78
add rdx, rdx
lea rcx, [rsp + 0x50]
mov r8d, 0x7f
mov rdx, qword [r11 + rdx*8 + 0x11f2d0]
call fcn.1400cee44
xor ebx, ebx
mov word [rsp + 0x14e], bx
cmp word [rsp + 0x50], bx
je 0x140017ad1
lea r10, [rsp + 0x50]
jmp 0x140017b8b
mov eax, ebx
mov word [rsp + 0x50], bx
jmp 0x140017b78
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x11f3a0]
call fcn.1400cee44
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x14e], bx
test ax, ax
lea r10, [rsp + 0x50]
lea rax, [0x140101128]
cmove r10, rax
mov r9, qword [0x140125b40]
mov rax, r12
sub rsi, r12
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017bb6
add rax, 2
test cx, cx
jne 0x140017ba0
mov eax, ebx
jmp 0x140017bbb
sbb eax, eax
or eax, 1
movzx ecx, word [r14 + r9 + 2]
lea r8, [0x1400fbbd0]
movss xmm0, dword [r14 + r9 + 8]
test eax, eax
mov eax, 0x75
mov edx, WSAAsyncSelect
cmovne r8, r12
cmp byte [r14 + r9 + 6], 0
mov qword [rsp + 0x48], r8
lea r8, [0x140101140]
mov qword [rsp + 0x40], r10
cmovne edx, eax
movzx eax, word [r14 + r9 + 4]
movzx r9d, byte [r14 + r9]
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0x398]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x390]
call fcn.14009c920
mov edx, dword [0x14011f190]
lea r11, [0x140000000]
mov rbx, qword [0x140125b40]
lea r9, [0x14011f3a8]
mov r10d, 0xff
xor r8d, r8d
inc r13d
inc ebp
inc r15
cmp r13d, edx
jl 0x140017930
mov r15, qword [rsp + 0x350]
mov r14, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x370]
mov r12, qword [rsp + 0x368]
mov rbp, qword [rsp + 0x3a8]
mov r13, qword [rsp + 0x360]
add rsp, 0x378
pop rdi
pop rbx
ret