Function at 0x140017510
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
push r13
sub rsp, 0x370
cmp qword [0x14012bfc8], 0
lea rax, [0x1401069e8]
mov rbx, rcx
lea r11, [0x1401069f0]
movzx ecx, byte [0x14012bd87]
mov r13d, edx
lea rdx, [rsp + 0x150]
cmovne r11, rax
call fcn.140022eb0
movzx ecx, byte [0x14012bd89]
lea rdx, [rsp + 0x250]
mov r10, rax
call fcn.140022eb0
mov qword [rsp + 0x28], r11
lea r8, str.Modifiers__Hooks_Logical____s_r_nModifiers__Hooks_Physical____s_r_nPrefix_key_is_down:__s_r_n
mov r9, rax
mov qword [rsp + 0x20], r10
mov rcx, rbx
mov edx, r13d
call fcn.1400a26d0
cmp qword [0x14012be68], 0
jne 0x1400175a6
lea r8, str._r_nNOTE:_Only_the_scripts_own_keyboard_events_are_shown_r_n_not_the_users___because_the_keyboard_hook_isnt_installed._r_n
mov edx, r13d
mov rcx, rbx
call fcn.1400a26d0
lea r8, str._r_nNOTE:_To_disable_the_key_history_shown_below__call_KeyHistory_0_.__The_same_method_can_be_used_to_change_the_size_of_the_history_buffer.__For_example:_KeyHistory_100___Default_is_40__Max_is_500__r_n_r_nThe_oldest_are_listed_first.__VKVirtual_Key__SCScan_Code__ElapsedSeconds_since_the_previous_event.__Types:_hHook_Hotkey__sSuppressed__blocked___iIgnored_because_it_was_generated_by_an_AHK_script__aArtificial__Disabled_via_HotIf__UUnicode_character__SendInput_._r_n_r_nVK__SC_tType_tUp_Dn_tElapsed_tKey_t_tWindow_r_n_____________________________________________________________________________________________________________
mov edx, r13d
mov rcx, rbx
call fcn.1400a26d0
mov rdi, qword [0x14012bba0]
test rdi, rdi
je 0x14001796e
mov edx, dword [0x1401251e0]
xor r10d, r10d
mov qword [rsp + 0x398], rbp
movsxd rbp, dword [0x14012bbcc]
mov qword [rsp + 0x360], r12
mov r12d, r10d
mov qword [rsp + 0x350], r15
lea r15, [0x140101bd0]
test edx, edx
jle 0x140017956
mov qword [rsp + 0x368], rsi
mov r11d, 0x75
mov qword [rsp + 0x358], r14
mov r9d, 0xff
mov r14, rbp
cmp ebp, edx
jl 0x14001762b
mov ebp, r10d
mov r14, r10
mov rsi, r15
movsxd rax, ebp
imul r8, r14, 0xd4
imul r15, rax, 0xd4
movzx ebx, byte [r8 + rdi]
add r15, 0xc
add r15, rdi
cmp bl, 0xe7
jne 0x1400176dc
movzx r9d, word [r8 + rdi + 2]
mov rax, r15
sub rsi, r15
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017677
add rax, 2
test cx, cx
jne 0x140017660
mov eax, r10d
jmp 0x14001767c
sbb eax, eax
or eax, 1
movss xmm0, dword [r8 + rdi + 8]
lea rdx, [0x140101bd0]
test eax, eax
mov ecx, WSAAsyncSelect
movzx eax, word [r8 + rdi + 4]
cmovne rdx, r15
cmp byte [r8 + rdi + 6], 0
mov qword [rsp + 0x40], rdx
lea r8, str._r_nE7__04X_t_c_t_c_t_0.2f_t_c_______________t_s
mov dword [rsp + 0x38], r9d
cmovne ecx, r11d
cvtps2pd xmm0, xmm0
mov edx, r13d
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x390]
mov dword [rsp + 0x20], eax
call fcn.1400a26d0
jmp 0x140017919
test bl, bl
jne 0x14001773f
cmp word [r8 + rdi + 2], 0
je 0x140017935
movzx eax, word [r8 + rdi + 2]
mov edx, eax
mov word [rsp + 0x50], r10w
mov edi, eax
movzx ecx, ax
sub edx, 0x45
je 0x14001773b
sub edx, 0xf1
je 0x140017712
cmp edx, 0xf
jne 0x140017716
and cx, r9w
bt cx, 8
jae 0x140017729
and cx, r9w
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
jmp 0x140017779
mov bl, reloc.WSOCK32.dll_send
jmp 0x140017779
movzx edi, word [r8 + rdi + 2]
mov word [rsp + 0x50], r10w
test di, di
jne 0x140017779
cmp bl, 0xd
je 0x140017767
mov dl, 1
movzx ecx, bl
call fcn.1400241f0
movzx edi, ax
test ax, ax
jne 0x140017779
xor edx, edx
movzx ecx, bl
call fcn.1400241f0
movzx edi, ax
test ax, ax
je 0x1400177e7
lea eax, [rbx + 0x64]
cmp al, 3
jbe 0x1400177e7
xor edx, edx
lea rax, [0x140125328]
lea rcx, [0x1401253f8]
cmp word [rax], di
je 0x1400177aa
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140017790
xor edi, edi
mov word [rsp + 0x50], di
jmp 0x1400177e9
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x125320]
call fcn.1400d42d4
xor edi, edi
mov word [rsp + 0x14e], di
cmp word [rsp + 0x50], di
je 0x1400177e9
lea r10, [rsp + 0x50]
jmp 0x140017874
xor edi, edi
mov rdx, rdi
lea rax, [0x1401253f8]
lea rcx, [0x140125aa8]
nop word [rax + rax]
cmp byte [rax], bl
je 0x140017832
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140017800
movzx ecx, bl
call fcn.140023360
mov word [rsp + 0x50], ax
test ax, ax
je 0x140017829
mov word [rsp + 0x52], di
jmp 0x140017861
mov eax, edi
mov word [rsp + 0x50], ax
jmp 0x140017861
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x1253f0]
call fcn.1400d42d4
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x14e], di
test ax, ax
lea r10, [rsp + 0x50]
lea rax, str.not_found
cmove r10, rax
mov r11, qword [0x14012bba0]
mov rax, r15
imul r9, r14, 0xd4
sub rsi, r15
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x1400178a6
add rax, 2
test cx, cx
jne 0x140017890
mov eax, edi
jmp 0x1400178ab
sbb eax, eax
or eax, 1
movzx ecx, word [r9 + r11 + 2]
lea r8, [0x140101bd0]
movss xmm0, dword [r9 + r11 + 8]
test eax, eax
mov eax, 0x75
mov edx, WSAAsyncSelect
cmovne r8, r15
cmp byte [r9 + r11 + 6], 0
mov qword [rsp + 0x48], r8
lea r8, str._r_n_02X___03X_t_c_t_c_t_0.2f_t__15s_t_s
mov qword [rsp + 0x40], r10
cmovne edx, eax
movzx eax, word [r9 + r11 + 4]
movzx r9d, byte [r9 + r11]
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], edx
mov edx, r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x390]
call fcn.1400a26d0
mov edx, dword [0x1401251e0]
mov r11d, 0x75
mov rdi, qword [0x14012bba0]
mov r9d, 0xff
xor r10d, r10d
inc r12d
inc ebp
inc r14
cmp r12d, edx
jl 0x140017621
mov r14, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x368]
mov r12, qword [rsp + 0x360]
mov rbp, qword [rsp + 0x398]
mov r15, qword [rsp + 0x350]
add rsp, 0x370
pop r13
pop rdi
pop rbx
ret