Function at 0x140017f80
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push r13
sub rsp, 0x378
cmp qword [0x140133358], 0
lea rax, [0x14010bd18]
mov rbx, rcx
lea r11, [0x14010bd20]
movzx ecx, byte [0x140133035]
mov r13d, edx
lea rdx, [rsp + 0x150]
cmovne r11, rax
call fcn.140023850
movzx ecx, byte [0x140133037]
lea rdx, [rsp + 0x250]
mov r10, rax
call fcn.140023850
mov qword [rsp + 0x28], r11
lea r8, str.Modifiers__Hooks_Logical____s_r_nModifiers__Hooks_Physical____s_r_nPrefix_key_is_down:__s_r_n
mov r9, rax
mov qword [rsp + 0x20], r10
mov rcx, rbx
mov edx, r13d
call fcn.1400a5d30
cmp qword [0x1401331f8], 0
jne 0x140018015
lea r8, str._r_nNOTE:_Only_the_scripts_own_keyboard_events_are_shown_r_n_not_the_users___because_the_keyboard_hook_isnt_installed._r_n
mov edx, r13d
mov rcx, rbx
call fcn.1400a5d30
lea r8, str._r_nNOTE:_To_disable_the_key_history_shown_below__call_KeyHistory_0_.__The_same_method_can_be_used_to_change_the_size_of_the_history_buffer.__For_example:_KeyHistory_100___Default_is_40__Max_is_500__r_n_r_nThe_oldest_are_listed_first.__VKVirtual_Key__SCScan_Code__ElapsedSeconds_since_the_previous_event.__Types:_hHook_Hotkey__sSuppressed__blocked___iIgnored_because_it_was_generated_by_an_AHK_script__aArtificial__Disabled_via_HotIf__UUnicode_character__SendInput_._r_n_r_nVK__SC_tType_tUp_Dn_tElapsed_tKey_t_tWindow_r_n_____________________________________________________________________________________________________________
mov edx, r13d
mov rcx, rbx
call fcn.1400a5d30
mov rbx, qword [0x140132f20]
test rbx, rbx
je 0x1400183fb
mov edx, dword [0x14012c3a0]
xor r10d, r10d
mov qword [rsp + 0x398], rbp
movsxd rbp, dword [0x140132f44]
mov qword [rsp + 0x360], r12
mov r12d, r10d
mov qword [rsp + 0x350], r15
lea r15, [0x140106cb0]
test edx, edx
jle 0x1400183e3
mov qword [rsp + 0x370], rsi
lea r9, [0x14012c5c8]
mov qword [rsp + 0x368], rdi
mov r11d, 0xff
mov qword [rsp + 0x358], r14
mov r14, rbp
nop dword [rax]
cmp ebp, edx
jl 0x1400180aa
mov ebp, r10d
mov r14, r10
mov rsi, r15
movsxd rax, ebp
imul r8, r14, 0xd4
imul r15, rax, 0xd4
movzx edi, byte [r8 + rbx]
add r15, 0xc
add r15, rbx
cmp dil, 0xe7
jne 0x140018160
movzx r9d, word [r8 + rbx + 2]
mov rax, r15
sub rsi, r15
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x1400180f7
add rax, 2
test cx, cx
jne 0x1400180e0
mov eax, r10d
jmp 0x1400180fc
sbb eax, eax
or eax, 1
movss xmm0, dword [r8 + rbx + 8]
lea rdx, [0x140106cb0]
test eax, eax
mov ecx, WSAAsyncSelect
mov eax, 0x75
cmovne rdx, r15
cmp byte [r8 + rbx + 6], 0
mov qword [rsp + 0x40], rdx
mov edx, r13d
cmovne ecx, eax
mov dword [rsp + 0x38], r9d
movzx eax, word [r8 + rbx + 4]
lea r8, str._r_nE7__04X_t_c_t_c_t_0.2f_t_c_______________t_s
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x390]
mov dword [rsp + 0x20], eax
call fcn.1400a5d30
jmp 0x14001839d
test dil, dil
jne 0x1400181c5
cmp word [r8 + rbx + 2], 0
je 0x1400183ba
movzx eax, word [r8 + rbx + 2]
mov edx, eax
mov word [rsp + 0x50], r10w
mov ebx, eax
movzx ecx, ax
sub edx, 0x45
je 0x1400181c0
sub edx, 0xf1
je 0x140018197
cmp edx, 0xf
jne 0x14001819b
and cx, r11w
bt cx, 8
jae 0x1400181ae
and cx, r11w
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
jmp 0x140018202
mov dil, reloc.WSOCK32.dll_send
jmp 0x14001820c
movzx ebx, word [r8 + rbx + 2]
mov word [rsp + 0x50], r10w
test bx, bx
jne 0x14001820c
cmp dil, 0xd
je 0x1400181ef
mov dl, 1
movzx ecx, dil
call fcn.140024b70
movzx ebx, ax
test ax, ax
jne 0x140018202
xor edx, edx
movzx ecx, dil
call fcn.140024b70
movzx ebx, ax
test ax, ax
je 0x140018237
xor r10d, r10d
lea r9, [0x14012c5c8]
lea eax, [rdi + 0x64]
cmp al, 3
jbe 0x140018237
mov rdx, r10
lea rax, [0x14012c4f8]
nop dword [rax]
cmp word [rax], bx
je 0x14001827b
inc rdx
add rax, 0x10
cmp rax, r9
jl 0x140018220
mov word [rsp + 0x50], r10w
xor ebx, ebx
mov rdx, rbx
lea rax, [0x14012c5c8]
lea rcx, [0x14012cc78]
nop word [rax + rax]
cmp byte [rax], dil
je 0x1400182be
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140018250
movzx ecx, dil
call fcn.140023d00
mov word [rsp + 0x50], ax
test ax, ax
je 0x1400182b5
mov word [rsp + 0x52], bx
jmp 0x1400182ed
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x12c4f0]
call fcn.1400d8b44
xor ebx, ebx
mov word [rsp + 0x14e], bx
cmp word [rsp + 0x50], bx
je 0x140018239
lea r10, [rsp + 0x50]
jmp 0x140018300
mov eax, ebx
mov word [rsp + 0x50], bx
jmp 0x1400182ed
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x12c5c0]
call fcn.1400d8b44
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x14e], bx
test ax, ax
lea r10, [rsp + 0x50]
lea rax, str.not_found
cmove r10, rax
mov r11, qword [0x140132f20]
mov rax, r15
imul r9, r14, 0xd4
sub rsi, r15
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x14001832a
add rax, 2
test cx, cx
jne 0x140018314
mov eax, ebx
jmp 0x14001832f
sbb eax, eax
or eax, 1
movzx ecx, word [r9 + r11 + 2]
lea r8, [0x140106cb0]
movss xmm0, dword [r9 + r11 + 8]
test eax, eax
mov eax, 0x75
mov edx, WSAAsyncSelect
cmovne r8, r15
cmp byte [r9 + r11 + 6], 0
mov qword [rsp + 0x48], r8
lea r8, str._r_n_02X___03X_t_c_t_c_t_0.2f_t__15s_t_s
mov qword [rsp + 0x40], r10
cmovne edx, eax
movzx eax, word [r9 + r11 + 4]
movzx r9d, byte [r9 + r11]
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], edx
mov edx, r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x390]
call fcn.1400a5d30
mov edx, dword [0x14012c3a0]
lea r9, [0x14012c5c8]
mov rbx, qword [0x140132f20]
mov r11d, 0xff
xor r10d, r10d
inc r12d
inc ebp
inc r14
cmp r12d, edx
jl 0x1400180a0
mov r14, qword [rsp + 0x358]
mov rdi, qword [rsp + 0x368]
mov rsi, qword [rsp + 0x370]
mov r12, qword [rsp + 0x360]
mov rbp, qword [rsp + 0x398]
mov r15, qword [rsp + 0x350]
add rsp, 0x378
pop r13
pop rbx
ret