Function at 0x140174550
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x198
call fcn.14008c780
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax + 0xf0]
test eax, eax
je 0x140174589
xor al, al
jmp 0x140174ddd
mov rax, qword [0x140222d70]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x68]
add rax, 0x38e0
mov qword [rsp + 0x60], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x78]
call fcn.140114bf0
mov dword [rsp + 0x48], eax
movss xmm0, dword [0x1401d7fc4]
movss dword [rsp + 0x20], xmm0
mov r9b, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x1b0]
lea rcx, [rsp + 0xb0]
call fcn.1401017f0
mov rax, qword [rsp + 0x60]
movss xmm0, dword [rax + 0x40]
mulss xmm0, dword [0x1401d7ed0]
movss xmm1, dword [rsp + 0xb4]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0xc8], xmm0
call fcn.140101010
movss dword [rsp + 0xcc], xmm0
mov rax, qword [rsp + 0x1c0]
mov rax, qword [rax]
mov qword [rsp + 0xd8], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xe0], rax
movss xmm3, dword [rsp + 0xc8]
movss xmm2, dword [rsp + 0xcc]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0xa8]
call fcn.140100ee0
movss xmm0, dword [rsp + 0xac]
movss dword [rsp + 0xc0], xmm0
movss xmm0, dword [rsp + 0xb0]
comiss xmm0, dword [0x1401d7dec]
jbe 0x1401746bd
mov rax, qword [rsp + 0x60]
movss xmm0, dword [rax + 0x54]
addss xmm0, dword [rsp + 0xb0]
movss dword [rsp + 0x98], xmm0
jmp 0x1401746c9
xorps xmm0, xmm0
movss dword [rsp + 0x98], xmm0
movss xmm0, dword [rsp + 0xa8]
addss xmm0, dword [rsp + 0x98]
movss xmm2, dword [rsp + 0xc0]
movaps xmm1, xmm0
lea rcx, [rsp + 0xe8]
call fcn.14002fdd0
mov rax, qword [rsp + 0x78]
add rax, 0x138
lea r8, [rsp + 0xa8]
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.140036b80
mov rcx, qword [rsp + 0x78]
add rcx, 0x138
mov r8, rax
mov rdx, rcx
lea rcx, [rsp + 0x80]
call fcn.1400f7fb0
lea r8, [rsp + 0xe8]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x158]
call fcn.140036b80
mov r8, rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x100]
call fcn.1400f7fb0
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0x60]
movss xmm1, dword [rax + 0x40]
lea rcx, [rsp + 0x100]
call fcn.140156d80
xor r9d, r9d
lea r8, [rsp + 0x80]
mov edx, dword [rsp + 0x48]
lea rcx, [rsp + 0x100]
call fcn.14011b5c0
movzx eax, al
test eax, eax
jne 0x1401747bc
xor al, al
jmp 0x140174ddd
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0x4068], ecx
jne 0x1401747da
mov dword [rsp + 0x9c], 1
jmp 0x1401747e5
mov dword [rsp + 0x9c], 0
mov edx, dword [rsp + 0x9c]
mov rcx, qword [rsp + 0x78]
call fcn.140174540
mov byte [rsp + 0x43], al
movzx eax, byte [rsp + 0x43]
mov byte [rsp + 0x70], al
mov edx, dword [rsp + 0x48]
lea rcx, [rsp + 0x80]
call fcn.14011b860
mov byte [rsp + 0x41], al
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x140174839
mov ecx, dword [rsp + 0x48]
call fcn.140129ef0
mov rax, qword [rsp + 0x68]
mov dword [rax + 0x4c28], 1
movzx eax, byte [rsp + 0x41]
test eax, eax
je 0x140174866
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x90]
movzx eax, byte [rcx + rax + 0x3750]
test eax, eax
je 0x140174866
mov byte [rsp + 0x42], 1
jmp 0x14017486b
mov byte [rsp + 0x42], 0
movzx eax, byte [rsp + 0x42]
mov byte [rsp + 0x50], al
movzx eax, byte [rsp + 0x43]
test eax, eax
jne 0x140174886
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x1401748fd
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0x4068], ecx
je 0x1401748e1
mov rax, qword [rsp + 0x90]
add rax, 0xe10
mov r8d, 5
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x90]
add rax, 0xb30
mov r8d, 0x28c
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x1b8]
mov dword [rax], 0
mov rdx, qword [rsp + 0x78]
mov ecx, dword [rsp + 0x48]
call fcn.140129450
xor edx, edx
mov rcx, qword [rsp + 0x78]
call fcn.140113b80
jmp 0x140174930
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 0x90]
movzx eax, byte [rcx + rax + 0x3750]
test eax, eax
je 0x140174930
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0x4068], ecx
jne 0x140174930
call fcn.140102ce0
mov byte [rsp + 0x40], 0
mov rax, qword [rsp + 0x1b8]
mov eax, dword [rax]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0x4068], ecx
jne 0x140174a86
mov dword [rsp + 0x54], 0
jmp 0x14017496c
mov eax, dword [rsp + 0x54]
inc eax
mov dword [rsp + 0x54], eax
cmp dword [rsp + 0x54], 5
jge 0x1401749fc
movsxd rax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x90]
movzx eax, byte [rcx + rax + 0xe10]
test eax, eax
je 0x1401749f7
mov eax, dword [rsp + 0x54]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1401749bd
cmp dword [rsp + 0x58], 1
je 0x1401749c7
cmp dword [rsp + 0x58], 2
je 0x1401749d1
cmp dword [rsp + 0x58], 3
je 0x1401749db
cmp dword [rsp + 0x58], 4
je 0x1401749e5
jmp 0x1401749ed
mov dword [rsp + 0x44], 1
jmp 0x1401749ed
mov dword [rsp + 0x44], 2
jmp 0x1401749ed
mov dword [rsp + 0x44], 4
jmp 0x1401749ed
mov dword [rsp + 0x44], 5
jmp 0x1401749ed
mov dword [rsp + 0x44], 6
mov byte [rsp + 0x40], 1
call fcn.140102ce0
jmp 0x140174962
movzx eax, byte [rsp + 0x40]
test eax, eax
jne 0x140174a50
mov dword [rsp + 0x5c], 8
jmp 0x140174a19
mov eax, dword [rsp + 0x5c]
inc eax
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0xff
jg 0x140174a50
movsxd rax, dword [rsp + 0x5c]
mov rcx, qword [rsp + 0x90]
movzx eax, byte [rcx + rax + 0xb30]
test eax, eax
je 0x140174a4e
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x44], eax
mov byte [rsp + 0x40], 1
call fcn.140102ce0
jmp 0x140174a0f
mov dl, 1
mov ecx, 0x20e
call fcn.140174df0
movzx eax, al
test eax, eax
je 0x140174a78
mov rax, qword [rsp + 0x1b8]
mov dword [rax], 0
call fcn.140102ce0
jmp 0x140174a86
mov rax, qword [rsp + 0x1b8]
mov ecx, dword [rsp + 0x44]
mov dword [rax], ecx
lea rax, [rsp + 0x110]
lea rcx, [0x1401ca818]
mov rdi, rax
mov rsi, rcx
mov ecx, 5
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x115]
mov rdi, rax
xor eax, eax
mov ecx, 0x3b
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x60]
movss xmm0, dword [rax + 0x44]
movss dword [rsp + 0xbc], xmm0
mov eax, 0x10
imul rax, rax, 7
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + rax + 0xdc]
mov rcx, rax
call fcn.140114560
mov dword [rsp + 0xc4], eax
movss xmm0, dword [rsp + 0xbc]
movss dword [rsp + 0x20], xmm0
mov r9b, 1
mov r8d, dword [rsp + 0xc4]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140124fc0
mov rax, qword [rsp + 0x1b8]
cmp dword [rax], 0
je 0x140174c34
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0x4068], ecx
je 0x140174c34
xor edx, edx
mov rax, qword [rsp + 0x1b8]
mov ecx, dword [rax]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x44], 0x20
jg 0x140174b6d
mov dword [rsp + 0xa0], 1
jmp 0x140174b78
mov dword [rsp + 0xa0], 0
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x74], eax
cmp dword [rsp + 0x74], 0
jne 0x140174bbb
cmp dword [rsp + 0x44], 0x6f
je 0x140174bbb
mov dword [rsp + 0x20], 1
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x110]
mov edx, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.USER32.dll_ToAscii]
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x4c]
shl eax, 0x10
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x4c]
bts eax, 0x19
mov dword [rsp + 0x4c], eax
cmp dword [rsp + 0x74], 0
jne 0x140174be5
mov eax, dword [rsp + 0x4c]
bts eax, 0x18
mov dword [rsp + 0x4c], eax
mov r8d, 0x40
lea rdx, [rsp + 0x110]
mov ecx, dword [rsp + 0x4c]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
lea rcx, [rsp + 0x110]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
ja 0x140174c32
mov rax, qword [rsp + 0x1b8]
movsxd rax, dword [rax]
lea rcx, [0x1401c9e00]
mov rdx, qword [rcx + rax*8]
lea rcx, [rsp + 0x110]
call fcn.140173800
jmp 0x140174c59
mov rax, qword [rsp + 0x68]
mov ecx, dword [rsp + 0x48]
cmp dword [rax + 0x4068], ecx
jne 0x140174c59
lea rdx, str.__Press_a_key__
lea rcx, [rsp + 0x110]
call fcn.140173800
lea rdx, str.Auto
lea rcx, [rsp + 0x110]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140174c7f
mov rax, qword [rsp + 0x1b8]
mov dword [rax], 0
movss xmm0, dword [rsp + 0x84]
addss xmm0, dword [rsp + 0xd4]
movss xmm1, dword [rsp + 0x80]
addss xmm1, dword [rsp + 0xd0]
movss dword [rsp + 0x20], xmm0
movaps xmm3, xmm1
movss xmm2, dword [rsp + 0x84]
movss xmm1, dword [rsp + 0x80]
lea rcx, [rsp + 0x178]
call fcn.1400f8060
mov rax, qword [rsp + 0x60]
add rax, 0x3c
mov r8, rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x160]
call fcn.140036b80
mov rax, qword [rsp + 0x60]
add rax, 0x3c
mov r8, rax
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x168]
call fcn.1400d8020
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x60]
add rax, 0x3c
mov r8, rax
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x188]
call fcn.140036b80
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x60]
add rax, 0x98
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rsp + 0x110]
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xf8]
call fcn.140125f60
movss xmm0, dword [rsp + 0xb0]
comiss xmm0, dword [0x1401d7dec]
jbe 0x140174dd8
mov rax, qword [rsp + 0x60]
movss xmm0, dword [rsp + 0x84]
addss xmm0, dword [rax + 0x40]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x100]
lea rcx, [rsp + 0x170]
call fcn.14002fdd0
mov r9b, 1
xor r8d, r8d
mov rdx, qword [rsp + 0x1b0]
mov rcx, qword [rax]
call fcn.140125de0
movzx eax, byte [rsp + 0x40]
add rsp, 0x198
pop rdi
pop rsi
ret