Function at 0x180019ee0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r14, r8
mov r15, rdx
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x20]
cmp qword [rcx + 0x10], rbx
je 0x180019f0e
mov rcx, qword [rcx + 0x20]
jmp 0x180019f12
add rcx, 8
mov rdx, qword [rdi + 0x20]
lea rax, [rdx + 8]
cmp rcx, rax
je 0x180019f41
mov rax, qword [rcx + 0x20]
cmp rax, r15
jne 0x180019f2d
mov rbx, rax
jmp 0x180019f36
call qword [sym.imp.Qt5Core.dll_public:_struct_QMapNodeBase_const____ptr64___cdecl_QMapNodeBase::nextNode_void_const___ptr64]
mov rcx, rax
test rbx, rbx
je 0x180019f12
mov rdx, qword [rdi + 0x20]
jmp 0x180019f4a
test rbx, rbx
je 0x18001a4b8
lea rax, [rdx + 8]
cmp qword [rdx + 0x10], 0
je 0x180019f80
mov rcx, qword [rdx + 0x20]
cmp rcx, rax
je 0x180019f80
nop
cmp qword [rcx + 0x20], rbx
je 0x18001a017
call qword [sym.imp.Qt5Core.dll_public:_struct_QMapNodeBase_const____ptr64___cdecl_QMapNodeBase::nextNode_void_const___ptr64]
mov rcx, rax
mov rax, qword [rdi + 0x20]
add rax, 8
cmp rcx, rax
jne 0x180019f60
xor esi, esi
movzx edx, word [r14 + 0x10]
mov ecx, edx
sub ecx, 6
je 0x18001a0f7
sub ecx, 1
je 0x18001a0f7
sub ecx, 1
je 0x18001a01f
cmp ecx, 1
jne 0x18001a4b8
test byte [rdi + 0x138], 0x20
je 0x180019fbd
xor edx, edx
mov rcx, qword [rdi + 0x10]
call fcn.18002b3c0
mov rcx, qword [rdi + 0x148]
test rcx, rcx
je 0x180019fda
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rdi + 0x148], 0
mov ecx, 0xffffffff
mov dword [rdi + 0x13c], ecx
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x38c]
cmp eax, 6
je 0x18001a000
add eax, 0xfffffff8
cmp eax, 2
ja 0x18001a008
mov rcx, rdi
call fcn.18001c430
mov dl, 1
mov rcx, rdi
call fcn.18001be30
jmp 0x18001a4b8
mov esi, dword [rcx + 0x18]
jmp 0x180019f82
mov rcx, qword [rdi + 0x148]
test rcx, rcx
je 0x18001a044
cmp esi, dword [rdi + 0x13c]
je 0x18001a06a
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rdi + 0x148], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, rax
xor r9d, r9d
lea rdx, [0x18001cde0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rdi + 0x148], rax
mov dword [rdi + 0x13c], esi
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x38c]
cmp eax, 6
je 0x18001a08f
add eax, 0xfffffff7
cmp eax, 1
ja 0x18001a4b8
test byte [rcx + 0x409], 4
jne 0x18001a0d3
mov rcx, rdi
call fcn.1800197e0
test al, al
je 0x18001a0d3
mov rcx, rbx
call qword [sym.imp.Qt5Widgets.dll_public:_unsigned_long_long_unsigned___int64____cdecl_QWidget::winId_void_const___ptr64]
mov rcx, rax
mov edx, 2
call qword [sym.imp.USER32.dll_GetAncestor]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rbx, rax
jne 0x18001a0d3
mov edx, esi
mov rcx, rdi
call fcn.180019820
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rcx + 0x409]
test al, 4
je 0x18001a4b8
and al, 0xfb
mov byte [rcx + 0x409], al
jmp 0x18001a4b8
test byte [rdi + 0x138], 2
je 0x18001a496
cmp edx, 6
jne 0x18001a4b8
mov eax, dword [r14 + 0x28]
sub eax, 0x1000030
cmp eax, 0xb
ja 0x18001a3a5
xor r9d, r9d
lea edx, [r9 + 8]
lea ecx, [rdx - 4]
lea r8d, [r9 + 6]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
test rax, rax
jne 0x18001a146
call qword [sym.imp.Qt5Core.dll_void___cdecl_qBadAlloc_void_]
mov rax, qword [rbp + 0x48]
mov dword [rax + 4], 6
mov rax, qword [rbp + 0x48]
mov rdx, qword [rax + 0x10]
movsxd rcx, dword [rax + 4]
lea r8, [rdx + rcx*4]
add r8, rax
lea rcx, [rdx + rax]
sub r8, rcx
and r8, 0xfffffffffffffffc
xor edx, edx
call sub.VCRUNTIME140.dll_memset
nop
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jbe 0x18001a1b7
mov edx, dword [rax + 8]
and edx, 0x7fffffff
jne 0x18001a1a7
lea r9d, [rdx + 2]
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
jmp 0x18001a1b7
xor r8d, r8d
lea rcx, [rbp + 0x48]
call fcn.180008190
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rax + rcx], 0x1d
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jbe 0x18001a206
mov edx, dword [rax + 8]
and edx, 0x7fffffff
jne 0x18001a1f6
lea r9d, [rdx + 2]
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
jmp 0x18001a206
xor r8d, r8d
lea rcx, [rbp + 0x48]
call fcn.180008190
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rax + 4], 0x38
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jbe 0x18001a256
mov edx, dword [rax + 8]
and edx, 0x7fffffff
jne 0x18001a246
lea r9d, [rdx + 2]
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
jmp 0x18001a256
xor r8d, r8d
lea rcx, [rbp + 0x48]
call fcn.180008190
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rax + 0x10], 0xb8
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jbe 0x18001a2a6
mov edx, dword [rax + 8]
and edx, 0x7fffffff
jne 0x18001a296
lea r9d, [rdx + 2]
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
jmp 0x18001a2a6
xor r8d, r8d
lea rcx, [rbp + 0x48]
call fcn.180008190
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rax + 0x14], RegisterTypeLib
mov ecx, dword [r14 + 0x28]
lea eax, [rcx - 0x1000030]
cmp eax, 9
ja 0x18001a3ea
lea ebx, [rcx - 0xfffff5]
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jbe 0x18001a30f
mov edx, dword [rax + 8]
and edx, 0x7fffffff
jne 0x18001a2ff
lea r9d, [rdx + 2]
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
jmp 0x18001a30f
xor r8d, r8d
lea rcx, [rbp + 0x48]
call fcn.180008190
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rax + 8], ebx
mov ebx, dword [r14 + 0x28]
add ebx, 0xff00008b
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jbe 0x18001a34f
mov edx, dword [rax + 8]
and edx, 0x7fffffff
je 0x18001a477
xor r8d, r8d
lea rcx, [rbp + 0x48]
call fcn.180008190
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rax + 0xc], ebx
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
add rcx, 0x288
lea rdx, [rbp + 0x48]
call qword [sym.imp.UICommon.dll_public:_unsigned_long_int___cdecl_CKeyboard::PutScancodes_class_QVector_long_int__const____ptr64____ptr64]
nop
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
test ecx, ecx
je 0x18001a392
cmp ecx, 0xffffffff
je 0x18001a3a5
mov rax, qword [rbp + 0x48]
mov ecx, 0xffffffff
lock xadd dword [rax], ecx
cmp ecx, 1
jne 0x18001a3a5
mov edx, 4
lea r8d, [rdx + 4]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QArrayData::deallocate_struct_QArrayData____ptr64__unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64__]
mov rcx, qword [rdi + 0x10]
call fcn.18001e7b0
mov rbx, rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, dword [r14 + 0x28]
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Gui.dll_public:_void___cdecl_QKeySequence::constructor_int__int__int__int____ptr64]
nop
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.UICommon.dll_public:_bool___cdecl_UIActionPool::processHotKey_class_QKeySequence_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x10]
call qword [sym.imp.Qt5Gui.dll_public:_void___cdecl_QKeySequence::destructor_void____ptr64]
jmp 0x18001a4b8
lea eax, [rcx - 0x100003a]
cmp eax, 1
ja 0x18001a357
lea ebx, [rcx - 0xffffe3]
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
mov rax, qword [rbp + 0x48]
cmp ecx, 1
jbe 0x18001a443
mov edx, dword [rax + 8]
and edx, 0x7fffffff
jne 0x18001a433
lea r9d, [rdx + 2]
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
jmp 0x18001a443
xor r8d, r8d
lea rcx, [rbp + 0x48]
call fcn.180008190
mov rax, qword [rbp + 0x48]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rax + 8], ebx
mov ebx, dword [r14 + 0x28]
add ebx, 0xff00009d
mov rax, qword [rbp + 0x48]
mov ecx, dword [rax]
cmp ecx, 1
jbe 0x18001a34b
mov rax, qword [rbp + 0x48]
mov edx, dword [rax + 8]
and edx, 0x7fffffff
jne 0x18001a33f
mov r9d, 2
xor r8d, r8d
lea edx, [r9 + 6]
lea ecx, [rdx - 4]
call qword [sym.imp.Qt5Core.dll_public:_static_struct_QArrayData____ptr64___cdecl_QArrayData::allocate_unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___unsigned_long_long_unsigned___int64___class_QFlags_enum_QArrayData::AllocationOption__]
mov qword [rbp + 0x48], rax
jmp 0x18001a34f
cmp edx, 7
jne 0x18001a4b8
mov rax, qword [rdi + 0x10]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x38c]
sub eax, edx
test eax, 0xfffffff7
jne 0x18001a4b8
call qword [sym.imp.UICommon.dll_public:_static_void___cdecl_UINotificationMessage::remindAboutPausedVMInput_void_]
mov r8, r14
mov rdx, r15
mov rcx, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp qword [sym.imp.Qt5Core.dll_public_virtual:_bool___cdecl_QObject::eventFilter_class_QObject____ptr64__class_QEvent____ptr64____ptr64]