Function at 0x140171d70
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x1404b3028]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
mov rcx, qword [0x1404c47a0]
test rcx, rcx
je 0x140171e14
mov rax, qword [rcx]
call qword [rax + 0x1e8]
test rax, rax
jne 0x140171e14
mov rcx, qword [0x1404c47a0]
mov rax, qword [rcx]
call qword [rax + 0x160]
test al, al
je 0x140171e14
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [0x1404c47a0]
mov rax, qword [rcx]
call qword [rax + 0x168]
mov rcx, qword [0x1404c47a0]
mov rax, qword [rcx]
call qword [rax + 0x160]
test al, al
jne 0x140171df0
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x208]
mov r9d, eax
mov r8, qword [rsi + 0x80]
mov edx, 2
mov rcx, rsi
call fcn.140145980
mov qword [rsi + 0x80], rax
test rax, rax
je 0x140171e4c
mov r13, qword [rax + 0x218]
jmp 0x140171e4f
mov r13, r15
call fcn.14007be90
test rax, rax
je 0x14017248c
test byte [rsi + 0x3f8], 0xa
je 0x140172153
cmp qword [rsi + 0x410], r15
jne 0x140172153
cmp qword [rsi + 0x440], r15
jne 0x140172153
lea rdx, [0x14038e6dc]
lea rcx, [rbp]
call fcn.140010ee0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
call fcn.14007be90
test rax, rax
je 0x140171ef5
lea r9, [rbp - 0x30]
lea r8, [rbp - 0x60]
lea rdx, [rbp]
mov rcx, rax
call fcn.14007c2d0
test rax, rax
jne 0x140171efe
lea rcx, [rbp]
call fcn.14007d380
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.14003d6e0
mov dword [rbp + 0xc8], 0xfffffffd
lea rdx, str.Yes
lea rcx, [rbp + 0x30]
call fcn.140010ee0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
call fcn.14007be90
test rax, rax
je 0x140171f92
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.14007c2d0
test rax, rax
jne 0x140171f9b
lea rcx, [rbp + 0x30]
call fcn.14007d380
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14003d6e0
mov dword [rbp + 0x90], 0xfffffffd
mov rax, qword [rsi]
lea r8, [rbp + 0x98]
lea rdx, [rbp + 0x60]
mov rcx, rsi
call qword [rax + 0x8a8]
nop
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x60]
call fcn.1400119a0
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x40]
call fcn.1400119a0
nop
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140172044
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017203f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017203f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b258
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x30]
call fcn.1400119a0
nop
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x98]
call fcn.1400119a0
nop
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x1401720d1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401720cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401720cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b258
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14017212f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14017212a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14017212a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b258
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp]
call fcn.1400119a0
cmp qword [rsi + 0x470], 0
jne 0x14017248c
cmp qword [rsi + 0x4a0], 0
jne 0x14017248c
lea rdx, [0x14036dbe4]
lea rcx, [rbp + 0x30]
call fcn.140010ee0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], r15
call fcn.14007be90
test rax, rax
je 0x1401721ea
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x70]
lea rdx, [rbp + 0x30]
mov rcx, rax
call fcn.14007c2d0
test rax, rax
jne 0x1401721f3
lea rcx, [rbp + 0x30]
call fcn.14007d380
mov rdx, rax
lea rcx, [rbp + 0x60]
call fcn.14003d6e0
mov dword [rbp + 0x90], 0xfffffffd
lea rdx, [0x14036dbe0]
lea rcx, [rbp]
call fcn.140010ee0
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r15
call fcn.14007be90
test rax, rax
je 0x14017227a
lea r9, [rbp - 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp]
mov rcx, rax
call fcn.14007c2d0
test rax, rax
jne 0x140172283
lea rcx, [rbp]
call fcn.14007d380
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.14003d6e0
mov dword [rbp + 0xc8], 0xfffffffd
mov rax, qword [rsi]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x98]
mov rcx, rsi
call qword [rax + 0x8c0]
nop
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x98]
call fcn.1400119a0
nop
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14017231b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140172316
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140172316
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b258
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r15w
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140172379
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140172374
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140172374
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b258
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp]
call fcn.1400119a0
nop
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x60]
call fcn.1400119a0
nop
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x140172403
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401723fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401723fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b258
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r15w
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x140172465
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140172460
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140172460
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003b258
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 7
mov word [rsp + 0x40], r15w
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp + 0x30]
call fcn.1400119a0
mov r14d, dword [rsi + 0x3f8]
mov eax, r14d
and eax, 0x10
test r14b, 0xa
je 0x1401724bc
neg eax
sbb ecx, ecx
add ecx, 4
test r14b, r14b
jns 0x1401724b1
bts ecx, 8
jmp 0x1401724d3
test r14d, r14d
jns 0x1401724d3
bts ecx, 9
jmp 0x1401724d3
test eax, eax
je 0x1401724d0
mov ecx, r14d
sar ecx, 0x1f
and ecx, 0x100
inc ecx
jmp 0x1401724d3
mov ecx, r15d
mov edi, ecx
bts edi, 0xe
bt r14d, 0xc
cmovae edi, ecx
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x8d0]
cmp eax, 0x100
je 0x140172518
cmp eax, 0x200
je 0x140172513
cmp eax, 0x400
je 0x14017250e
cmp eax, 0x800
jne 0x14017251b
or edi, 0x40
jmp 0x14017251b
or edi, 0x20
jmp 0x14017251b
or edi, 0x10
jmp 0x14017251b
or edi, 0x30
mov ebx, edi
bts ebx, 0x12
bt r14d, 0xf
cmovae ebx, edi
mov rcx, qword [rsi + 0x80]
call fcn.1400eb050
mov ecx, ebx
or ecx, 0x180000
cmp eax, 2
cmovne ecx, ebx
mov r12d, ecx
bts r12d, 0xd
test r13, r13
cmovne r12d, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r14d, eax
mov r9d, eax
xor r8d, r8d
lea rdx, [0x140170940]
lea ecx, [r8 + 5]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rsi + 0x4f0], rax
call fcn.140170b20
mov rdi, rax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x30], r15
mov eax, r14d
xor edx, edx
div qword [rdi + 8]
mov r15, rdx
mov rcx, qword [rdi]
mov rbx, qword [rcx + rdx*8]
test rbx, rbx
je 0x1401725b5
cmp dword [rbx + 8], r14d
je 0x140172654
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1401725a3
mov ecx, Ordinal_27
call fcn.14003b21c
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rax], 0
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rax + 8], xmm0
mov rcx, qword [rdi]
mov rdx, qword [rcx + r15*8]
mov qword [rax], rdx
mov rcx, qword [rdi]
mov qword [rcx + r15*8], rax
inc qword [rdi + 0x10]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
xorps xmm0, xmm0
test rcx, rcx
js 0x140172603
cvtsi2ss xmm0, rcx
jmp 0x140172618
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
xorps xmm1, xmm1
test rdx, rdx
js 0x140172627
cvtsi2ss xmm1, rdx
jmp 0x14017263f
mov rcx, rdx
shr rcx, 1
mov rax, rdx
and eax, 1
or rcx, rax
cvtsi2ss xmm1, rcx
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [0x14033c608]
jb 0x140172654
mov rcx, rdi
call fcn.140171ce0
mov qword [rbx + 0x10], rsi
lea rdx, [rsi + 0x368]
lea rcx, [rsp + 0x40]
call fcn.14003d6e0
mov dword [rsp + 0x20], 1
cmp qword [rsi + 0x3a8], 0
je 0x1401726e4
lea rdx, [0x140393cd8]
lea rcx, [rbp]
call fcn.140044710
nop
mov rdx, rax
cmp qword [rax + 0x18], 8
jb 0x140172699
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x40]
call fcn.140041c40
lea rdx, [rsi + 0x398]
cmp qword [rsi + 0x3b0], 8
jb 0x1401726bf
mov rdx, qword [rsi + 0x398]
mov r8, qword [rsi + 0x3a8]
lea rcx, [rsp + 0x40]
call fcn.140041c40
nop
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbp]
call fcn.1400119a0
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
lea r8, [rsi + 0x3c8]
cmp qword [r8 + 0x18], 8
jb 0x140172706
mov r8, qword [r8]
mov r9d, r12d
mov rcx, r13
call qword [sym.imp.USER32.dll_MessageBoxW]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsp + 0x40]
call fcn.1400119a0
mov ecx, ebx
call fcn.140171240
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.14003b100
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret