Function at 0x140017840
Capabilities:
Log keystrokes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x378
cmp qword [0x140125f68], 0
lea rax, [0x140100a28]
mov rdi, rcx
lea r11, [0x140100a30]
movzx ecx, byte [0x140125d27]
mov ebx, edx
lea rdx, [rsp + 0x150]
cmovne r11, rax
call fcn.140022bd0
movzx ecx, byte [0x140125d29]
lea rdx, [rsp + 0x250]
mov r10, rax
call fcn.140022bd0
mov qword [rsp + 0x28], r11
lea r8, str.Modifiers__Hooks_Logical____s_r_nModifiers__Hooks_Physical____s_r_nPrefix_key_is_down:__s_r_n
mov r9, rax
mov qword [rsp + 0x20], r10
mov rcx, rdi
mov edx, ebx
call fcn.14009c820
cmp qword [0x140125e08], 0
jne 0x1400178d5
lea r8, str._r_nNOTE:_Only_the_scripts_own_keyboard_events_are_shown_r_n_not_the_users___because_the_keyboard_hook_isnt_installed._r_n
mov edx, ebx
mov rcx, rdi
call fcn.14009c820
lea r8, str._r_nNOTE:_To_disable_the_key_history_shown_below__call_KeyHistory_0_.__The_same_method_can_be_used_to_change_the_size_of_the_history_buffer.__For_example:_KeyHistory_100___Default_is_40__Max_is_500__r_n_r_nThe_oldest_are_listed_first.__VKVirtual_Key__SCScan_Code__ElapsedSeconds_since_the_previous_event.__Types:_hHook_Hotkey__sSuppressed__blocked___iIgnored_because_it_was_generated_by_an_AHK_script__aArtificial__Disabled_via_HotIf__UUnicode_character__SendInput_._r_n_r_nVK__SC_tType_tUp_Dn_tElapsed_tKey_t_tWindow_r_n_____________________________________________________________________________________________________________
mov edx, ebx
mov rcx, rdi
call fcn.14009c820
mov rbx, qword [0x140125b40]
test rbx, rbx
je 0x140017cc2
mov edx, dword [0x14011f190]
xor r8d, r8d
mov qword [rsp + 0x3a8], rbp
movsxd rbp, dword [0x140125b6c]
mov qword [rsp + 0x368], r12
lea r12, [0x1400fbbd0]
mov qword [rsp + 0x360], r13
mov r13d, r8d
test edx, edx
jle 0x140017caa
mov qword [rsp + 0x370], rsi
lea r9, [0x14011f3a8]
mov qword [rsp + 0x358], r14
lea r11, [0x140000000]
mov qword [rsp + 0x350], r15
mov r10d, 0xff
mov r15, rbp
nop
cmp ebp, edx
jl 0x14001796a
mov ebp, r8d
mov r15, r8
mov rsi, r12
movsxd rax, ebp
imul r14, r15, 0xd4
imul r12, rax, 0xd4
movzx edi, byte [r14 + rbx]
add r12, 0xc
add r12, rbx
cmp dil, 0xe7
jne 0x140017a24
movzx r9d, word [r14 + rbx + 2]
mov rax, r12
sub rsi, r12
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x1400179b7
add rax, 2
test cx, cx
jne 0x1400179a0
mov eax, r8d
jmp 0x1400179bc
sbb eax, eax
or eax, 1
movss xmm0, dword [r14 + rbx + 8]
lea rdx, [0x1400fbbd0]
test eax, eax
lea r8, str._r_nE7__04X_t_c_t_c_t_0.2f_t_c_______________t_s
mov eax, 0x75
mov ecx, WSAAsyncSelect
cmovne rdx, r12
cmp byte [r14 + rbx + 6], 0
mov qword [rsp + 0x40], rdx
mov edx, dword [rsp + 0x398]
cmovne ecx, eax
movzx eax, word [r14 + rbx + 4]
mov dword [rsp + 0x38], r9d
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x390]
mov dword [rsp + 0x20], eax
call fcn.14009c820
jmp 0x140017c5d
test dil, dil
jne 0x140017a89
cmp word [r14 + rbx + 2], 0
je 0x140017c81
movzx eax, word [r14 + rbx + 2]
mov edx, eax
mov word [rsp + 0x50], r8w
mov ebx, eax
movzx ecx, ax
sub edx, 0x45
je 0x140017a84
sub edx, 0xf1
je 0x140017a5b
cmp edx, 0xf
jne 0x140017a5f
and cx, r10w
bt cx, 8
jae 0x140017a72
and cx, r10w
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
jmp 0x140017ac6
mov dil, reloc.WSOCK32.dll_send
jmp 0x140017ad7
movzx ebx, word [r14 + rbx + 2]
mov word [rsp + 0x50], r8w
test bx, bx
jne 0x140017ad7
cmp dil, 0xd
je 0x140017ab3
mov dl, 1
movzx ecx, dil
call fcn.140023ef0
movzx ebx, ax
test ax, ax
jne 0x140017ac6
xor edx, edx
movzx ecx, dil
call fcn.140023ef0
movzx ebx, ax
test ax, ax
je 0x140017aff
xor r8d, r8d
lea r9, [0x14011f3a8]
lea r11, [0x140000000]
lea eax, [rdi + 0x64]
cmp al, 3
jbe 0x140017aff
mov rdx, r8
lea rax, [0x14011f2d8]
cmp word [rax], bx
je 0x140017b3d
inc rdx
add rax, 0x10
cmp rax, r9
jl 0x140017ae8
mov word [rsp + 0x50], r8w
xor ebx, ebx
mov rdx, rbx
lea rax, [0x14011f3a8]
lea rcx, [0x14011fa58]
cmp byte [rax], dil
je 0x140017b79
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140017b12
movzx ecx, dil
call fcn.140023080
mov word [rsp + 0x50], ax
test ax, ax
je 0x140017b70
mov word [rsp + 0x52], bx
jmp 0x140017ba8
add rdx, rdx
lea rcx, [rsp + 0x50]
mov r8d, 0x7f
mov rdx, qword [r11 + rdx*8 + 0x11f2d0]
call fcn.1400ced64
xor ebx, ebx
mov word [rsp + 0x14e], bx
cmp word [rsp + 0x50], bx
je 0x140017b01
lea r10, [rsp + 0x50]
jmp 0x140017bbb
mov eax, ebx
mov word [rsp + 0x50], bx
jmp 0x140017ba8
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x11f3a0]
call fcn.1400ced64
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x14e], bx
test ax, ax
lea r10, [rsp + 0x50]
lea rax, str.not_found
cmove r10, rax
mov r9, qword [0x140125b40]
mov rax, r12
sub rsi, r12
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017be6
add rax, 2
test cx, cx
jne 0x140017bd0
mov eax, ebx
jmp 0x140017beb
sbb eax, eax
or eax, 1
movzx ecx, word [r14 + r9 + 2]
lea r8, [0x1400fbbd0]
movss xmm0, dword [r14 + r9 + 8]
test eax, eax
mov eax, 0x75
mov edx, WSAAsyncSelect
cmovne r8, r12
cmp byte [r14 + r9 + 6], 0
mov qword [rsp + 0x48], r8
lea r8, str._r_n_02X___03X_t_c_t_c_t_0.2f_t__15s_t_s
mov qword [rsp + 0x40], r10
cmovne edx, eax
movzx eax, word [r14 + r9 + 4]
movzx r9d, byte [r14 + r9]
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], edx
mov edx, dword [rsp + 0x398]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x390]
call fcn.14009c820
mov edx, dword [0x14011f190]
lea r11, [0x140000000]
mov rbx, qword [0x140125b40]
lea r9, [0x14011f3a8]
mov r10d, 0xff
xor r8d, r8d
inc r13d
inc ebp
inc r15
cmp r13d, edx
jl 0x140017960
mov r15, qword [rsp + 0x350]
mov r14, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x370]
mov r12, qword [rsp + 0x368]
mov rbp, qword [rsp + 0x3a8]
mov r13, qword [rsp + 0x360]
add rsp, 0x378
pop rdi
pop rbx
ret