Function at 0x1400178e0
Capabilities:
Log keystrokes

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x378
cmp qword [0x140125ea0], 0
lea rax, [0x140101978]
mov rdi, rcx
lea r11, [0x140101980]
movzx ecx, byte [0x140125e82]
mov ebx, edx
lea rdx, [rsp + 0x150]
cmovne r11, rax
call fcn.140022e60
movzx ecx, byte [0x140125e84]
lea rdx, [rsp + 0x250]
mov r10, rax
call fcn.140022e60
mov qword [rsp + 0x28], r11
lea r8, str.Modifiers__Hooks_Logical____s_r_nModifiers__Hooks_Physical____s_r_nPrefix_key_is_down:__s_r_n
mov r9, rax
mov qword [rsp + 0x20], r10
mov rcx, rdi
mov edx, ebx
call fcn.14009d730
cmp qword [0x140125d78], 0
jne 0x140017975
lea r8, str._r_nNOTE:_Only_the_scripts_own_keyboard_events_are_shown_r_n_not_the_users___because_the_keyboard_hook_isnt_installed._r_n
mov edx, ebx
mov rcx, rdi
call fcn.14009d730
lea r8, str._r_nNOTE:_To_disable_the_key_history_shown_below__call_KeyHistory_0_.__The_same_method_can_be_used_to_change_the_size_of_the_history_buffer.__For_example:_KeyHistory_100___Default_is_40__Max_is_500__r_n_r_nThe_oldest_are_listed_first.__VKVirtual_Key__SCScan_Code__ElapsedSeconds_since_the_previous_event.__Types:_hHook_Hotkey__sSuppressed__blocked___iIgnored_because_it_was_generated_by_an_AHK_script__aArtificial__Disabled_via_HotIf__UUnicode_character__SendInput_._r_n_r_nVK__SC_tType_tUp_Dn_tElapsed_tKey_t_tWindow_r_n_____________________________________________________________________________________________________________
mov edx, ebx
mov rcx, rdi
call fcn.14009d730
mov r8, qword [0x140125a88]
test r8, r8
je 0x140017d50
mov edx, dword [0x14011f190]
xor r10d, r10d
mov qword [rsp + 0x3a8], rbp
movsxd rbp, dword [0x140125ad4]
mov qword [rsp + 0x368], r12
lea r12, [0x1400fcb50]
mov qword [rsp + 0x360], r13
mov r13d, r10d
test edx, edx
jle 0x140017d38
mov qword [rsp + 0x370], rsi
lea r9, [0x14011f3a8]
mov qword [rsp + 0x358], r14
mov r11d, 0xff
mov qword [rsp + 0x350], r15
mov r15, rbp
cmp ebp, edx
jl 0x140017a02
mov ebp, r10d
mov r15, r10
mov rsi, r12
movsxd rax, ebp
imul r12, rax, 0xd4
imul r14, r15, 0xd4
add r12, 0xc
add r12, r8
movzx eax, byte [r14 + r8]
cmp al, 0xe7
jne 0x140017ab0
movzx r9d, word [r14 + r8 + 2]
mov rax, r12
sub rsi, r12
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017a4d
add rax, 2
test cx, cx
jne 0x140017a36
mov eax, r10d
jmp 0x140017a52
sbb eax, eax
or eax, 1
movss xmm0, dword [r14 + r8 + 8]
lea rdx, [0x1400fcb50]
test eax, eax
mov ecx, WSAAsyncSelect
mov eax, 0x75
cmovne rdx, r12
cmp byte [r14 + r8 + 6], 0
mov qword [rsp + 0x40], rdx
mov edx, ebx
cmovne ecx, eax
mov dword [rsp + 0x38], r9d
movzx eax, word [r14 + r8 + 4]
lea r8, str._r_nE7__04X_t_c_t_c_t_0.2f_t_c_______________t_s
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov rcx, rdi
mov dword [rsp + 0x20], eax
call fcn.14009d730
jmp 0x140017cf2
test al, al
jne 0x140017b14
cmp word [r14 + r8 + 2], 0
je 0x140017d0f
movzx eax, word [r14 + r8 + 2]
mov edx, eax
mov word [rsp + 0x50], r10w
mov ebx, eax
movzx ecx, ax
sub edx, 0x45
je 0x140017b0f
sub edx, 0xf1
je 0x140017ae6
cmp edx, 0xf
jne 0x140017aea
and cx, r11w
bt cx, 8
jae 0x140017afd
and cx, r11w
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
jmp 0x140017b51
mov dil, reloc.WSOCK32.dll_send
jmp 0x140017b5b
movzx ebx, word [r14 + r8 + 2]
movzx edi, al
mov word [rsp + 0x50], r10w
test bx, bx
jne 0x140017b5b
cmp al, 0xd
je 0x140017b3e
mov dl, 1
movzx ecx, al
call fcn.1400241a0
movzx ebx, ax
test ax, ax
jne 0x140017b51
xor edx, edx
movzx ecx, dil
call fcn.1400241a0
movzx ebx, ax
test ax, ax
je 0x140017b87
xor r10d, r10d
lea r9, [0x14011f3a8]
lea eax, [rdi + 0x64]
cmp al, 3
jbe 0x140017b87
mov rdx, r10
lea rax, [0x14011f2d8]
nop dword [rax]
cmp word [rax], bx
je 0x140017bcb
inc rdx
add rax, 0x10
cmp rax, r9
jl 0x140017b70
mov word [rsp + 0x50], r10w
xor ebx, ebx
mov rdx, rbx
lea rax, [0x14011f3a8]
lea rcx, [0x14011fa58]
nop word [rax + rax]
cmp byte [rax], dil
je 0x140017c0e
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140017ba0
movzx ecx, dil
call fcn.140023320
mov word [rsp + 0x50], ax
test ax, ax
je 0x140017c05
mov word [rsp + 0x52], bx
jmp 0x140017c3d
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x11f2d0]
call fcn.1400d02a4
xor ebx, ebx
mov word [rsp + 0x14e], bx
cmp word [rsp + 0x50], bx
je 0x140017b89
lea r10, [rsp + 0x50]
jmp 0x140017c50
mov eax, ebx
mov word [rsp + 0x50], bx
jmp 0x140017c3d
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x11f3a0]
call fcn.1400d02a4
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x14e], bx
test ax, ax
lea r10, [rsp + 0x50]
lea rax, str.not_found
cmove r10, rax
mov r9, qword [0x140125a88]
mov rax, r12
sub rsi, r12
nop dword [rax]
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140017c76
add rax, 2
test cx, cx
jne 0x140017c60
mov eax, ebx
jmp 0x140017c7b
sbb eax, eax
or eax, 1
movzx ecx, word [r14 + r9 + 2]
lea r8, [0x1400fcb50]
movss xmm0, dword [r14 + r9 + 8]
test eax, eax
mov rdi, qword [rsp + 0x390]
mov eax, 0x75
mov ebx, dword [rsp + 0x398]
cmovne r8, r12
cmp byte [r14 + r9 + 6], 0
mov edx, WSAAsyncSelect
mov qword [rsp + 0x48], r8
lea r8, str._r_n_02X___03X_t_c_t_c_t_0.2f_t__15s_t_s
mov qword [rsp + 0x40], r10
cmovne edx, eax
movzx eax, word [r14 + r9 + 4]
movzx r9d, byte [r14 + r9]
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], edx
mov edx, ebx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, rdi
call fcn.14009d730
mov edx, dword [0x14011f190]
lea r9, [0x14011f3a8]
mov r8, qword [0x140125a88]
mov r11d, 0xff
xor r10d, r10d
inc r13d
inc ebp
inc r15
cmp r13d, edx
jl 0x1400179f8
mov r15, qword [rsp + 0x350]
mov r14, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x370]
mov r12, qword [rsp + 0x368]
mov rbp, qword [rsp + 0x3a8]
mov r13, qword [rsp + 0x360]
add rsp, 0x378
pop rdi
pop rbx
ret