Function at 0x18018d0d0
Capabilities:
Log keystrokes via application hook

Disassembly:
push r12
push r15
sub rsp, 0x38
mov rax, qword [rcx]
mov r12, rdx
mov r15, rcx
call qword [rax + 0x2b8]
test al, al
jne 0x18018d157
mov edx, dword [r12]
lea eax, [rdx - 9]
cmp eax, 9
ja 0x18018d157
mov rcx, qword [r15 + 0x90]
test rcx, rcx
je 0x18018d118
mov rax, qword [rcx]
mov rdx, r12
add rsp, 0x38
pop r15
pop r12
jmp qword [rax + 0x318]
cmp edx, 0x15
jne 0x18018d12e
mov byte [r15 + 0x1f9], 1
add rsp, 0x38
pop r15
pop r12
ret
cmp edx, 0x14
jne 0x18018d144
mov byte [r15 + 0x1f9], 0
add rsp, 0x38
pop r15
pop r12
ret
mov rdx, r12
mov rcx, r15
add rsp, 0x38
pop r15
pop r12
jmp fcn.180177170
cmp dword [r12], 0x17
jne 0x18018d18d
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x2a8]
test al, al
je 0x18018d18d
mov edx, 0x7f01
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, rax
add rsp, 0x38
pop r15
pop r12
jmp qword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [r12]
cmp eax, 0x16
jne 0x18018d1b3
cmp qword [r15 + 0x7e0], 0
je 0x18018d1b3
mov rcx, qword [r15 + 0x88]
mov rdx, r15
call fcn.18016fe10
mov eax, dword [r12]
cmp eax, 0x12
jne 0x18018d1c6
cmp qword [r15 + 0x7e0], 0
jne 0x18018d5e7
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rsi
lea rsi, vtable.DuiLib::CEditWnd.0
mov qword [rsp + 0x28], rdi
xor edi, edi
cmp eax, 0x15
jne 0x18018d2ae
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x2a8]
test al, al
je 0x18018d2ae
cmp qword [r15 + 0x7e0], rdi
jne 0x18018d5d8
mov rcx, r15
call fcn.180176e70
mov rcx, r15
call fcn.180175550
test al, al
je 0x18018d264
lea ecx, [rdi + 0x38]
call fcn.1801c7c04
mov qword [rsp + 0x50], rax
mov rdx, r15
mov rcx, qword [0x180201710]
mov qword [rax + 0x10], rcx
mov rcx, rax
mov qword [rax + 8], rdi
mov byte [rax + 0x18], dil
mov qword [rax], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rdi
mov dword [rax + 0x30], 0x10000
mov byte [rax + 0x34], dil
mov qword [r15 + 0x7e0], rax
call fcn.18018be30
call fcn.18019ce20
mov rbx, rax
cmp qword [rax + 8], rdi
jne 0x18018d28d
mov r9d, dword [rax]
lea rdx, [fcn.180113910]
xor r8d, r8d
lea ecx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 8], rax
cmp qword [rbx + 0x10], rdi
jne 0x18018d2ae
mov r9d, dword [rbx]
lea rdx, [fcn.180113910]
xor r8d, r8d
lea ecx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x10], rax
cmp dword [r12], 0x14
jne 0x18018d2da
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x2a8]
test al, al
je 0x18018d2da
mov rcx, r15
call fcn.180176e70
call fcn.18019ce20
mov rcx, rax
call fcn.18019ceb0
mov ecx, dword [r12]
cmp ecx, 0x18
jne 0x18018d35d
cmp qword [r12 + 0x20], 0x15
jne 0x18018d35d
call fcn.18019ce20
mov rbx, rax
cmp dword [rax + 0x18], edi
jne 0x18018d5d8
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x18018d30f
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx + 8], rdi
mov r9d, dword [rbx]
lea rdx, [fcn.180113910]
xor r8d, r8d
lea ecx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 8], rax
test rcx, rcx
je 0x18018d33d
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov qword [rbx + 0x10], rdi
mov r9d, dword [rbx]
lea rdx, [fcn.180113910]
xor r8d, r8d
lea ecx, [r8 + 2]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x10], rax
jmp 0x18018d5d8
lea eax, [rcx - 0xd]
test eax, 0xfffffffc
jne 0x18018d4db
cmp ecx, 0xe
je 0x18018d4db
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x2a8]
test al, al
je 0x18018d5d8
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x110]
cmp byte [rax + 0x321], dil
je 0x18018d3b9
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x110]
mov rbx, rax
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov byte [rbx + 0x321], dil
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x2d8]
test al, al
je 0x18018d42d
cmp qword [r15 + 0x7e0], rdi
jne 0x18018d42d
mov rcx, r15
call fcn.180175550
test al, al
je 0x18018d42d
mov ecx, gethostname
call fcn.1801c7c04
mov qword [rsp + 0x50], rax
mov rdx, r15
mov rcx, qword [0x180201710]
mov qword [rax + 0x10], rcx
mov rcx, rax
mov qword [rax + 8], rdi
mov byte [rax + 0x18], dil
mov qword [rax], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 0x28], rdi
mov dword [rax + 0x30], 0x10000
mov byte [rax + 0x34], dil
mov qword [r15 + 0x7e0], rax
call fcn.18018be30
jmp 0x18018d5d8
mov rcx, qword [r15 + 0x7e0]
test rcx, rcx
je 0x18018d5d8
cmp byte [r15 + 0x7ee], dil
jne 0x18018d5d8
mov rcx, qword [rcx + 8]
xor r9d, r9d
mov esi, dword [r15 + 0x788]
xor r8d, r8d
mov ebx, dword [r15 + 0x78c]
mov edx, 0xb1
mov edi, dword [r15 + 0x1b8]
mov qword [rsp + 0x60], rbp
mov ebp, dword [r15 + 0x1b4]
mov qword [rsp + 0x20], r14
mov r14, qword [r12 + 0x14]
mov qword [rsp + 0x50], r14
call qword [sym.imp.USER32.dll_SendMessageW]
movzx eax, word [rsp + 0x54]
sub r14w, si
mov rcx, qword [r15 + 0x7e0]
sub ax, bx
mov r8, qword [r12 + 0x20]
sub ax, di
movzx r9d, ax
sub r14w, bp
shl r9, 0x10
mov edx, 0x201
mov rcx, qword [rcx + 8]
movzx eax, r14w
or r9, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov r14, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x60]
jmp 0x18018d5d8
cmp ecx, 0x11
ja 0x18018d4ee
mov eax, 0x24200
bt eax, ecx
jb 0x18018d5d8
cmp ecx, 0xb
jne 0x18018d536
mov rdx, qword [r12 + 0x14]
lea rcx, [r15 + 0x1b4]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x18018d536
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x2a8]
test al, al
je 0x18018d536
mov eax, dword [r15 + 0x7f4]
test al, 8
jne 0x18018d536
or eax, 8
mov rcx, r15
mov dword [r15 + 0x7f4], eax
call fcn.180176e70
mov eax, dword [r12]
cmp eax, 0xa
jne 0x18018d59a
mov rdx, qword [r12 + 0x14]
lea rcx, [r15 + 0x1b4]
call qword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x18018d5a9
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x2a8]
test al, al
je 0x18018d582
mov eax, dword [r15 + 0x7f4]
test al, 8
je 0x18018d582
and eax, 0xfffffff7
mov rcx, r15
mov dword [r15 + 0x7f4], eax
call fcn.180176e70
mov rcx, qword [r15 + 0x88]
test rcx, rcx
je 0x18018d596
mov rdx, r15
call fcn.1801707a0
mov eax, dword [r12]
cmp eax, 0x15
jne 0x18018d5bf
mov byte [r15 + 0x1f9], 1
jmp 0x18018d5d8
mov rcx, qword [r15 + 0x88]
test rcx, rcx
je 0x18018d5d8
mov rdx, r15
call fcn.180170760
jmp 0x18018d5d8
cmp eax, 0x14
jne 0x18018d5cd
mov byte [r15 + 0x1f9], dil
jmp 0x18018d5d8
mov rdx, r12
mov rcx, r15
call fcn.180177170
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x28]
add rsp, 0x38
pop r15
pop r12
ret