Function at 0x140017f80
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
push r13
sub rsp, 0x370
cmp qword [0x140130308], 0
lea rax, [0x140109c58]
mov rbx, rcx
lea r11, [0x140109c60]
movzx ecx, byte [0x1401300c5]
mov r13d, edx
lea rdx, [rsp + 0x150]
cmovne r11, rax
call fcn.140023830
movzx ecx, byte [0x1401300c7]
lea rdx, [rsp + 0x250]
mov r10, rax
call fcn.140023830
mov qword [rsp + 0x28], r11
lea r8, str.Modifiers__Hooks_Logical____s_r_nModifiers__Hooks_Physical____s_r_nPrefix_key_is_down:__s_r_n
mov r9, rax
mov qword [rsp + 0x20], r10
mov rcx, rbx
mov edx, r13d
call fcn.1400a4d70
cmp qword [0x1401301a8], 0
jne 0x140018016
lea r8, str._r_nNOTE:_Only_the_scripts_own_keyboard_events_are_shown_r_n_not_the_users___because_the_keyboard_hook_isnt_installed._r_n
mov edx, r13d
mov rcx, rbx
call fcn.1400a4d70
lea r8, str._r_nNOTE:_To_disable_the_key_history_shown_below__call_KeyHistory_0_.__The_same_method_can_be_used_to_change_the_size_of_the_history_buffer.__For_example:_KeyHistory_100___Default_is_40__Max_is_500__r_n_r_nThe_oldest_are_listed_first.__VKVirtual_Key__SCScan_Code__ElapsedSeconds_since_the_previous_event.__Types:_hHook_Hotkey__sSuppressed__blocked___iIgnored_because_it_was_generated_by_an_AHK_script__aArtificial__Disabled_via_HotIf__UUnicode_character__SendInput_._r_n_r_nVK__SC_tType_tUp_Dn_tElapsed_tKey_t_tWindow_r_n_____________________________________________________________________________________________________________
mov edx, r13d
mov rcx, rbx
call fcn.1400a4d70
mov rdi, qword [0x14012fee0]
test rdi, rdi
je 0x1400183de
mov edx, dword [0x1401293a0]
xor r10d, r10d
mov qword [rsp + 0x398], rbp
movsxd rbp, dword [0x14012ff0c]
mov qword [rsp + 0x360], r12
mov r12d, r10d
mov qword [rsp + 0x350], r15
lea r15, [0x140104c70]
test edx, edx
jle 0x1400183c6
mov qword [rsp + 0x368], rsi
mov r11d, 0x75
mov qword [rsp + 0x358], r14
mov r9d, 0xff
mov r14, rbp
cmp ebp, edx
jl 0x14001809b
mov ebp, r10d
mov r14, r10
mov rsi, r15
movsxd rax, ebp
imul r8, r14, 0xd4
imul r15, rax, 0xd4
movzx ebx, byte [r8 + rdi]
add r15, 0xc
add r15, rdi
cmp bl, 0xe7
jne 0x14001814c
movzx r9d, word [r8 + rdi + 2]
mov rax, r15
sub rsi, r15
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x1400180e7
add rax, 2
test cx, cx
jne 0x1400180d0
mov eax, r10d
jmp 0x1400180ec
sbb eax, eax
or eax, 1
movss xmm0, dword [r8 + rdi + 8]
lea rdx, [0x140104c70]
test eax, eax
mov ecx, WSAAsyncSelect
movzx eax, word [r8 + rdi + 4]
cmovne rdx, r15
cmp byte [r8 + rdi + 6], 0
mov qword [rsp + 0x40], rdx
lea r8, str._r_nE7__04X_t_c_t_c_t_0.2f_t_c_______________t_s
mov dword [rsp + 0x38], r9d
cmovne ecx, r11d
cvtps2pd xmm0, xmm0
mov edx, r13d
movsd qword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x390]
mov dword [rsp + 0x20], eax
call fcn.1400a4d70
jmp 0x140018389
test bl, bl
jne 0x1400181af
cmp word [r8 + rdi + 2], 0
je 0x1400183a5
movzx eax, word [r8 + rdi + 2]
mov edx, eax
mov word [rsp + 0x50], r10w
mov edi, eax
movzx ecx, ax
sub edx, 0x45
je 0x1400181ab
sub edx, 0xf1
je 0x140018182
cmp edx, 0xf
jne 0x140018186
and cx, r9w
bt cx, 8
jae 0x140018199
and cx, r9w
mov eax, 0xe000
or cx, ax
movzx ecx, cx
mov edx, 3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
jmp 0x1400181e9
mov bl, reloc.WSOCK32.dll_send
jmp 0x1400181e9
movzx edi, word [r8 + rdi + 2]
mov word [rsp + 0x50], r10w
test di, di
jne 0x1400181e9
cmp bl, 0xd
je 0x1400181d7
mov dl, 1
movzx ecx, bl
call fcn.140024b70
movzx edi, ax
test ax, ax
jne 0x1400181e9
xor edx, edx
movzx ecx, bl
call fcn.140024b70
movzx edi, ax
test ax, ax
je 0x140018257
lea eax, [rbx + 0x64]
cmp al, 3
jbe 0x140018257
xor edx, edx
lea rax, [0x1401294f8]
lea rcx, [0x1401295c8]
cmp word [rax], di
je 0x14001821a
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140018200
xor edi, edi
mov word [rsp + 0x50], di
jmp 0x140018259
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x1294f0]
call fcn.1400d6d74
xor edi, edi
mov word [rsp + 0x14e], di
cmp word [rsp + 0x50], di
je 0x140018259
lea r10, [rsp + 0x50]
jmp 0x1400182e4
xor edi, edi
mov rdx, rdi
lea rax, [0x1401295c8]
lea rcx, [0x140129c78]
nop word [rax + rax]
cmp byte [rax], bl
je 0x1400182a2
inc rdx
add rax, 0x10
cmp rax, rcx
jl 0x140018270
movzx ecx, bl
call fcn.140023ce0
mov word [rsp + 0x50], ax
test ax, ax
je 0x140018299
mov word [rsp + 0x52], di
jmp 0x1400182d1
mov eax, edi
mov word [rsp + 0x50], ax
jmp 0x1400182d1
add rdx, rdx
lea rax, [0x140000000]
mov r8d, 0x7f
lea rcx, [rsp + 0x50]
mov rdx, qword [rax + rdx*8 + 0x1295c0]
call fcn.1400d6d74
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x14e], di
test ax, ax
lea r10, [rsp + 0x50]
lea rax, str.not_found
cmove r10, rax
mov r11, qword [0x14012fee0]
mov rax, r15
imul r9, r14, 0xd4
sub rsi, r15
nop dword [rax + rax]
movzx ecx, word [rax]
cmp cx, word [rax + rsi]
jne 0x140018316
add rax, 2
test cx, cx
jne 0x140018300
mov eax, edi
jmp 0x14001831b
sbb eax, eax
or eax, 1
movzx ecx, word [r9 + r11 + 2]
lea r8, [0x140104c70]
movss xmm0, dword [r9 + r11 + 8]
test eax, eax
mov eax, 0x75
mov edx, WSAAsyncSelect
cmovne r8, r15
cmp byte [r9 + r11 + 6], 0
mov qword [rsp + 0x48], r8
lea r8, str._r_n_02X___03X_t_c_t_c_t_0.2f_t__15s_t_s
mov qword [rsp + 0x40], r10
cmovne edx, eax
movzx eax, word [r9 + r11 + 4]
movzx r9d, byte [r9 + r11]
cvtps2pd xmm0, xmm0
movsd qword [rsp + 0x38], xmm0
mov dword [rsp + 0x30], edx
mov edx, r13d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0x390]
call fcn.1400a4d70
mov edx, dword [0x1401293a0]
mov r11d, 0x75
mov rdi, qword [0x14012fee0]
mov r9d, 0xff
xor r10d, r10d
inc r12d
inc ebp
inc r14
cmp r12d, edx
jl 0x140018091
mov r14, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x368]
mov r12, qword [rsp + 0x360]
mov rbp, qword [rsp + 0x398]
mov r15, qword [rsp + 0x350]
add rsp, 0x370
pop r13
pop rdi
pop rbx
ret