Function at 0x140018ce0
Capabilities:
Log keystrokes via polling

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rsi, rcx
lea rdi, [rcx + 0x1948]
lea r15, [rcx + 0x1930]
lea rbx, [rcx + 0x1908]
lea rbp, [rcx + 0x1961]
mov eax, 0xe87eff7d
mov r13, qword [sym.imp.USER32.dll_GetAsyncKeyState]
lea r14, [rsp + 0xa0]
lea r12, [0x14005e61e]
jmp 0x140018d50
cmp dword [rsp + 0x84], 0
mov eax, 0x954532eb
mov ecx, 0x5ebab0f2
cmove eax, ecx
nop word cs:[rax + rax]
nop
cmp eax, 0x32978416
jg 0x140018da0
cmp eax, 0x58cc51f
jg 0x140018de0
cmp eax, 0xb3e584d4
jg 0x140018e4b
cmp eax, 0x80037a90
je 0x140018fda
cmp eax, 0xb1cbe6fb
jne 0x14001916d
mov rax, qword [rsp + 0x98]
mov al, byte [rax]
mov byte [rsp + 0x3f], al
mov eax, 0xf71bbd28
jmp 0x140018d50
cmp eax, 0x49b2e22f
jg 0x140018e20
cmp eax, 0x36389a34
jg 0x140018e8f
cmp eax, 0x32978417
je 0x140018ff1
cmp eax, 0x33ac1716
jne 0x140018d50
mov qword [rsp + 0x98], rbp
mov eax, 0xb1cbe6fb
jmp 0x140018d50
cmp eax, 0x18d1eb44
jg 0x140018ebc
cmp eax, 0xd4b409c
je 0x140019009
cmp eax, 0x1402f68f
jne 0x14001917d
mov eax, dword [rsp + 0x5c]
add eax, 1
mov dword [0x140069e24], eax
mov eax, 0xb3e584d5
jmp 0x140018d50
cmp eax, 0x697d6182
jg 0x140018fba
cmp eax, 0x49b2e230
je 0x14001903e
cmp eax, 0x5ebab0f2
jne 0x140018d50
mov eax, 0xd4b409c
jmp 0x140018d50
cmp eax, 0xe87eff7d
je 0x1400190b3
cmp eax, 0xf71bbd28
jne 0x14001918d
mov al, byte [rsp + 0x3f]
mov ecx, eax
not cl
and al, 0xe6
mov edx, ecx
and dl, 0x19
or dl, al
xor dl, 0x18
and cl, 0xfe
or cl, dl
cmp cl, 0xff
mov eax, 0x697d6183
mov ecx, 0x49b2e230
cmove eax, ecx
jmp 0x140018d50
cmp eax, 0x36389a35
je 0x140018d2f
cmp eax, 0x3684d45d
jne 0x140018d50
cmp byte [rsp + 0x3e], 0
mov eax, 0x80037a90
mov ecx, 0x33ac1716
cmovne eax, ecx
jmp 0x140018d50
cmp eax, 0x18d1eb45
je 0x1400190bd
cmp eax, 0x1b930c8e
jne 0x140018d50
mov rax, qword [rsp + 0x68]
mov edx, dword [rax]
mov rcx, qword [rsp + 0x60]
mov r9d, dword [rsp + 0x7c]
mov r8d, dword [rsp + 0x80]
call fcn.140003ac0
mov rax, qword [rsp + 0x88]
mov r8d, dword [rax]
mov rax, qword [rsp + 0x90]
mov edx, dword [rax]
xor r9d, r9d
call fcn.14001aab0
mov r9d, dword [rsi + 0x1924]
mov edx, dword [rsi + 0x191c]
mov r8d, dword [rsi + 0x1920]
mov rcx, qword [rsp + 0x60]
call fcn.140003ac0
mov edx, dword [rsi + 0x1920]
mov r8d, dword [rsi + 0x1924]
xor r9d, r9d
call fcn.14001aab0
mov rcx, rdi
call fcn.14001c6e0
mov rcx, r15
call fcn.14001c8f0
mov rcx, qword [rsp + 0x60]
call fcn.140002080
mov rcx, qword [rsp + 0x60]
mov edx, 3
call fcn.140002cc0
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x140053a00]
mov dword [rax + 0x10], ecx
movups xmm0, xmmword [0x1400539f0]
movups xmmword [rax], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.1400214e0
mov eax, 0xb3f09ca1
nop dword [rax + rax]
cmp eax, 0xb3f09ca1
je 0x140018fb3
cmp eax, 0x7cd7c3c7
jne 0x140018fa0
jmp 0x14001910e
mov eax, 0x7cd7c3c7
jmp 0x140018fa0
cmp eax, 0x697d6183
je 0x140019159
cmp eax, 0x76743a28
jne 0x140018d50
mov eax, 0xd4b409c
jmp 0x140018d50
mov ecx, 0x30
call r13
mov word [rsp + 0x4e], ax
mov eax, 0x18d1eb45
jmp 0x140018d50
cmp dword [rsp + 0x78], 0
setne byte [rsp + 0x3e]
mov al, byte [rsp + 0x3e]
mov eax, 0x3684d45d
jmp 0x140018d50
mov ecx, 0x31
call r13
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x751a
and eax, 0xffff8ae5
or eax, edx
xor eax, 0xfffff51a
or eax, ecx
not eax
movzx eax, ax
mov dword [rsp + 0x78], eax
mov eax, 0x32978417
jmp 0x140018d50
mov eax, dword [0x140069e24]
lea ecx, [rax + 1]
mov dword [0x140069e24], ecx
lea eax, [rax + rax*2]
mov dword [0x1400c1838], eax
mov rcx, r12
call fcn.14003b6ec
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rbx
mov rax, qword [rsp + 0x68]
add rax, 8
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax]
mov dword [rsp + 0x7c], eax
mov rax, qword [rsp + 0x68]
add rax, 4
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov eax, dword [rax]
mov dword [rsp + 0x80], eax
mov eax, 0x1b930c8e
jmp 0x140018d50
mov eax, 0x76743a28
jmp 0x140018d50
movzx eax, word [rsp + 0x4e]
mov ecx, eax
not ecx
and eax, 0xffffd5d7
mov edx, ecx
and edx, 0x2a28
or edx, eax
xor edx, 0xffffaa28
and ecx, 0x7fff
or ecx, edx
mov eax, ecx
not eax
and eax, 0xffffdbf3
and ecx, 0x240c
or ecx, eax
xor ecx, 0x240c
movzx eax, cx
mov dword [rsp + 0x84], eax
mov eax, 0x36389a35
jmp 0x140018d50
mov qword [rsp + 0x50], rsi
mov rax, qword [0x140069d78]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [0x14005e57e]
mov qword [rsp + 0x20], rax
mov word [rsp + 0x30], 6
xor edx, edx
mov r8d, 0xd
mov r9d, 0x25
call fcn.140003720
mov rax, qword [rsp + 0x40]
mov eax, 0x58cc520
jmp 0x140018d50
mov eax, dword [0x140069e24]
mov dword [rsp + 0x5c], eax
mov eax, 0x1402f68f
jmp 0x140018d50
cmp eax, 0x954532eb
jne 0x140018d50
jmp 0x14001935d
cmp eax, 0x58cc520
jne 0x140018d50
jmp 0x1400192a4
cmp eax, 0xb3e584d5
jne 0x140018d50
mov eax, dword [rsp + 0x5c]
add eax, eax
mov dword [0x1400c1838], eax
lea rcx, [0x14005e61e]
call fcn.14003b6ec
mov r9d, dword [rsi + 0x1910]
mov edx, dword [rsi + 0x1908]
mov r8d, dword [rsi + 0x190c]
mov rcx, rsi
call fcn.140003ac0
mov edx, dword [rsi + 0x190c]
mov r8d, dword [rsi + 0x1910]
xor r9d, r9d
call fcn.14001aab0
mov rcx, rdi
call fcn.14001c6e0
mov rcx, r15
call fcn.14001c8f0
mov rcx, rsi
call fcn.140002080
mov rcx, rsi
mov edx, 2
call fcn.140002cc0
mov qword [rsp + 0x40], r14
mov rax, qword [rsp + 0x40]
mov rax, qword [rsp + 0x40]
mov ecx, dword [0x140053a00]
mov dword [rax + 0x10], ecx
movups xmm0, xmmword [0x1400539f0]
movups xmmword [rax], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.1400214e0
mov eax, 0xb3f09ca1
jmp 0x140019240
mov eax, 0x7cd7c3c7
nop
cmp eax, 0xb3f09ca1
je 0x14001923a
cmp eax, 0x7cd7c3c7
jne 0x140019240
mov qword [rsp + 0x50], rsi
mov rax, qword [0x140069d78]
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [0x14005e57e]
mov qword [rsp + 0x20], rax
mov word [rsp + 0x30], 6
xor edx, edx
mov r8d, 0xd
mov r9d, 0x25
call fcn.140003720
mov rax, qword [rsp + 0x40]
mov rcx, rsi
mov edx, 4
call fcn.140018290
mov rcx, rsi
call fcn.140018730
lea rdi, [rsi + 0x191c]
mov eax, 0xcb9ab55c
jmp 0x140019300
mov qword [rsp + 0x70], r14
mov rax, qword [rsp + 0x70]
mov rax, qword [rsp + 0x70]
mov ecx, dword [0x140053a14]
mov dword [rax + 0x10], ecx
movups xmm0, xmmword [0x140053a04]
movups xmmword [rax], xmm0
mov rcx, rdi
mov rdx, r14
call fcn.1400214e0
mov qword [rsp + 0x40], rsi
mov rax, qword [0x140069d78]
mov qword [rsp + 0x50], rax
mov eax, 0x4902e68e
nop word cs:[rax + rax]
nop
cmp eax, 0xcb9ab55c
je 0x1400192b2
cmp eax, 0x4902e68e
jne 0x140019300
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [0x14005e57e]
mov qword [rsp + 0x20], rax
mov word [rsp + 0x30], 6
xor edx, edx
mov r8d, 0x1b
mov r9d, 0x25
call fcn.140003720
mov rax, qword [rsp + 0x70]
mov rcx, rsi
mov edx, 4
call fcn.140018290
mov rcx, rsi
call fcn.14001a3d0
xor ecx, ecx
call fcn.1400340c8
int3