Function at 0x18003ead0
Capabilities:
Log keystrokes
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
mov qword [rsp + 0xe0], 0xfffffffffffffffe
cmp dword [rsp + 0x108], 0x20
jb 0x18003eb0a
cmp dword [rsp + 0x108], 0x7e
jbe 0x18003eb2c
cmp dword [rsp + 0x108], 0xa0
jb 0x18003ed88
cmp dword [rsp + 0x108], 0xff
ja 0x18003ed88
movzx ecx, byte [rsp + 0x108]
call qword [sym.imp.USER32.dll_VkKeyScanA]
mov word [rsp + 0x3c], ax
movsx eax, word [rsp + 0x3c]
cmp eax, 0xffffffff
jne 0x18003eb4e
jmp 0x18003ef2d
movsx rax, word [rsp + 0x3c]
and rax, 0xff
mov byte [rsp + 0x38], al
mov dword [rsp + 0x40], setsockopt
mov dword [rsp + 0x44], 0
mov byte [rsp + 0x48], 0
mov byte [rsp + 0x49], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x20], reloc.WS2_32.dll_select
mov dword [rsp + 0x24], 0
mov byte [rsp + 0x28], 0
mov byte [rsp + 0x29], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x88], reloc.WS2_32.dll_recv
mov dword [rsp + 0x8c], 0
mov byte [rsp + 0x90], 0
mov byte [rsp + 0x91], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x58], 0xa0
mov dword [rsp + 0x5c], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x61], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], 0xa1
mov dword [rsp + 0x74], 0
mov byte [rsp + 0x78], 0
mov byte [rsp + 0x79], 0
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x80], rax
movzx eax, byte [rsp + 0x110]
test eax, eax
je 0x18003ecd6
movsx rax, word [rsp + 0x3c]
shr rax, 8
and rax, 0xff
mov byte [rsp + 0xa0], al
movzx eax, byte [rsp + 0xa0]
and eax, 2
test eax, eax
je 0x18003ec73
lea rcx, [rsp + 0x40]
call fcn.18003efa0
movzx eax, byte [rsp + 0xa0]
and eax, 4
test eax, eax
je 0x18003ec8c
lea rcx, [rsp + 0x20]
call fcn.18003efa0
movzx eax, byte [rsp + 0xa0]
and eax, 1
test eax, eax
je 0x18003ecaa
lea rcx, [rsp + 0x88]
call fcn.18003efa0
jmp 0x18003ecd6
call fcn.18004cf90
test eax, eax
je 0x18003ecc2
lea rcx, [rsp + 0x88]
call fcn.18003f040
jmp 0x18003ecd6
lea rcx, [rsp + 0x58]
call fcn.18003f040
lea rcx, [rsp + 0x70]
call fcn.18003f040
movzx eax, byte [rsp + 0x110]
test eax, eax
je 0x18003ecef
mov dword [rsp + 0xd0], 0
jmp 0x18003ecfa
mov dword [rsp + 0xd0], 2
cmp qword [rsp + 0x118], 0
je 0x18003ed23
mov rax, qword [rsp + 0x118]
mov rax, qword [rax]
mov edx, 1
mov rcx, qword [rsp + 0x118]
call qword [rax + 0x420]
movzx ecx, byte [rsp + 0x38]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
xor r9d, r9d
mov r8d, dword [rsp + 0xd0]
movzx edx, al
movzx ecx, byte [rsp + 0x38]
call qword [sym.imp.USER32.dll_keybd_event]
nop
lea rcx, [rsp + 0x70]
call fcn.18003f0e0
nop
lea rcx, [rsp + 0x58]
call fcn.18003f0e0
nop
lea rcx, [rsp + 0x88]
call fcn.18003f0e0
nop
lea rcx, [rsp + 0x20]
call fcn.18003f0e0
nop
lea rcx, [rsp + 0x40]
call fcn.18003f0e0
jmp 0x18003ef2d
mov rax, qword [rsp + 0x100]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0xd8], rax
mov r8, qword [rsp + 0x100]
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0xc0]
call fcn.180041620
lea r8, [rsp + 0x108]
lea rdx, [rsp + 0xb0]
mov rcx, qword [rsp + 0x100]
call fcn.18003f340
lea rdx, [rsp + 0xc0]
mov rcx, rax
call fcn.18003f690
movzx eax, al
test eax, eax
je 0x18003edf2
jmp 0x18003ef2d
lea rdx, [rsp + 0x108]
mov rcx, qword [rsp + 0x100]
call fcn.18003f4f0
movzx eax, byte [rax]
mov byte [rsp + 0xa8], al
mov dword [rsp + 0xa4], 0
mov rcx, qword [rsp + 0x100]
add rcx, 0x40
lea rdx, [rsp + 0x108]
call fcn.18003f4f0
movzx eax, byte [rax]
test eax, eax
je 0x18003ee4d
mov eax, dword [rsp + 0xa4]
or eax, 1
mov dword [rsp + 0xa4], eax
movzx eax, byte [rsp + 0x110]
test eax, eax
jne 0x18003ee6a
mov eax, dword [rsp + 0xa4]
or eax, 2
mov dword [rsp + 0xa4], eax
movzx eax, byte [rsp + 0x110]
test eax, eax
je 0x18003eebd
movzx eax, byte [rsp + 0xa8]
cmp eax, 0x2e
jne 0x18003eebd
mov ecx, setsockopt
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x18003eebd
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x18003eebd
call fcn.18004cfc0
test eax, eax
je 0x18003eebd
call fcn.18004d1e0
jmp 0x18003ef2d
call fcn.18004cf90
test eax, eax
je 0x18003ef10
mov al, byte [rsp + 0xa8]
mov byte [rsp + 0xe8], al
cmp byte [rsp + 0xe8], 0xa1
je 0x18003eef4
cmp byte [rsp + 0xe8], 0xa3
je 0x18003eefe
cmp byte [rsp + 0xe8], 0xa5
je 0x18003ef08
jmp 0x18003ef10
mov byte [rsp + 0xa8], reloc.WS2_32.dll_recv
jmp 0x18003ef10
mov byte [rsp + 0xa8], setsockopt
jmp 0x18003ef10
mov byte [rsp + 0xa8], reloc.WS2_32.dll_select
mov r8d, dword [rsp + 0xa4]
mov rdx, qword [rsp + 0x118]
movzx ecx, byte [rsp + 0xa8]
call fcn.18003ef40
add rsp, 0xf8
ret