Function at 0x180006510
Capabilities:
Create thread
Log keystrokes via polling
Terminate thread

Disassembly:
sub rsp, 0x128
mov rax, qword [0x180031020]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800060c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0xd8], 0
lea rax, [0x180072fec]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0xd8]
call fcn.18000a420
mov byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x32]
mov rcx, qword [rsp + 0x40]
xchg byte [rcx], al
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180003ef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x88], rax
xor eax, eax
cmp eax, 1
je 0x1800069e8
call fcn.180006c30
movzx eax, al
test eax, eax
jne 0x1800065da
call fcn.180006a00
jmp 0x1800065c7
mov edx, 0x3e8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1800042b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180004a20]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180005850]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x180006000]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0xe0], 0
lea rax, [0x180072feb]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
call fcn.18000a420
mov byte [rsp + 0x33], al
movzx eax, byte [rsp + 0x33]
mov rcx, qword [rsp + 0x48]
xchg byte [rcx], al
mov byte [rsp + 0xe8], 0
lea rax, [0x180072fea]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0xe8]
call fcn.18000a420
mov byte [rsp + 0x35], al
movzx eax, byte [rsp + 0x35]
mov rcx, qword [rsp + 0x50]
xchg byte [rcx], al
mov byte [rsp + 0xf0], 0
lea rax, [0x180072fe8]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0xf0]
call fcn.18000a420
mov byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x31]
mov rcx, qword [rsp + 0x58]
xchg byte [rcx], al
mov byte [rsp + 0xf8], 0
lea rax, [0x180072fed]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0xf8]
call fcn.18000a420
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
xchg byte [rcx], al
lea rax, [0x180072feb]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
movzx eax, byte [rax]
mov byte [rsp + 0x100], al
movzx eax, byte [rsp + 0x100]
test eax, eax
jne 0x1800069c1
lea rax, [0x180072fea]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx eax, byte [rax]
mov byte [rsp + 0x101], al
movzx eax, byte [rsp + 0x101]
test eax, eax
jne 0x1800069c1
lea rax, [0x180072fec]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
movzx eax, byte [rax]
mov byte [rsp + 0x102], al
movzx eax, byte [rsp + 0x102]
test eax, eax
je 0x180006896
lea rcx, [0x180072feb]
call fcn.180007480
movzx eax, al
test eax, eax
jne 0x18000682c
jmp 0x180006817
lea rcx, [0x180072fe8]
call fcn.180007480
movzx eax, al
test eax, eax
jne 0x180006841
jmp 0x18000682c
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x180072ff0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0x1f4
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitThread]
lea rax, [0x180073030]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax]
mov dword [rsp + 0x110], eax
mov ecx, dword [rsp + 0x110]
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 1
test eax, eax
jne 0x1800068dd
mov dword [rsp + 0x38], 1
jmp 0x1800068e5
mov dword [rsp + 0x38], 0
lea rax, [0x180071814]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0xa0]
movzx eax, byte [rax]
mov byte [rsp + 0x103], al
movzx eax, byte [rsp + 0x103]
cmp dword [rsp + 0x38], eax
je 0x1800069bc
lea rax, [0x180071814]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
movzx eax, byte [rax]
mov byte [rsp + 0x104], al
movzx eax, byte [rsp + 0x104]
test eax, eax
jne 0x18000695c
mov byte [rsp + 0x30], 1
jmp 0x180006961
mov byte [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x108], al
lea rax, [0x180071814]
mov rcx, rax
call fcn.180006f70
mov qword [rsp + 0xb0], rax
lea rcx, [rsp + 0x108]
call fcn.18000a420
mov byte [rsp + 0x36], al
movzx eax, byte [rsp + 0x36]
mov rcx, qword [rsp + 0xb0]
xchg byte [rcx], al
xor r9d, r9d
xor r8d, r8d
mov edx, 5
mov rcx, qword [0x180072ff8]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x180006782
mov dword [rsp + 0x3c], 0x3e8
movsxd rax, dword [rsp + 0x3c]
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0xb8]
call fcn.180009040
jmp 0x1800065bc
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.18000f250
add rsp, 0x128
ret