Function at 0x18000e520
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x34], 0
mov rcx, qword [rsp + 0x60]
call fcn.18000ec00
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x18000e5df
mov rax, qword [rsp + 0x60]
movzx eax, byte [rax + 0x10]
test eax, eax
je 0x18000e572
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x10], 0
mov rax, qword [rsp + 0x60]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.18000c280
mov rax, qword [rsp + 0x60]
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.1800066f0
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1800057b0
movzx eax, al
test eax, eax
je 0x18000e5df
lea rcx, [rsp + 0x38]
call fcn.18000c370
add rax, 8
mov rdx, rax
mov rcx, qword [rsp + 0x68]
call fcn.1800032b0
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0x30
jl 0x18000e65d
cmp dword [rsp + 0x70], 0x39
jg 0x18000e65d
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xff00
mov word [rsp + 0x20], ax
movsx eax, word [rsp + 0x20]
test eax, eax
jne 0x18000e634
mov eax, dword [rsp + 0x70]
movzx edx, al
mov rcx, qword [rsp + 0x68]
call fcn.18000e410
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.18000e8a0
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0x41
jl 0x18000e700
cmp dword [rsp + 0x70], 0x5a
jg 0x18000e700
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xff00
mov word [rsp + 0x24], ax
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0xff00
mov word [rsp + 0x28], ax
movsx eax, word [rsp + 0x24]
test eax, eax
jne 0x18000e6b1
movsx eax, word [rsp + 0x28]
test eax, eax
je 0x18000e6d7
lea rdx, [0x18010e87c]
mov rcx, qword [rsp + 0x68]
call fcn.180003320
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.18000e8a0
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0x60
jl 0x18000e73c
cmp dword [rsp + 0x70], 0x69
jg 0x18000e73c
mov eax, dword [rsp + 0x70]
sub eax, 0x30
movzx edx, al
mov rcx, qword [rsp + 0x68]
call fcn.18000e410
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0x6a
jl 0x18000e782
cmp dword [rsp + 0x70], 0x6f
jg 0x18000e782
mov eax, dword [rsp + 0x70]
sub eax, 0x6a
cdqe
lea rcx, str.__._
movzx edx, byte [rcx + rax]
mov rcx, qword [rsp + 0x68]
call fcn.18000e410
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0x70
jl 0x18000e7c8
cmp dword [rsp + 0x70], 0x87
jg 0x18000e7c8
mov eax, dword [rsp + 0x70]
sub eax, 0x6f
mov r8d, eax
lea rdx, [0x1801102c8]
mov rcx, qword [rsp + 0x68]
call fcn.180010870
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0xba
jl 0x18000e807
cmp dword [rsp + 0x70], 0xc0
jg 0x18000e807
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.18000e8a0
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0xdb
jl 0x18000e843
cmp dword [rsp + 0x70], 0xdf
jg 0x18000e843
mov r8d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call fcn.18000e8a0
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
cmp dword [rsp + 0x70], 0x20
jne 0x18000e86d
lea rdx, [0x18010e904]
mov rcx, qword [rsp + 0x68]
call fcn.180003320
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
jmp 0x18000e88e
lea rdx, [0x18010e92c]
mov rcx, qword [rsp + 0x68]
call fcn.180003320
mov eax, dword [rsp + 0x2c]
or eax, 1
mov dword [rsp + 0x2c], eax
mov rax, qword [rsp + 0x68]
add rsp, 0x58
ret