Function at 0x18009cb88
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x5a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x102
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x5c8]
mov rax, qword [0x180203940]
xor rax, rbp
mov qword [rbp + 0x570], rax
lea rcx, [0x18025f83e]
call fcn.180136f34
mov byte [0x18020f05e], 1
mov byte [0x18020f300], 1
mov eax, dword [0x18020f2f8]
mov dword [0x18020f2fc], eax
xor edx, edx
mov ecx, dword [0x18020f2fc]
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shl eax, 0x10
mov r8d, 0x100
lea rdx, [rbp + 0x30]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
test eax, eax
je 0x18009cd5a
lea rax, [rbp + 0x348]
mov qword [rbp + 0x388], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x388]
call fcn.18000e08c
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x560]
mov qword [rbp + 0x568], rax
mov rdx, qword [rbp + 0x568]
mov rcx, qword [0x18020f120]
call fcn.1800bfba4
mov rax, qword [0x18020f120]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x558], rax
xor edx, edx
mov rcx, qword [rbp + 0x558]
call fcn.1800bf664
lea rax, [rbp + 0x3a8]
mov qword [rbp + 0x3e8], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x3e8]
call fcn.18000e08c
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x560]
mov qword [rbp + 0x568], rax
mov rdx, qword [rbp + 0x568]
mov rcx, qword [0x18020f120]
call fcn.1800bfba4
mov rax, qword [0x18020f120]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x558], rax
mov dl, 1
mov rcx, qword [rbp + 0x558]
call fcn.1800bf664
lea rax, [rbp + 0x408]
mov qword [rbp + 0x448], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x448]
call fcn.18000e08c
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x560]
mov qword [rbp + 0x568], rax
mov rdx, qword [rbp + 0x568]
mov rcx, qword [0x18020f120]
call fcn.1800bfba4
jmp 0x18009cdc8
lea rax, [rbp + 0x468]
mov qword [rbp + 0x4a8], rax
lea rdx, [0x18015b098]
lea rcx, [rbp + 0x4c4]
call fcn.18008e310
mov rcx, rax
call fcn.1800db6fc
mov rdx, rax
mov rcx, qword [rbp + 0x4a8]
call fcn.18000e08c
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x560]
mov qword [rbp + 0x568], rax
mov rdx, qword [rbp + 0x568]
mov rcx, qword [0x18020f120]
call fcn.1800bfba4
mov rax, qword [0x18020f128]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x558], rax
mov dl, 1
mov rcx, qword [rbp + 0x558]
call fcn.1800bf664
mov rax, qword [0x18020f120]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x558], rax
mov dl, 1
mov rcx, qword [rbp + 0x558]
call fcn.1800bf664
lea rax, [rbp + 0x4e8]
mov qword [rbp + 0x528], rax
lea rdx, str.Confirm
lea rcx, [rbp + 0x548]
call fcn.18008de90
mov rcx, rax
call fcn.1800db4dc
mov rdx, rax
mov rcx, qword [rbp + 0x528]
call fcn.18000e08c
mov qword [rbp + 0x558], rax
mov rax, qword [rbp + 0x558]
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x560]
mov qword [rbp + 0x568], rax
mov rdx, qword [rbp + 0x568]
mov rcx, qword [0x18020f128]
call fcn.1800bfba4
mov rax, qword [0x18020f2e0]
add rax, 8
mov qword [rbp + 0x148], rax
mov rcx, qword [rbp + 0x148]
call fcn.18009249c
mov qword [rbp + 0x168], rax
mov rcx, qword [rbp + 0x148]
call fcn.1800d77d8
mov qword [rbp + 0x188], rax
jmp 0x18009cec2
mov rax, qword [rbp + 0x168]
add rax, 8
mov qword [rbp + 0x168], rax
mov rax, qword [rbp + 0x188]
cmp qword [rbp + 0x168], rax
je 0x18009cf1d
mov rax, qword [rbp + 0x168]
mov rax, qword [rax]
mov qword [rbp + 0x1a8], rax
cmp qword [rbp + 0x1a8], 0
je 0x18009cf1b
mov rax, qword [rbp + 0x1a8]
cmp qword [rax + 0x50], 0
je 0x18009cf1b
mov rax, qword [rbp + 0x1a8]
mov rax, qword [rax + 0x50]
mov qword [rbp + 0x558], rax
xor edx, edx
mov rcx, qword [rbp + 0x558]
call fcn.1800bf664
jmp 0x18009ceb0
lea rcx, [rbp - 0x20]
lea rdx, reloc.WS2_32.dll_accept
call fcn.180136ec0
mov rcx, qword [rbp + 0x570]
xor rcx, rbp
call fcn.180137000
lea rsp, [rbp + 0x588]
pop rdi
pop rbp
ret