Function at 0x180002290
Capabilities:
Log keystrokes via polling
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov ecx, 0x31
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edi, edi
test ax, ax
mov ebx, edi
setne bl
lea ecx, [rdi + 0x12]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, edi
lea rsi, [0x180011138]
test ax, ax
setne cl
test ebx, ecx
je 0x180002339
cmp byte [0x180011081], dil
lea ecx, [rdi + 9]
jne 0x1800022f1
call fcn.180001ef0
mov byte [0x180011081], 1
mov byte [0x1800119d4], 0x80
jmp 0x180002304
call fcn.180001ef0
mov byte [0x180011081], dil
mov byte [0x1800119d4], 0x81
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, 0x32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov ecx, edi
setne cl
test ebx, ecx
je 0x180002402
mov eax, dword [0x18001108c]
cmp eax, 3
je 0x1800023b2
cmp eax, 1
jne 0x180002392
lea ecx, [rax + 8]
call fcn.180001ef0
mov dword [0x18001108c], 2
mov byte [0x1800119d4], 0x83
jmp 0x1800023cd
cmp eax, 2
jne 0x1800023b2
lea ecx, [rax + 7]
call fcn.180001ef0
mov dword [0x18001108c], 3
mov byte [0x1800119d4], 0xa3
jmp 0x1800023cd
mov ecx, 9
call fcn.180001ef0
mov dword [0x18001108c], 1
mov byte [0x1800119d4], 0x82
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, 0x33
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov ecx, edi
setne cl
test ebx, ecx
je 0x180002497
cmp byte [0x180011084], dil
mov ecx, 9
jne 0x18000244f
call fcn.180001ef0
mov byte [0x180011084], 1
mov byte [0x1800119d4], 0x84
jmp 0x180002462
call fcn.180001ef0
mov byte [0x180011084], dil
mov byte [0x1800119d4], 0x85
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov ecx, edi
setne cl
test ebx, ecx
je 0x18000257e
mov eax, dword [0x180011948]
cmp eax, 3
jne 0x1800024eb
lea ecx, [rax + 6]
call fcn.180001ef0
mov dword [0x180011948], 4
mov byte [0x1800119d4], 0x8b
jmp 0x180002549
cmp eax, 4
jne 0x18000250b
lea ecx, [rax + 5]
call fcn.180001ef0
mov dword [0x180011948], 5
mov byte [0x1800119d4], 0x8c
jmp 0x180002549
cmp eax, 5
jne 0x18000252b
lea ecx, [rax + 4]
call fcn.180001ef0
mov dword [0x180011948], 6
mov byte [0x1800119d4], 0x8d
jmp 0x180002549
cmp eax, 6
jne 0x18000257e
lea ecx, [rax + 3]
call fcn.180001ef0
mov dword [0x180011948], 7
mov byte [0x1800119d4], 0x8e
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov ecx, edi
setne cl
test ebx, ecx
je 0x180002665
mov eax, dword [0x180011948]
cmp eax, 7
jne 0x1800025d2
lea ecx, [rax + 2]
call fcn.180001ef0
mov dword [0x180011948], 6
mov byte [0x1800119d4], 0x8d
jmp 0x180002630
cmp eax, 6
jne 0x1800025f2
lea ecx, [rax + 3]
call fcn.180001ef0
mov dword [0x180011948], 5
mov byte [0x1800119d4], 0x8c
jmp 0x180002630
cmp eax, 5
jne 0x180002612
lea ecx, [rax + 4]
call fcn.180001ef0
mov dword [0x180011948], 4
mov byte [0x1800119d4], 0x8b
jmp 0x180002630
cmp eax, 4
jne 0x180002665
lea ecx, [rax + 5]
call fcn.180001ef0
mov dword [0x180011948], 3
mov byte [0x1800119d4], 0x8a
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov ecx, edi
setne cl
test ebx, ecx
je 0x180002694
call fcn.180001fb0
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov ecx, edi
setne cl
test ebx, ecx
je 0x1800026c3
call fcn.180002120
mov ecx, 0x34
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov ecx, edi
setne cl
test ebx, ecx
je 0x18000274e
cmp byte [0x180011080], dil
sete al
mov byte [0x180011080], al
cmp al, 1
jne 0x18000274e
mov ecx, 9
call fcn.180001ef0
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov byte [0x180011080], 1
mov dword [0x1800119d0], 0x101ff00
mov byte [0x1800119d4], 0x8f
mov qword [rsp + 0x20], rsi
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov ecx, 0x35
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, edi
mov ecx, send
test ax, ax
setne bl
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne dil
test ebx, edi
je 0x1800027ed
cmp byte [0x180011083], 0
mov ecx, 9
sete al
mov byte [0x180011083], al
cmp al, 1
jne 0x1800027a5
call fcn.180001ef0
mov byte [0x180011083], 1
mov byte [0x1800119d4], 0x91
jmp 0x1800027b8
call fcn.180001ef0
mov byte [0x180011083], 0
mov byte [0x1800119d4], 0x92
mov rcx, qword [0x1800110a8]
lea rdx, [0x1800119d0]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov dword [0x1800119d0], 0x101ff00
lea r8d, [r9 + 0x17]
call qword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret