Function at 0x1800125d0
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x180021040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rsi, rdx
mov qword [rbp - 0x69], rdx
mov r13, rcx
mov qword [rbp - 0x79], rcx
xor edi, edi
mov r15d, edi
mov dword [rbp - 0x71], edi
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
xor r8d, r8d
lea rdx, [0x18001ca96]
lea rcx, [rbp - 0x49]
call fcn.180005010
nop
mov byte [0x1800215b8], 1
mov r12, 0xffffffffffffffff
mov rbx, r12
inc rbx
cmp byte [rsi + rbx], 0
jne 0x180012644
mov rax, qword [0x1800215b0]
cmp rbx, rax
ja 0x180012687
lea rdi, [0x180021598]
cmp rax, 0xf
cmova rdi, qword [0x180021598]
mov qword [0x1800215a8], rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x180012699
mov r9, rsi
mov rdx, rbx
lea rcx, [0x180021598]
call fcn.180007140
mov ecx, dword [0x180021c4c]
mov rax, qword gs:[0x58]
mov edx, 4
mov r14, qword [rax + rcx*8]
add r14, rdx
mov qword [rbp - 0x79], r14
movabs rcx, 0x44131118d8db3cd
lea rdi, [rbp - 0x49]
cmp qword [rbp - 0x31], 0xf
cmova rdi, qword [rbp - 0x49]
call fcn.1800120c0
mov rbx, rax
mov eax, dword [r14]
cmp dword [0x18002ad5c], eax
jle 0x180012710
lea rcx, [0x18002ad5c]
call fcn.180018d30
cmp dword [0x18002ad5c], 0xffffffff
jne 0x180012710
call fcn.1800051e0
mov qword [0x18002a9f8], rax
lea rcx, [0x18002ad5c]
call fcn.180018cc4
mov eax, dword [r14]
cmp dword [0x18002a9f0], eax
jle 0x180012788
lea rcx, [0x18002a9f0]
call fcn.180018d30
cmp dword [0x18002a9f0], 0xffffffff
jne 0x180012788
xor edx, edx
mov r8d, 0x180
lea rcx, [0x18002a730]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x18002a7f0]
mov qword [0x18002a710], rax
xor r14d, r14d
mov qword [0x18002a718], r14
mov qword [0x18002a720], rax
mov qword [0x18002a728], r14
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x18002a9f0]
call fcn.180018cc4
jmp 0x18001278b
xor r14d, r14d
test rbx, rbx
je 0x180012821
mov qword [0x18002a728], r14
mov dword [0x18002a7f0], r14d
mov qword [0x18002a7f8], rsi
lea rsi, [0x18001ca96]
mov qword [0x18002a800], rsi
mov qword [0x18002a808], rdi
mov qword [0x18002a810], rsi
mov qword [0x18002a818], rsi
mov qword [0x18002a820], rsi
mov dword [0x18002a828], 0x96
mov qword [0x18002a718], 8
mov rax, qword [0x18002a9f8]
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rbx
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rsp + 0x28], r14
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18002a710]
call fcn.180018760
jmp 0x180012830
lea rsi, [0x18001ca96]
nop dword [rax + rax]
movabs rcx, 0x37df360f235a3893
call fcn.180012d70
test eax, eax
jne 0x180012b42
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180012977
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
cmp byte [0x18002a906], 0
jne 0x180012971
test al, al
je 0x180012971
mov byte [0x18002a906], al
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180012908
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rbx, rax
test rax, rax
je 0x180012908
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x180012908
xorps xmm0, xmm0
movups xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], r14
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x1800128c5
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.180005010
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rbp - 9]
movups xmmword [rbp - 0x29], xmm0
movups xmm1, xmmword [rbp + 7]
movups xmmword [rbp - 0x19], xmm1
mov qword [rbp + 0xf], 0xf
mov byte [rbp - 9], 0
jmp 0x180012927
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov qword [rbp - 0x11], r14
xor r8d, r8d
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.180005010
nop
or r15d, 2
mov rdi, qword [rbp - 0x19]
test rdi, rdi
jne 0x180012995
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x180012977
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001296a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012b3b
call fcn.180018c54
jmp 0x180012977
mov byte [0x18002a906], al
call qword [sym.imp.WINMM.dll_timeGetTime]
mov dword [0x1800223f8], eax
mov rcx, qword [0x180023c08]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
jmp 0x180012830
lea r9, [rbp - 0x29]
mov rsi, qword [rbp - 0x29]
mov r14, qword [rbp - 0x11]
cmp r14, 0xf
cmova r9, rsi
mov rax, qword [rbp - 0x31]
cmp rdi, rax
ja 0x1800129d7
lea rbx, [rbp - 0x49]
cmp rax, 0xf
cmova rbx, qword [rbp - 0x49]
mov qword [rbp - 0x39], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
jmp 0x1800129eb
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.180007140
mov r14, qword [rbp - 0x11]
mov rsi, qword [rbp - 0x29]
movabs rcx, 0x58a39be597ce99cd
call fcn.1800120c0
mov rbx, rax
mov rdi, qword [rbp - 0x79]
mov eax, dword [rdi]
cmp dword [0x18002ad68], eax
jle 0x180012a38
lea rcx, [0x18002ad68]
call fcn.180018d30
cmp dword [0x18002ad68], 0xffffffff
jne 0x180012a38
call fcn.1800051e0
mov qword [0x18002a9e0], rax
lea rcx, [0x18002ad68]
call fcn.180018cc4
mov eax, dword [rdi]
cmp dword [0x18002ad58], eax
jle 0x180012aae
lea rcx, [0x18002ad58]
call fcn.180018d30
cmp dword [0x18002ad58], 0xffffffff
jne 0x180012aae
xor edx, edx
mov r8d, 0x180
lea rcx, [0x18002abc0]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x18002ac80]
mov qword [0x18002aba0], rax
xor edi, edi
mov qword [0x18002aba8], rdi
mov qword [0x18002abb0], rax
mov qword [0x18002abb8], rdi
xor edx, edx
mov r8d, 0xc0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x18002ad58]
call fcn.180018cc4
jmp 0x180012ab0
xor edi, edi
test rbx, rbx
je 0x180012afb
mov qword [0x18002aba8], rdi
mov qword [0x18002abb8], rdi
mov rax, qword [0x18002a9e0]
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x59], rbx
xor eax, eax
mov qword [rbp - 0x51], rax
mov qword [rsp + 0x28], rdi
lea rax, [rbp - 0x61]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18002aba0]
call fcn.180018760
nop
cmp r14, 0xf
jbe 0x180012b2e
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180012b26
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012b3b
mov rcx, rsi
call fcn.180018c54
mov rsi, qword [rbp - 0x69]
mov r14, qword [rbp - 0x79]
jmp 0x1800126b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180012370
test rax, rax
jne 0x180012bd4
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r14
mov qword [r13 + 0x18], r14
xor r8d, r8d
mov rdx, rsi
mov rcx, r13
call fcn.180005010
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x180012baa
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180012c43
call fcn.180018c54
mov rax, r13
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1800187b0
mov rbx, qword [rsp + 0x120]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [0x1800215b8], 0
call fcn.180012370
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r14
mov qword [r13 + 0x18], r14
inc r12
cmp byte [rax + r12], 0
jne 0x180012bf0
mov r8, r12
mov rdx, rax
mov rcx, r13
call fcn.180005010
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0xf
jbe 0x180012baa
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180012ba5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180012ba5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3