Function at 0x180018760
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, 0x10
mov ebx, eax
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1800187ad
mov ecx, RegisterTypeLib
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1800187ad
mov ecx, reloc.OLEAUT32.dll_LoadRegTypeLib
call qword [sym.imp.USER32.dll_GetKeyState]
test al, al
js 0x1800187ad
xor eax, eax
jmp 0x1800187af
mov al, 1
mov ecx, 0x10
movzx esi, al
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x8000
test di, ax
jne 0x1800187eb
mov ecx, RegisterTypeLib
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x1800187eb
mov ecx, reloc.OLEAUT32.dll_LoadRegTypeLib
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test di, ax
jne 0x1800187eb
xor edi, edi
jmp 0x1800187ee
mov dil, 1
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
mov r11w, ax
and r11d, 1
test esi, esi
jne 0x180018835
test dil, dil
jne 0x180018835
lea ecx, [rbx - 0x41]
cmp cl, 0x19
ja 0x1800189f7
test r11d, r11d
jne 0x1800189f7
movsx eax, bl
or eax, 0x20
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsx edx, bl
lea eax, [rdx - 0x27]
cmp eax, 0x39
ja case.0x180018861.40
lea r8, sym.SecEditCtlAdv.CMBCEnterprise.x64.dll_nqu__i6_jj.1___V_O0yryMZ5G6q_
cdqe
movzx eax, byte [r8 + rax + 0x18a64]
mov ecx, dword [r8 + rax*4 + 0x18a0c]
add rcx, r8
jmp rcx
mov al, 0x21
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x23
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x24
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x25
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x5e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x26
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x2a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x28
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x29
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x7e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x5f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x2b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x7b
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x7d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x7c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x3a
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x22
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x3c
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x3e
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov al, 0x3f
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
test r11d, r11d
je 0x1800189f7
or edx, 0x20
mov al, dl
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
mov al, bl
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret