Function at 0x180002b00
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x180009040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
call fcn.180002520
mov r13d, eax
mov edx, 0x96
mov ecx, 0x1b8
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rbp - 0x11], 0x32
lea rcx, [rbp - 0x11]
call fcn.1800042d0
mov edx, 0x96
mov ecx, 0x20b
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rbp - 0x11], 0x32
lea rcx, [rbp - 0x11]
call fcn.1800042d0
mov edx, 0x96
mov ecx, 0x294
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rbp - 0x11], 0x32
lea rcx, [rbp - 0x11]
call fcn.1800042d0
mov edx, 0x96
mov ecx, 0x310
call qword [sym.imp.KERNEL32.dll_Beep]
mov qword [rbp - 0x11], 0x32
lea rcx, [rbp - 0x11]
call fcn.1800042d0
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x180002eec
xor r15d, r15d
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, r13d
test ax, ax
jns 0x180002d66
call fcn.180002360
mov r12, rax
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
mov qword [rbp - 0x39], 8
mov dword [rbp - 0x31], 8
mov dword [rbp - 0x2d], 0x624
movdqu xmmword [rbp - 9], xmm0
mov ecx, 0x10
call fcn.180004a94
mov rsi, rax
mov qword [rbp - 9], rax
lea rdi, [rax + 0x10]
mov qword [rbp + 7], rdi
mov r8d, 0x10
lea rdx, [rbp - 0x39]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 1], rdi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf], xmm0
mov qword [rbp + 0x1f], r15
mov r15, rdi
sub r15, rsi
mov rbx, r15
sar rbx, 2
test rbx, rbx
je 0x180002cef
movabs rax, 0x3fffffffffffffff
cmp rbx, rax
ja 0x180002f41
lea rbx, [rbx*4]
test rbx, rbx
jne 0x180002c95
xor eax, eax
jmp 0x180002cd2
cmp rbx, 0x1000
jb 0x180002cca
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x180002f3b
call fcn.180004a94
mov rcx, rax
test rax, rax
je 0x180002f19
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180002cd2
mov rcx, rbx
call fcn.180004a94
mov qword [rbp + 0xf], rax
add rbx, rax
mov qword [rbp + 0x1f], rbx
mov r8, r15
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x17], rbx
lea r8, [rbp + 0xf]
lea rdx, [r12 + 0x2084910]
mov rcx, r14
call fcn.180002410
mov dword [rbp + 0x27], 0x20
xor r15d, r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x27]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x180002ed9
sub rdi, rsi
and rdi, 0xfffffffffffffffc
mov rax, rsi
cmp rdi, 0x1000
jb 0x180002d5e
add rdi, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002f20
mov rdx, rdi
jmp 0x180002ed1
call fcn.180002360
mov r12, rax
mov r8d, r13d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
xorps xmm0, xmm0
mov qword [rbp - 0x29], 8
mov dword [rbp - 0x21], 8
mov dword [rbp - 0x1d], 0x624
movdqu xmmword [rbp + 0xf], xmm0
mov ecx, 0x10
call fcn.180004a94
mov rsi, rax
mov qword [rbp + 0xf], rax
lea rbx, [rax + 0x10]
mov qword [rbp + 0x1f], rbx
mov r8d, 0x10
lea rdx, [rbp - 0x29]
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0x17], rbx
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r15
mov r15, rbx
sub r15, rsi
mov rdi, r15
sar rdi, 2
test rdi, rdi
je 0x180002e6a
movabs rax, 0x3fffffffffffffff
cmp rdi, rax
ja 0x180002f35
lea rdi, [rdi*4]
test rdi, rdi
jne 0x180002e10
xor eax, eax
jmp 0x180002e4d
cmp rdi, 0x1000
jb 0x180002e45
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x180002f47
call fcn.180004a94
mov rcx, rax
test rax, rax
je 0x180002f27
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180002e4d
mov rcx, rdi
call fcn.180004a94
mov qword [rbp - 9], rax
add rdi, rax
mov qword [rbp + 7], rdi
mov r8, r15
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp - 1], rdi
lea r8, [rbp - 9]
lea rdx, [r12 + 0x2084910]
mov rcx, r14
call fcn.180002410
xor r15d, r15d
mov dword [rbp - 0x11], r15d
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x11]
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
test rsi, rsi
je 0x180002ed9
sub rbx, rsi
and rbx, 0xfffffffffffffffc
mov rax, rsi
cmp rbx, 0x1000
jb 0x180002ece
add rbx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180002f2e
mov rdx, rbx
mov rcx, rsi
call fcn.180004a60
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x180002bd4
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.180004a40
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.180004870
nop
call fcn.180001a20
int3
call fcn.180004870
nop
call fcn.180001a20
int3