Function at 0x1800a8060
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x150
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r15, r9
mov rdi, r8
mov r12, rdx
mov r14, rcx
mov rsi, qword [rsp + 0x1b0]
mov rax, qword [0x18027b380]
test rax, rax
jne 0x1800a80cf
lea ecx, [rax + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a80c8
mov rcx, rax
call fcn.1800a07f0
nop
mov qword [0x18027b380], rax
mov dword [rax + 0x38], 0
mov rcx, r12
call fcn.1800abdd0
call fcn.18009ccd0
mov rbx, rax
lea rcx, [r14 - 0x18]
mov qword [rax + 0x20], rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x28], eax
mov dword [rbx + 0x18], 6
mov rax, qword [0x18027b390]
test rax, rax
jne 0x1800a812e
mov ecx, pe_nt_image_headers64
call fcn.1800b543c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a8127
mov rcx, rax
call fcn.1800b0b90
nop
mov qword [0x18027b390], rax
cmp byte [rax + 0x111], 0
je 0x1800a829d
mov rcx, qword [0x180278788]
test rcx, rcx
jne 0x1800a816e
mov ecx, 8
call fcn.1800b543c
mov rcx, rax
test rax, rax
je 0x1800a8165
lea rax, vtable.CShareConfigManager.0
mov qword [rcx], rax
jmp 0x1800a8167
xor ecx, ecx
mov qword [0x180278788], rcx
mov rax, qword [rcx]
mov edx, 0xe4
call qword [rax]
cmp al, 1
je 0x1800a829d
mov byte [rsp + 0x40], 0
xor edx, edx
mov r8d, 0xff
lea rcx, [rsp + 0x41]
call fcn.1800be330
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov rax, qword [0x18027b380]
test rax, rax
jne 0x1800a81d0
lea ecx, [rax + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a81c9
mov rcx, rax
call fcn.1800a07f0
nop
mov qword [0x18027b380], rax
mov r8, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, r8
movabs rbp, 0x2aaaaaaaaaaaaaab
mov rax, rbp
imul rcx
sar rdx, 1
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800a825e
cmp dword [r8], edi
jne 0x1800a825e
cmp dword [r8 + 4], 3
jne 0x1800a825e
call fcn.18009cd40
mov rbx, rax
mov rcx, rax
call fcn.1800a0cc0
test eax, eax
je 0x1800a827f
mov r8, qword [rbx]
mov rcx, qword [rbx + 8]
sub rcx, r8
mov rax, rbp
imul rcx
sar rdx, 1
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800a827f
cmp dword [r8], edi
jne 0x1800a827f
cmp dword [r8 + 4], 3
jne 0x1800a827f
cmp dword [r8 + 8], 0
jne 0x1800a827f
mov dword [rsi], 0
call fcn.18009cd40
xor r9d, r9d
jmp 0x1800a83c4
call fcn.18009eca0
mov rcx, rax
lea r9, [rsp + 0x40]
mov r8, r15
mov edx, edi
call fcn.1800b1500
mov dword [rsi], eax
test eax, eax
je 0x1800a83d4
call fcn.18009eca0
mov rcx, rax
lea r9, [rsp + 0x40]
mov r8d, r15d
mov edx, edi
call fcn.1800b16a0
mov dword [rsi], eax
jmp 0x1800a83d4
mov r9, qword [0x18027b380]
test r9, r9
jne 0x1800a82d3
lea ecx, [r9 + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a82c9
mov rcx, rax
call fcn.1800a07f0
mov r9, rax
jmp 0x1800a82cc
xor r9d, r9d
mov qword [0x18027b380], r9
mov r8, qword [r9]
mov rcx, qword [r9 + 8]
sub rcx, r8
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 1
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x1800a8348
cmp dword [r8], edi
jne 0x1800a8348
cmp dword [r8 + 4], 3
jne 0x1800a8348
mov r8d, 3
mov edx, edi
mov rcx, r9
call fcn.1800a0d80
test eax, eax
jne 0x1800a838d
mov dword [rsi], eax
mov rax, qword [0x18027b380]
test rax, rax
jne 0x1800a83c1
lea ecx, [rax + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a8346
mov rcx, rax
call fcn.1800a07f0
nop
jmp 0x1800a83ba
mov rax, qword [r14]
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, rdi
mov rdx, r12
mov rcx, r14
call qword [rax + 0x28]
cmp dword [rsi], 0
jne 0x1800a838d
mov rax, qword [0x18027b380]
test rax, rax
jne 0x1800a83c1
lea ecx, [rax + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a838b
mov rcx, rax
call fcn.1800a07f0
nop
jmp 0x1800a83ba
mov dword [rsi], 1
mov rax, qword [0x18027b380]
test rax, rax
jne 0x1800a83c1
lea ecx, [rax + 0x40]
call fcn.1800b543c
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a83ba
mov rcx, rax
call fcn.1800a07f0
nop
mov qword [0x18027b380], rax
mov r9d, dword [rsi]
mov r8d, 4
mov edx, edi
mov rcx, rax
call fcn.1800a0bc0
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800b5370
add rsp, 0x150
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret