Function at 0x18002dcf0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18029b200]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov r15, rcx
call fcn.18000cf90
test rax, rax
je case.0x18002df6d.527
call fcn.18000d2e0
mov rsi, rax
call fcn.18000cf90
test rax, rax
je 0x18002dd48
call fcn.18000d2e0
mov r14, qword [rax + 0xe0]
jmp 0x18002dd4b
xor r14d, r14d
cmp ebp, 0x200
ja 0x18002df43
je 0x18002df01
lea eax, [rbp - 7]
cmp eax, 0xfe
ja case.0x18002df6d.527
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x2e0e8]
mov ecx, dword [rdx + rax*4 + 0x2e0d4]
add rcx, rdx
jmp rcx
lea eax, [rbp - 0x100]
test eax, 0xfffffffb
sete al
cmp rdi, 0x100
jae 0x18002dda4
mov byte [rdi + rsi + 0x13c], al
cmp rdi, 0x11
jne 0x18002ddfb
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0xa3
and al, 1
mov byte [rsi + 0x1de], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rsi + 0x1de], 0
mov byte [rsi + 0x1df], al
jne 0x18002ddee
test al, al
jne 0x18002ddee
mov byte [rsi + 0x138], al
jmp case.0x18002df6d.527
mov al, 1
mov byte [rsi + 0x138], al
jmp case.0x18002df6d.527
cmp rdi, 0x10
jne 0x18002de52
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0xa1
and al, 1
mov byte [rsi + 0x1dc], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rsi + 0x1dc], 0
mov byte [rsi + 0x1dd], al
jne 0x18002de45
test al, al
jne 0x18002de45
mov byte [rsi + 0x139], al
jmp case.0x18002df6d.527
mov al, 1
mov byte [rsi + 0x139], al
jmp case.0x18002df6d.527
cmp rdi, 0x12
jne case.0x18002df6d.527
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0xa5
and al, 1
mov byte [rsi + 0x1e0], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
cmp byte [rsi + 0x1e0], 0
mov byte [rsi + 0x1e1], al
jne 0x18002dea0
test al, al
jne 0x18002dea0
mov byte [rsi + 0x13a], al
jmp case.0x18002df6d.527
mov al, 1
mov byte [rsi + 0x13a], al
jmp case.0x18002df6d.527
cmp ebp, 7
mov rcx, rsi
sete dl
call fcn.180005a20
jmp case.0x18002df6d.527
lea rax, [rdi - 1]
cmp rax, 0xfffe
ja case.0x18002df6d.527
movzx edx, di
mov rcx, rsi
call fcn.180005a30
jmp case.0x18002df6d.527
cmp bx, 1
jne case.0x18002df6d.527
call fcn.18002db70
test al, al
je case.0x18002df6d.527
mov eax, 1
jmp 0x18002e0b1
cmp byte [r14 + 0x10], 0
mov qword [r14 + 8], r15
jne case.0x18002df6d.527
mov ebx, 2
mov dword [rsp + 0x20], Ordinal_30
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x24], ebx
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x30], 0
call qword [sym.imp.USER32.dll_TrackMouseEvent]
mov byte [r14 + 0x10], 1
jmp case.0x18002df6d.527
lea eax, [rbp - 0x201]
cmp eax, 0xa2
ja case.0x18002df6d.527
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x2e204]
mov ecx, dword [rdx + rax*4 + 0x2e1e8]
add rcx, rdx
jmp rcx
cmp qword [r14 + 8], r15
jne 0x18002df7d
mov qword [r14 + 8], 0
mov byte [r14 + 0x10], 0
jmp case.0x18002df6d.527
cmp ebp, 0x204
je 0x18002df99
xor ebx, ebx
cmp ebp, 0x206
jne 0x18002df9e
mov ebx, 1
cmp ebp, 0x207
je 0x18002dfae
cmp ebp, 0x209
jne 0x18002dfb3
mov ebx, 2
cmp ebp, 0x20b
je 0x18002dfc3
cmp ebp, 0x20d
jne 0x18002dfd4
xor ebx, ebx
shr rdi, 0x10
cmp di, 1
setne bl
add rbx, 3
call fcn.18000ec60
test al, al
jne 0x18002dff1
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x18002dff1
mov rcx, r15
call qword [sym.imp.USER32.dll_SetCapture]
mov byte [rbx + rsi + 0x128], 1
jmp case.0x18002df6d.527
xor ebx, ebx
cmp ebp, 0x205
sete bl
cmp ebp, 0x208
jne 0x18002e018
mov ebx, 2
jmp 0x18002e031
cmp ebp, 0x20c
jne 0x18002e031
xor ebx, ebx
shr rdi, 0x10
cmp di, 1
setne bl
add rbx, 3
mov byte [rbx + rsi + 0x128], 0
call fcn.18000ec60
test al, al
jne case.0x18002df6d.527
call qword [sym.imp.USER32.dll_GetCapture]
cmp rax, r15
jne case.0x18002df6d.527
call qword [sym.imp.USER32.dll_ReleaseCapture]
jmp case.0x18002df6d.527
shr rdi, 0x10
movsx eax, di
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x180127c90]
addss xmm0, dword [rsi + 0x130]
movss dword [rsi + 0x130], xmm0
jmp case.0x18002df6d.527
shr rdi, 0x10
movsx eax, di
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm0, dword [0x180127c90]
addss xmm0, dword [rsi + 0x134]
movss dword [rsi + 0x134], xmm0
jmp case.0x18002df6d.527
cmp edi, 7
jne case.0x18002df6d.527
mov byte [r14 + 0x2d], 1
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18011eca0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret