Function at 0x180002aa0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, [0x18003e9a4]
nop dword [rax]
mov ecx, 0x1b
mov qword [0x18004a0f0], rbx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180002ab0
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000375f
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000374c
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003739
mov ecx, 0x73
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003726
mov ecx, 0x74
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003713
mov ecx, 0x75
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003700
mov ecx, 0x76
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800036ed
mov ecx, 0x77
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800036d7
mov ecx, 0x78
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800036c1
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800036ab
mov ecx, 0x7a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003695
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000367f
mov ecx, 9
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003669
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003653
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000363d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003627
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003611
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800035fb
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800035e5
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800035cf
mov ecx, 0x21
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800035b9
mov ecx, 0x22
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800035a3
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000358d
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003577
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003561
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000354b
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003535
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000351f
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003509
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800034f3
mov ecx, 0x60
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800034dd
mov ecx, 0x61
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800034c7
mov ecx, 0x62
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800034b1
mov ecx, 0x63
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000349b
mov ecx, 0x64
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003485
mov ecx, 0x65
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000346f
mov ecx, 0x66
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003459
mov ecx, 0x67
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003443
mov ecx, 0x68
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000342d
mov ecx, 0x69
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003417
mov ecx, 0x6a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003401
mov ecx, 0x6b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800033eb
mov ecx, 0x6c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800033d5
mov ecx, 0x6d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800033bf
mov ecx, 0x6e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800033a9
mov ecx, 0x6f
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003393
mov ecx, 0x90
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000337d
mov ecx, 0x91
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003367
mov ecx, 0xbb
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003351
mov ecx, 0xbc
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000333b
mov ecx, 0xbd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003325
mov ecx, 0xbe
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000330f
mov ecx, 0x51
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800032f9
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800032e3
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800032cd
mov ecx, 0x52
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800032b7
mov ecx, 0x54
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800032a1
mov ecx, 0x59
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000328b
mov ecx, 0x55
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003275
mov ecx, 0x49
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000325f
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003249
mov ecx, 0x50
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003233
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000321d
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003207
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800031f1
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800031db
mov ecx, 0x47
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800031c5
mov ecx, 0x48
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800031af
mov ecx, 0x4a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003199
mov ecx, 0x4b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003183
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000316d
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003157
mov ecx, 0x58
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003141
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000312b
mov ecx, 0x56
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180003115
mov ecx, 0x42
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800030ff
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x1800030e9
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180002ab0
mov dword [0x18004a0e8], 0x4d
lea rax, [0x18003ebac]
jmp 0x180003770
mov dword [0x18004a0e8], 0x4e
lea rax, [0x18003eba8]
jmp 0x180003770
mov dword [0x18004a0e8], 0x42
lea rax, [0x18003eba4]
jmp 0x180003770
mov dword [0x18004a0e8], 0x56
lea rax, [0x18003eba0]
jmp 0x180003770
mov dword [0x18004a0e8], 0x43
lea rax, [0x18003e7b4]
jmp 0x180003770
mov dword [0x18004a0e8], 0x58
lea rax, [0x18003eb9c]
jmp 0x180003770
mov dword [0x18004a0e8], 0x5a
lea rax, [0x18003eb98]
jmp 0x180003770
mov dword [0x18004a0e8], 0x4c
lea rax, [0x18003eb94]
jmp 0x180003770
mov dword [0x18004a0e8], 0x4b
lea rax, [0x18003eb90]
jmp 0x180003770
mov dword [0x18004a0e8], 0x4a
lea rax, [0x18003eb8c]
jmp 0x180003770
mov dword [0x18004a0e8], 0x48
lea rax, [0x18003eb88]
jmp 0x180003770
mov dword [0x18004a0e8], 0x47
lea rax, [0x18003eb84]
jmp 0x180003770
mov dword [0x18004a0e8], 0x46
lea rax, [0x18003eb80]
jmp 0x180003770
mov dword [0x18004a0e8], 0x44
lea rax, [0x18003eb7c]
jmp 0x180003770
mov dword [0x18004a0e8], 0x53
lea rax, [0x18003eb78]
jmp 0x180003770
mov dword [0x18004a0e8], 0x41
lea rax, [0x18003eb74]
jmp 0x180003770
mov dword [0x18004a0e8], 0x50
lea rax, [0x18003eb70]
jmp 0x180003770
mov dword [0x18004a0e8], 0x4f
lea rax, [0x18003eb6c]
jmp 0x180003770
mov dword [0x18004a0e8], 0x49
lea rax, [0x18003eb68]
jmp 0x180003770
mov dword [0x18004a0e8], 0x55
lea rax, [0x18003eb64]
jmp 0x180003770
mov dword [0x18004a0e8], 0x59
lea rax, [0x18003eb60]
jmp 0x180003770
mov dword [0x18004a0e8], 0x54
lea rax, [0x18003eb5c]
jmp 0x180003770
mov dword [0x18004a0e8], 0x52
lea rax, [0x18003eb58]
jmp 0x180003770
mov dword [0x18004a0e8], 0x45
lea rax, [0x18003eb54]
jmp 0x180003770
mov dword [0x18004a0e8], 0x57
lea rax, [0x18003eb50]
jmp 0x180003770
mov dword [0x18004a0e8], 0x51
lea rax, str.QWERTYUIOPASDFGHJKLZXVBNM_
jmp 0x180003770
mov dword [0x18004a0e8], 0xbe
lea rax, [0x18003eb48]
jmp 0x180003770
mov dword [0x18004a0e8], 0xbd
lea rax, [0x18003eb44]
jmp 0x180003770
mov dword [0x18004a0e8], 0xbc
lea rax, [0x18003eb40]
jmp 0x180003770
mov dword [0x18004a0e8], 0xbb
lea rax, [0x18003eb3c]
jmp 0x180003770
mov dword [0x18004a0e8], 0x91
lea rax, str.SCROLL_LOCK
jmp 0x180003770
mov dword [0x18004a0e8], 0x90
lea rax, str.NUM_LOCK
jmp 0x180003770
mov dword [0x18004a0e8], 0x6f
lea rax, str.DIVIDE
jmp 0x180003770
mov dword [0x18004a0e8], 0x6e
lea rax, str.DECIMAL
jmp 0x180003770
mov dword [0x18004a0e8], 0x6d
lea rax, str.SUBTRACT
jmp 0x180003770
mov dword [0x18004a0e8], 0x6c
lea rax, str.SEPARATOR
jmp 0x180003770
mov dword [0x18004a0e8], 0x6b
lea rax, [0x18003eaec]
jmp 0x180003770
mov dword [0x18004a0e8], 0x6a
lea rax, str.MULTIPLY
jmp 0x180003770
mov dword [0x18004a0e8], 0x69
lea rax, str.NUMPAD9
jmp 0x180003770
mov dword [0x18004a0e8], 0x68
lea rax, str.NUMPAD8
jmp 0x180003770
mov dword [0x18004a0e8], 0x67
lea rax, str.NUMPAD7
jmp 0x180003770
mov dword [0x18004a0e8], 0x66
lea rax, str.NUMPAD6
jmp 0x180003770
mov dword [0x18004a0e8], 0x65
lea rax, str.NUMPAD5
jmp 0x180003770
mov dword [0x18004a0e8], 0x64
lea rax, str.NUMPAD4
jmp 0x180003770
mov dword [0x18004a0e8], 0x63
lea rax, str.NUMPAD3
jmp 0x180003770
mov dword [0x18004a0e8], 0x62
lea rax, str.NUMPAD2
jmp 0x180003770
mov dword [0x18004a0e8], 0x61
lea rax, str.NUMPAD1
jmp 0x180003770
mov dword [0x18004a0e8], 0x60
lea rax, str.NUMPAD0
jmp 0x180003770
mov dword [0x18004a0e8], 0x2e
lea rax, str.DELETE
jmp 0x180003770
mov dword [0x18004a0e8], 0x2d
lea rax, str.INSERT
jmp 0x180003770
mov dword [0x18004a0e8], 0x28
lea rax, str.DOWN_ARROW
jmp 0x180003770
mov dword [0x18004a0e8], 0x27
lea rax, str.RIGHT_ARROW
jmp 0x180003770
mov dword [0x18004a0e8], 0x26
lea rax, str.UP_ARROW
jmp 0x180003770
mov dword [0x18004a0e8], 0x25
lea rax, str.LEFT_ARROW
jmp 0x180003770
mov dword [0x18004a0e8], 0x24
lea rax, str.HOME
jmp 0x180003770
mov dword [0x18004a0e8], 0x23
lea rax, [0x18003ea34]
jmp 0x180003770
mov dword [0x18004a0e8], 0x22
lea rax, str.PAGE_DOWN
jmp 0x180003770
mov dword [0x18004a0e8], 0x21
lea rax, str.PAGE_UP
jmp 0x180003770
mov dword [0x18004a0e8], 0x20
lea rax, str.SPACE
jmp 0x180003770
mov dword [0x18004a0e8], 0xa1
lea rax, str.RIGHT_SHIFT
jmp 0x180003770
mov dword [0x18004a0e8], 0xa3
lea rax, str.RIGHT_CONTROL
jmp 0x180003770
mov dword [0x18004a0e8], 0x12
lea rax, [0x18003e7f0]
jmp 0x180003770
mov dword [0x18004a0e8], 0x11
lea rax, str.CTRL
jmp 0x180003770
mov dword [0x18004a0e8], 0x10
lea rax, str.SHIFT
jmp 0x180003770
mov dword [0x18004a0e8], 0x14
lea rax, str.CAPS
jmp 0x180003770
mov dword [0x18004a0e8], 9
lea rax, [0x18003e9d8]
jmp 0x180003770
mov dword [0x18004a0e8], 0x7b
lea rax, [0x18003e9d4]
jmp 0x180003770
mov dword [0x18004a0e8], 0x7a
lea rax, [0x18003e9d0]
jmp 0x180003770
mov dword [0x18004a0e8], 0x79
lea rax, [0x18003e9cc]
jmp 0x180003770
mov dword [0x18004a0e8], 0x78
lea rax, [0x18003e9c8]
jmp 0x180003770
mov dword [0x18004a0e8], 0x77
lea rax, [0x18003e9c4]
jmp 0x180003770
mov dword [0x18004a0e8], 0x76
lea rax, [0x18003e9c0]
jmp 0x180003770
mov dword [0x18004a0e8], 0x75
lea rax, [0x18003e9bc]
jmp 0x180003770
mov dword [0x18004a0e8], 0x74
lea rax, [0x18003e9b8]
jmp 0x180003770
mov dword [0x18004a0e8], 0x73
lea rax, [0x18003e9b4]
jmp 0x180003770
mov dword [0x18004a0e8], 0x72
lea rax, [0x18003e9b0]
jmp 0x180003770
mov dword [0x18004a0e8], 0x71
lea rax, [0x18003e9ac]
jmp 0x180003770
mov dword [0x18004a0e8], 0x70
lea rax, [0x18003e9a8]
mov ecx, 0xa
mov qword [0x18004a0f0], rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_Sleep]