Function at 0x180008280
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x68
cmp byte [0x1800cb025], 0
je 0x180008579
mov rax, qword [0x1800cb218]
lea rdx, [0x1800c9b98]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x1800cb168]
add rcx, qword [rax + 8]
call fcn.1800085c0
mov rcx, qword [0x1800c9b98]
lea rdx, [0x1800c9ba4]
add rcx, 0x15a4
call fcn.180008660
mov r8d, dword [0x1800c9ba4]
cmp r8d, 0xffffffff
je 0x180008579
mov rax, qword [0x1800cb140]
mov edx, r8d
mov qword [rsp + 0x78], rbx
shr edx, 9
and edx, 0x3f
mov qword [rsp + 0x80], rsi
mov rbx, qword [rax + 0x108]
movabs rsi, 0x7ffd5d15ff558
add rbx, 0x10
shl edx, 3
mov qword [rsp + 0x60], rdi
add rbx, rdx
je 0x180008378
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x180008378
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180008371
cmp dword [rsp + 0x50], 0x1000
jne 0x180008371
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x180008371
test al, 0x66
je 0x180008371
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x180008371
mov rbx, qword [rbx]
mov r8d, dword [0x1800c9ba4]
and r8d, 0x1ff
imul ecx, r8d, 0x78
add rbx, rcx
je 0x1800083dc
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x1800083dc
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800083dc
cmp dword [rsp + 0x50], 0x1000
jne 0x1800083dc
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x1800083dc
test al, 0x66
je 0x1800083dc
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x1800083dc
mov rbx, qword [rbx]
mov rax, qword [0x1800cb218]
mov edi, dword [rax + 0x38]
add rdi, rbx
je 0x180008440
lea rax, [rdi - 0xaa70aa8]
cmp rax, rsi
ja 0x180008440
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x180008440
cmp dword [rsp + 0x50], 0x1000
jne 0x180008440
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x180008440
test al, 0x66
je 0x180008440
mov rax, qword [rsp + 0x30]
sub rax, rdi
add rax, qword [rsp + 0x48]
cmp rax, 4
jb 0x180008440
mov edi, dword [rdi]
jmp 0x180008444
mov edi, dword [rsp + 0x70]
mov rax, qword [0x1800cb218]
mov ecx, dword [rax + 0x28]
add rbx, rcx
je 0x1800084a8
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x1800084a8
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1800084a8
cmp dword [rsp + 0x50], 0x1000
jne 0x1800084a8
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x1800084a8
test al, 0x66
je 0x1800084a8
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 4
jb 0x1800084a8
mov eax, dword [rbx]
jmp 0x1800084ac
mov eax, dword [rsp + 0x70]
cmp byte [0x180087ae4], 0
mov rsi, qword [rsp + 0x80]
je 0x1800084c9
cmp dword [0x1800c9ba0], eax
je 0x18000856f
test edi, edi
jle 0x18000856f
mov ecx, dword [0x1800ca410]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x1800cb370], eax
jg 0x18000857e
lea rcx, [rsp + 0x70]
call fcn.1800081a0
cvttss2si rax, dword [0x180087ae0]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
sub rcx, qword [0x1800cb368]
imul rax, rax, 0xf4240
cmp rcx, rax
jl 0x18000856f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x180008568
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [0x1800cb368], rbx
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rcx, [0x1800cb370]
call fcn.18004465c
cmp dword [0x1800cb370], 0xffffffff
jne 0x1800084f8
lea rcx, [0x1800cb368]
call fcn.1800081a0
lea rcx, [0x1800cb370]
call fcn.1800445f0
jmp 0x1800084f8