Function at 0x18002da60
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x148
mov rax, qword [0x180061500]
xor rax, rsp
mov qword [rsp + 0x138], rax
movzx eax, byte [0x180061a7c]
test eax, eax
jne 0x18002dac6
mov eax, dword [0x1800613e0]
cmp dword [rsp + 0x150], eax
jne 0x18002dac6
mov byte [0x180061a7c], 1
movzx eax, byte [0x180061a6f]
test eax, eax
jne 0x18002dab3
mov dword [rsp + 0x20], 1
jmp 0x18002dabb
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [0x180061a6f], al
movzx eax, byte [0x180061a7d]
test eax, eax
je 0x18002daf2
cmp dword [rsp + 0x150], 0
je 0x18002daf2
mov rax, qword [0x180061ae0]
mov ecx, dword [rsp + 0x150]
mov dword [rax], ecx
mov byte [0x180061a7d], 0
movzx eax, byte [0x18006238d]
test eax, eax
je 0x18002db08
movzx eax, byte [0x180061a6e]
test eax, eax
jne 0x18002db26
movzx eax, byte [0x18006238e]
test eax, eax
je 0x18002ddbc
movzx eax, byte [0x180061a6e]
test eax, eax
je 0x18002ddbc
mov rdx, qword [0x180062398]
lea rcx, [rsp + 0x78]
call fcn.1800229f0
nop
mov ecx, dword [rsp + 0x150]
call fcn.18003f930
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x58]
call fcn.1800229f0
nop
cmp dword [rsp + 0x150], 0x61
jl 0x18002db6d
cmp dword [rsp + 0x150], 0x7a
jle 0x18002db7b
cmp dword [rsp + 0x150], 8
jne 0x18002dc55
lea rdx, [0x1800583f8]
mov rcx, qword [rsp + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x18002db9a
cmp dword [rsp + 0x150], 8
jne 0x18002dbe3
lea rcx, [rsp + 0x58]
call fcn.18001e0a0
dec rax
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x58]
call fcn.18001e190
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1800066d0
lea rcx, [rsp + 0x98]
call fcn.180003a90
nop
jmp 0x18002dc43
mov rcx, qword [0x180062398]
call fcn.18001e0a0
cmp rax, 0x16
jae 0x18002dc43
lea rdx, [0x180058414]
mov rcx, qword [rsp + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x18002dc1e
lea rdx, [0x180058420]
lea rcx, [rsp + 0x58]
call fcn.180004130
nop
jmp 0x18002dc43
lea rdx, [0x180058434]
mov rcx, qword [rsp + 0x28]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x18002dc43
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x58]
call fcn.180004130
nop
lea rdx, [rsp + 0x58]
mov rcx, qword [0x180062398]
call fcn.180023ad0
nop
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x18002dca3
lea r8, str._:._
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xb8]
call fcn.18001f270
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.1800066d0
lea rcx, [rsp + 0xb8]
call fcn.180003a90
nop
mov ecx, 0xba
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x18002dcf6
lea r8, [0x180058440]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xd8]
call fcn.18001f270
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.1800066d0
lea rcx, [rsp + 0xd8]
call fcn.180003a90
nop
jmp 0x18002dd94
mov ecx, 0xbe
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x18002dd46
lea r8, [0x180058444]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xf8]
call fcn.18001f270
mov qword [rsp + 0x48], rax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
call fcn.1800066d0
lea rcx, [rsp + 0xf8]
call fcn.180003a90
nop
jmp 0x18002dd94
mov ecx, 0xdc
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x18002dd94
lea r8, [0x180058448]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x118]
call fcn.18001f270
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.1800066d0
lea rcx, [rsp + 0x118]
call fcn.180003a90
nop
lea rdx, [rsp + 0x58]
mov rcx, qword [0x180062398]
call fcn.180023ad0
nop
lea rcx, [rsp + 0x58]
call fcn.180003a90
nop
lea rcx, [rsp + 0x78]
call fcn.180003a90
nop
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.18004bb30
add rsp, 0x148
ret