Function at 0x1800250a0
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
cmp qword [0x1800a9550], 0
jne 0x1800250db
call fcn.18001fec0
test al, al
jne 0x1800250db
xor eax, eax
jmp 0x18002533f
mov rcx, qword [0x1800a9558]
test rcx, rcx
jne 0x180025137
lea rax, [0x1800a9558]
mov qword [rsp + 0x20], rax
mov r12d, 1
mov r9d, r12d
xor r8d, r8d
lea rdx, str.SoftwareDownloadManagerSpecialKeys
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x180025125
xor edi, edi
mov qword [0x1800a9558], rdi
jmp 0x18002533d
mov rcx, qword [0x1800a9558]
test rcx, rcx
je 0x18002533d
jmp 0x18002513d
mov r12d, 1
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UseKeyToPrevent
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x18002533d
cmp dword [rsp + 0x78], eax
je 0x18002533d
xor edi, edi
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AltP
mov rcx, qword [0x1800a9558]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, edi
test eax, eax
cmove esi, dword [rsp + 0x78]
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ShiftP
mov rcx, qword [0x1800a9558]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r13d, edi
test eax, eax
cmove r13d, dword [rsp + 0x78]
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.CtrlP
mov rcx, qword [0x1800a9558]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r14d, edi
test eax, eax
cmove r14d, dword [rsp + 0x78]
mov dword [rsp + 0x70], 4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DelP
mov rcx, qword [0x1800a9558]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15d, edi
test eax, eax
cmove r15d, dword [rsp + 0x78]
test esi, esi
jne 0x180025299
test r13d, r13d
jne 0x180025299
test r14d, r14d
jne 0x180025299
test r15d, r15d
je 0x18002533d
mov dword [rsp + 0x30], edi
mov ebx, edi
mov dword [rsp + 0x34], ebx
test esi, esi
je 0x1800252cc
mov edi, r12d
mov dword [rsp + 0x30], r12d
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
test si, ax
cmovne ebx, r12d
mov dword [rsp + 0x34], ebx
jmp 0x1800252d1
mov esi, 0x8000
test r13d, r13d
je 0x1800252f2
inc edi
mov dword [rsp + 0x30], edi
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x1800252f2
inc ebx
mov dword [rsp + 0x34], ebx
test r14d, r14d
je 0x180025313
inc edi
mov dword [rsp + 0x30], edi
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x180025313
inc ebx
mov dword [rsp + 0x34], ebx
test r15d, r15d
je 0x180025334
inc edi
mov dword [rsp + 0x30], edi
mov ecx, 0x2e
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x180025334
inc ebx
mov dword [rsp + 0x34], ebx
cmp ebx, edi
jne 0x18002533d
mov eax, r12d
jmp 0x18002533f
xor eax, eax
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret