Function at 0x18001bab0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0xf8]
sub rsp, 0x1f0
mov rax, qword [0x180309080]
xor rax, rsp
mov qword [rbp + 0x90], rax
cmp byte [0x180309d3c], 0
jne 0x18001c4bb
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov esi, dword [0x18030b254]
mov qword [r11 + 0x18], rdi
mov edi, 0xff
mov qword [r11 - 0x10], r12
movabs r12, 0x7fffffffffffffff
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov r14, qword gs:[0x58]
mov qword [r11 - 0x28], r15
xor r15d, r15d
movaps xmmword [r11 - 0x38], xmm6
xorps xmm6, xmm6
movaps xmmword [r11 - 0x48], xmm7
movss xmm7, dword [0x1802f3f78]
movaps xmmword [r11 - 0x58], xmm8
movss xmm8, dword [0x1802f3fc0]
mov r13d, 4
nop word [rax + rax]
mov eax, dword [reloc.WS2_32.dll_accept]
lea rcx, [rsp + 0x70]
inc eax
movsxd rbx, eax
call fcn.180002450
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x40], rcx
test rbx, rbx
je 0x18001bba1
js 0x18001bba1
imul r8, rbx, 0xf4240
mov rax, r12
sub rax, r8
cmp rcx, rax
je 0x18001bb9d
mov edx, 1
cmovl edx, edi
test dl, dl
jns 0x18001bb9d
lea rax, [r8 + rcx]
mov qword [rbp - 0x40], rax
jmp 0x18001bba1
mov qword [rbp - 0x40], r12
lea rcx, [rbp - 0x40]
call fcn.1800052d0
mov rbx, qword [0x18030bb50]
test rbx, rbx
je 0x18001c45d
mov r10, qword [0x18030b418]
movzx edi, byte [0x180309d24]
test r10, r10
je 0x18001bbfc
cmp dword [0x18030b384], r15d
je 0x18001bbfc
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
bts rcx, 8
btr rax, 8
test dil, dil
cmove rcx, rax
mov qword [rbp - 0x40], rcx
test r10, r10
je 0x18001bc4c
cmp dword [0x18030b384], r15d
je 0x18001bc4c
lea rdx, [rbx + 0x188]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp - 0x40]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x18030b418]
cmp byte [0x180309d23], r15b
je 0x18001bd2e
mov rax, qword [r14 + rsi*8]
mov ecx, dword [r13 + rax]
cmp dword [0x18030bb8c], ecx
jle 0x18001bce1
lea rcx, [0x18030bb8c]
call fcn.1800e8140
cmp dword [0x18030bb8c], 0xffffffff
jne 0x18001bcda
mov rdx, qword [0x18030bb50]
test rdx, rdx
jne 0x18001bc90
movaps xmm0, xmm6
jmp 0x18001bcc6
mov rcx, qword [0x18030b418]
test rcx, rcx
je 0x18001bcc1
cmp dword [0x18030b384], r15d
je 0x18001bcc1
add rdx, qword [0x18030b348]
lea r8, [rbp]
mov r9d, 4
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movss xmm0, dword [rbp]
lea rcx, [0x18030bb8c]
movss dword [0x18030bb88], xmm0
call fcn.1800e80d4
mov r10, qword [0x18030b418]
mov rbx, qword [0x18030bb50]
test rbx, rbx
je 0x18001bd2e
movss xmm0, dword [0x18030bb88]
movss dword [rbp + 8], xmm0
test r10, r10
je 0x18001bd2e
cmp dword [0x18030b384], r15d
je 0x18001bd2e
lea rdx, [rbx + 0x280]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 8]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r10, qword [0x18030b418]
mov rcx, qword [0x18030bb50]
test rcx, rcx
je 0x18001bea3
test r10, r10
je 0x18001bd75
cmp dword [0x18030b384], r15d
je 0x18001bd75
mov rdx, qword [0x18030b340]
lea r8, [rbp + 0x58]
add rdx, rcx
mov qword [rsp + 0x20], r15
mov rcx, r10
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rbx, qword [rbp + 0x58]
test rbx, rbx
je 0x18001bea3
test r10, r10
je 0x18001bdbc
cmp dword [0x18030b384], r15d
je 0x18001bdbc
mov rdx, qword [0x18030b358]
lea r8, [rbp + 0x88]
add rdx, rbx
mov qword [rsp + 0x20], r15
mov r9d, 8
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rax, qword [0x18030bb50]
cmp qword [rbp + 0x88], rax
jne 0x18001bec1
mov byte [0x18030b300], 1
test r10, r10
je 0x18001be08
cmp dword [0x18030b384], r15d
je 0x18001be08
lea rdx, [rbx + 0x20]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x68]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rax, qword [rbp + 0x68]
mov qword [0x18030b2f8], rax
mov qword [0x18030b308], rbx
test r10, r10
je 0x18001be4b
cmp dword [0x18030b384], r15d
je 0x18001be4b
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rax, qword [rbp + 0x70]
mov qword [0x18030b2f0], rax
test r10, r10
je 0x18001be8b
cmp dword [0x18030b384], r15d
je 0x18001be8b
lea rdx, [rbx + 0x90]
mov qword [rsp + 0x20], r15
mov r9d, recvfrom
lea r8, [rsp + 0x60]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
movsd xmm0, qword [rsp + 0x60]
mov eax, dword [rsp + 0x68]
movsd qword [0x18030b7b0], xmm0
mov dword [0x18030b7b8], eax
cmp byte [0x18030b300], r15b
jne 0x18001bfd1
mov rdx, qword [0x18030bb50]
test rdx, rdx
jne 0x18001beca
mov rax, r15
jmp 0x18001beff
mov byte [0x18030b300], r15b
jmp 0x18001beb0
test r10, r10
je 0x18001befb
cmp dword [0x18030b384], r15d
je 0x18001befb
add rdx, 0x20
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x78]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rax, qword [rbp + 0x78]
mov rbx, qword [0x18030bb50]
mov qword [0x18030b2f8], rax
mov qword [0x18030b308], rbx
test rbx, rbx
jne 0x18001bf1e
mov rax, r15
jmp 0x18001bf59
test r10, r10
je 0x18001bf52
cmp dword [0x18030b384], r15d
je 0x18001bf52
lea rdx, [rbx + 0x30]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x80]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rax, qword [rbp + 0x80]
cmp qword [0x18030bb50], r15
mov qword [0x18030b2f0], rax
jne 0x18001bf7d
movaps xmm0, xmm6
movss dword [rsp + 0x38], xmm6
unpcklps xmm0, xmm6
movsd qword [rsp + 0x30], xmm0
jmp 0x18001bfb9
test r10, r10
je 0x18001bfb9
cmp dword [0x18030b384], r15d
je 0x18001bfb9
mov rdx, qword [0x18030bb50]
lea r8, [rsp + 0x30]
add rdx, 0x90
mov qword [rsp + 0x20], r15
mov r9d, recvfrom
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
movsd xmm0, qword [rsp + 0x30]
mov eax, dword [rsp + 0x38]
movsd qword [0x18030b7b0], xmm0
mov dword [0x18030b7b8], eax
mov rdx, qword [0x18030ba88]
test rdx, rdx
je 0x18001c047
test r10, r10
je 0x18001c011
cmp dword [0x18030b384], r15d
je 0x18001c011
add rdx, 0x3c0
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x30]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r10, qword [0x18030b418]
mov rdx, qword [rbp + 0x30]
test rdx, rdx
je 0x18001c047
test r10, r10
je 0x18001c051
cmp dword [0x18030b384], r15d
je 0x18001c051
add rdx, 0x40
mov qword [rsp + 0x20], r15
mov r9d, recvfrom
lea r8, [rsp + 0x3c]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
jmp 0x18001c051
mov qword [rsp + 0x3c], r15
mov dword [rsp + 0x44], r15d
movsd xmm0, qword [rsp + 0x3c]
lea rcx, [rbp - 0x80]
mov eax, dword [rsp + 0x44]
movsd qword [rbp - 0x80], xmm0
mov dword [rbp - 0x78], eax
call fcn.18001b300
mov rcx, qword [0x18030b418]
mov rdi, qword [0x18030bb50]
test rcx, rcx
je 0x18001c0dd
cmp dword [0x18030b384], r15d
je 0x18001c0ab
lea rdx, [rdi + 0x10d8]
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x18030b418]
test rcx, rcx
je 0x18001c0dd
cmp dword [0x18030b384], r15d
je 0x18001c0dd
mov rdx, qword [rbp + 0x38]
lea r8, [rbp + 0x40]
add rdx, 0x20
mov qword [rsp + 0x20], r15
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d25], r15b
mov rbx, qword [rbp + 0x40]
je 0x18001c102
mov qword [rbp + 0x48], r15
test rcx, rcx
je 0x18001c13b
cmp dword [0x18030b384], r15d
je 0x18001c13b
lea r8, [rbp + 0x48]
jmp 0x18001c11c
mov qword [rbp + 0x50], 1
test rcx, rcx
je 0x18001c13b
cmp dword [0x18030b384], r15d
je 0x18001c13b
lea r8, [rbp + 0x50]
mov r9d, 8
mov qword [rsp + 0x20], r15
lea rdx, [rbx + 0x2f4]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d26], r15b
je 0x18001c179
mov dword [rbp + 0x10], r15d
test rcx, rcx
je 0x18001c179
cmp dword [0x18030b384], r15d
je 0x18001c179
lea rdx, [rbx + 0x84]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d16], r15b
je 0x18001c1a6
movd xmm0, dword [0x180309d18]
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x18], xmm0
test rcx, rcx
je 0x18001c1de
cmp dword [0x18030b384], r15d
je 0x18001c1de
lea r8, [rbp + 0x18]
jmp 0x18001c1bf
mov dword [rbp + 0x20], 0x42480000
test rcx, rcx
je 0x18001c1de
cmp dword [0x18030b384], r15d
je 0x18001c1de
lea r8, [rbp + 0x20]
mov r9d, 4
mov qword [rsp + 0x20], r15
lea rdx, [rbx + 0xb0]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d15], r15b
je 0x18001c21c
mov dword [rbp - 0x38], 0x447a0000
test rcx, rcx
je 0x18001c250
cmp dword [0x18030b384], r15d
je 0x18001c21c
lea rdx, [rbx + 0x28]
mov qword [rsp + 0x20], r15
mov r9d, 4
lea r8, [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
test rcx, rcx
je 0x18001c250
cmp dword [0x18030b384], r15d
je 0x18001c250
mov rdx, qword [0x18030b338]
lea r8, [rbp + 0x28]
add rdx, rdi
mov qword [rsp + 0x20], r15
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d14], r15b
je 0x18001c27d
movd xmm0, dword [0x180309d1c]
cvtdq2ps xmm0, xmm0
movss dword [rbp - 0x30], xmm0
test rcx, rcx
je 0x18001c2b9
cmp dword [0x18030b384], r15d
je 0x18001c2b9
lea r8, [rbp - 0x30]
jmp 0x18001c296
mov dword [rbp - 0x28], 0x3f800000
test rcx, rcx
je 0x18001c2b9
cmp dword [0x18030b384], r15d
je 0x18001c2b9
lea r8, [rbp - 0x28]
mov rdx, qword [rbp + 0x28]
mov r9d, 4
add rdx, 0xcf0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d13], r15b
je 0x18001c327
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rcx, qword [0x18030b418]
test ax, ax
je 0x18001c2f1
mov dword [rbp - 0x20], r15d
test rcx, rcx
je 0x18001c327
cmp dword [0x18030b384], r15d
je 0x18001c327
lea r8, [rbp - 0x20]
jmp 0x18001c30a
mov dword [rbp - 0x18], 0x3f800000
test rcx, rcx
je 0x18001c327
cmp dword [0x18030b384], r15d
je 0x18001c327
lea r8, [rbp - 0x18]
mov r9d, 4
mov qword [rsp + 0x20], r15
mov edx, 0x478
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d12], r15b
je 0x18001c34b
mov dword [rbp - 0x10], 0x3f800000
test rcx, rcx
je 0x18001c37e
cmp dword [0x18030b384], r15d
je 0x18001c37e
lea r8, [rbp - 0x10]
jmp 0x18001c361
mov dword [rbp - 8], r15d
test rcx, rcx
je 0x18001c37e
cmp dword [0x18030b384], r15d
je 0x18001c37e
lea r8, [rbp - 8]
mov r9d, 4
mov qword [rsp + 0x20], r15
mov edx, 0x28b5
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d11], r15b
je 0x18001c3ab
movss dword [rbp - 0x68], xmm7
movaps xmm0, xmm7
unpcklps xmm0, xmm7
movsd qword [rbp - 0x70], xmm0
test rcx, rcx
je 0x18001c3ed
cmp dword [0x18030b384], r15d
je 0x18001c3ed
lea r8, [rbp - 0x70]
jmp 0x18001c3d0
movss dword [rbp - 0x58], xmm8
movaps xmm0, xmm8
unpcklps xmm0, xmm8
movsd qword [rbp - 0x60], xmm0
test rcx, rcx
je 0x18001c3ed
cmp dword [0x18030b384], r15d
je 0x18001c3ed
lea r8, [rbp - 0x60]
mov r9d, recvfrom
mov qword [rsp + 0x20], r15
mov edx, 0x87c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x18030b418]
cmp byte [0x180309d10], r15b
je 0x18001c41a
movss dword [rbp - 0x48], xmm7
movaps xmm0, xmm7
unpcklps xmm0, xmm7
movsd qword [rbp - 0x50], xmm0
test rcx, rcx
je 0x18001c458
cmp dword [0x18030b384], r15d
je 0x18001c458
lea r8, [rbp - 0x50]
jmp 0x18001c442
movss dword [rsp + 0x58], xmm8
movaps xmm0, xmm8
unpcklps xmm0, xmm8
movsd qword [rsp + 0x50], xmm0
test rcx, rcx
je 0x18001c458
cmp dword [0x18030b384], r15d
je 0x18001c458
lea r8, [rsp + 0x50]
mov r9d, recvfrom
mov qword [rsp + 0x20], r15
mov edx, 0x50c
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, 0xff
cmp byte [0x180309d3c], r15b
je 0x18001bb50
movaps xmm8, xmmword [rsp + 0x1a0]
movaps xmm7, xmmword [rsp + 0x1b0]
movaps xmm6, xmmword [rsp + 0x1c0]
mov r15, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1e0]
mov r12, qword [rsp + 0x1e8]
mov rdi, qword [rsp + 0x210]
mov rsi, qword [rsp + 0x208]
mov rbx, qword [rsp + 0x200]
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1800e7c90
add rsp, 0x1f0
pop rbp
ret