Function at 0x18005c2e0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov rax, qword [0x1802c2700]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x51], rdx
mov ecx, r8d
mov qword [rbp - 0x49], rdx
mov edi, r8d
xor edx, edx
xor r12d, r12d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov r8d, 0x20
mov ecx, eax
lea rdx, [rbp - 0x21]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
lea rax, [rbp - 0x21]
mov rsi, 0xffffffffffffffff
movups xmmword [rbp - 0x41], xmm0
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], r12b
jne 0x18005c346
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0xa0], r15
cmp rbx, r13
ja 0x18005c77e
movabs rax, 0x8000000000000000
mov ecx, 0x16
cmp rbx, 0xf
ja 0x18005c3b6
mov r8, rbx
mov qword [rbp - 0x31], rbx
lea rdx, [rbp - 0x21]
mov qword [rbp - 0x29], 0xf
lea rcx, [rbp - 0x41]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x41], r12b
mov r14, qword [rbp - 0x29]
mov rbx, qword [rbp - 0x31]
mov r15, qword [rbp - 0x41]
jmp 0x18005c430
mov r14, rbx
or r14, 0xf
cmp r14, r13
jbe 0x18005c3cb
mov r14, r13
add rax, 0x27
jmp 0x18005c3f6
cmp r14, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
test rcx, rcx
jne 0x18005c3e0
mov r15, r12
jmp 0x18005c41d
cmp rcx, 0x1000
jb 0x18005c415
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005c778
mov rcx, rax
call fcn.180199d50
test rax, rax
je 0x18005c70f
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x18005c41d
call fcn.180199d50
mov r15, rax
mov r8, rbx
lea rdx, [rbp - 0x21]
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [r15 + rbx], r12b
test rbx, rbx
sete bl
cmp r14, 0xf
jbe 0x18005c46d
lea rdx, [r14 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x18005c465
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005c70f
mov rcx, r15
call fcn.180199d8c
test bl, bl
je 0x18005c655
lea r15, [rbp + 0x14]
test edi, edi
jns 0x18005c4c0
neg edi
nop
dec r15
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r15], dil
mov edi, edx
test edx, edx
jne 0x18005c480
dec r15
mov byte [r15], 0x2d
jmp 0x18005c4e8
dec r15
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r15], dil
mov edi, edx
test edx, edx
jne 0x18005c4c0
lea rax, [rbp + 0x14]
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
cmp r15, rax
jne 0x18005c51c
movdqa xmm0, xmmword [0x1801d7990]
movdqu xmmword [rbp - 0x31], xmm0
mov byte [rbp - 0x41], r12b
mov rdi, qword [rbp - 0x41]
psrldq xmm0, 8
movq rbx, xmm0
jmp 0x18005c5f7
lea r14, [rbp + 0x14]
sub r14, r15
cmp r14, r13
ja 0x18005c76c
cmp r14, 0xf
ja 0x18005c55f
mov r8, r14
mov qword [rbp - 0x31], r14
mov rdx, r15
mov qword [rbp - 0x29], 0xf
lea rcx, [rbp - 0x41]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r14 - 0x41], r12b
mov rbx, qword [rbp - 0x29]
mov rdi, qword [rbp - 0x41]
jmp 0x18005c5f7
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x18005c597
movabs rax, 0x8000000000000000
mov rbx, r13
add rax, 0x27
mov rcx, rax
call fcn.180199d50
test rax, rax
je 0x18005c5ca
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x18005c5d9
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x18005c5b2
mov rdi, r12
jmp 0x18005c5d9
cmp rcx, 0x1000
jb 0x18005c5d1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005c772
jmp 0x18005c57c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180199d50
mov rdi, rax
mov r8, r14
mov qword [rbp - 0x41], rdi
mov rdx, r15
mov qword [rbp - 0x31], r14
mov rcx, rdi
mov qword [rbp - 0x29], rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], r12b
cmp rbx, 0xf
lea rcx, [rbp - 0x41]
lea rdx, [rbp - 0x21]
cmova rcx, rdi
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x18005c610
cmp rbx, 0xf
jbe 0x18005c655
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x18005c64d
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18005c70f
mov rcx, rdi
call fcn.180199d8c
mov rbx, qword [rbp - 0x51]
lea rax, [rbp - 0x21]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], r12
nop dword [rax + rax]
inc rsi
cmp byte [rax + rsi], r12b
jne 0x18005c670
cmp rsi, r13
ja 0x18005c77e
cmp rsi, 0xf
ja 0x18005c6ac
mov r8, rsi
mov qword [rbx + 0x10], rsi
lea rdx, [rbp - 0x21]
mov qword [rbx + 0x18], 0xf
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r12b
jmp 0x18005c73d
mov rax, rsi
or rax, 0xf
cmp rax, r13
jbe 0x18005c6e2
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180199d50
test rax, rax
je 0x18005c70f
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x18005c71e
cmp rax, 0x16
mov r13, rax
mov eax, 0x16
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
je 0x18005c71e
cmp rcx, 0x1000
jb 0x18005c716
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18005c778
jmp 0x18005c6c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180199d50
mov r12, rax
mov r8, rsi
mov qword [rbx], r12
lea rdx, [rbp - 0x21]
mov qword [rbx + 0x10], rsi
mov rcx, r12
mov qword [rbx + 0x18], r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rsi], 0
mov r15, qword [rsp + 0xa0]
mov rax, rbx
mov r14, qword [rsp + 0xe0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180199d30
add rsp, 0xa8
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.180055aa0
int3
call fcn.180055a80
int3
call fcn.180055a80
int3
call fcn.180055aa0
int3