Function at 0x18006bd88
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword [0x1800b13a8]
xor rax, rsp
mov qword [rsp + 0x28], rax
call fcn.180010a4c
xor r13d, r13d
movabs rcx, 0x19dd1c202b338df3
test eax, eax
je 0x18006c30e
call fcn.180078a38
lea ecx, [r13 + 0xa]
call fcn.1800100b0
lea ecx, [r13 + 6]
call fcn.1800100b0
lea ecx, [r13 + 7]
call fcn.1800100b0
lea ecx, [r13 + 9]
call fcn.1800100b0
lea ecx, [r13 + 8]
call fcn.1800100b0
lea ebx, [r13 + 1]
movabs rcx, 0xe4fa4fbf0bafd2a8
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], ebx
call fcn.18007876c
mov edx, 0xf1
call fcn.180010a90
mov edx, 0xf2
call fcn.180010a90
lea edx, [rbx + 0x2f]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x19]
xor ecx, ecx
call fcn.180010adc
xor edx, edx
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x62]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x4f]
xor ecx, ecx
call fcn.180010adc
mov r12d, 0xc9
lea edi, [rbx + 1]
mov edx, r12d
mov ecx, edi
call fcn.180010adc
lea edx, [r12 + 1]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0xc]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0xb]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0xe]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0xd]
mov ecx, edi
call fcn.180010adc
mov edx, r12d
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0x22]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x23]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x21]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x20]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x12]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x1a]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x18]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0x19]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0x1d]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0x1c]
mov ecx, edi
call fcn.180010adc
lea ecx, [rbx + 0xc]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
lea ecx, [rbx + 7]
movzx eax, byte [0x1800b9f6b]
cmovne eax, ebx
mov byte [0x1800b9f6b], al
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
je 0x18006bf6c
cmp qword [0x1800c2c60], rbx
jbe 0x18006bf65
lea rcx, [0x1800c2c40]
call fcn.180076ef0
jmp 0x18006bf6c
mov byte [0x1800b9489], r13b
mov ecx, WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
mov ecx, 0x25
movzx eax, byte [0x1800b9300]
cmovne eax, ebx
mov byte [0x1800b9300], al
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edi, 0x1f4
test bl, al
jne 0x18006bfde
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test bl, al
je 0x18006bfe6
cmp byte [0x1800ba078], r13b
je 0x18006bfcf
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba078], r13b
mov qword [0x1800ba070], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba070]
jbe 0x18006bfec
mov byte [0x1800b937f], bl
jmp 0x18006bfec
mov byte [0x1800ba078], bl
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
jne 0x18006c03c
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test bl, al
je 0x18006c044
cmp byte [0x1800ba088], r13b
je 0x18006c02d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba088], r13b
mov qword [0x1800ba080], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba080]
jbe 0x18006c04a
mov byte [0x1800b95b9], bl
jmp 0x18006c04a
mov byte [0x1800ba088], bl
mov ecx, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
jne 0x18006c182
mov edx, 0xf2
xor ecx, ecx
call fcn.18001089c
test eax, eax
jne 0x18006c182
lea ecx, [rax + 0x28]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test bl, al
je 0x18006c177
cmp byte [0x1800ba058], r13b
je 0x18006c0a5
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba058], r13b
mov qword [0x1800ba050], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba050]
jbe 0x18006c202
cmp byte [0x1800ba048], r13b
je 0x18006c0d9
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, 0x28
mov byte [0x1800ba048], r13b
mov qword [0x1800ba040], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba040]
jbe 0x18006c202
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c60]
dec rax
add rcx, rax
mov byte [0x1800b9f99], bl
mov rax, qword [0x1800c2c50]
dec rax
and rcx, rax
mov rax, qword [0x1800c2c48]
mov rcx, qword [rax + rcx*8]
add dword [rcx], ebx
mov r9, qword [0x1800c2c50]
mov r10, qword [0x1800c2c48]
mov rax, qword [0x1800c2c58]
mov r8, qword [0x1800c2c60]
dec rax
add r8, rax
lea rax, [r9 - 1]
and rax, r8
mov rdx, qword [r10 + rax*8]
lea rax, [r9 - 1]
and rax, r8
mov rcx, qword [r10 + rax*8]
mov eax, dword [rdx + 8]
cmp dword [rcx], eax
jle 0x18006c16c
lea rax, [r9 - 1]
and rax, r8
mov rax, qword [r10 + rax*8]
mov dword [rax], ebx
mov byte [0x1800ba048], bl
jmp 0x18006c202
mov byte [0x1800ba058], bl
jmp 0x18006c202
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c60]
dec rax
add rcx, rax
mov byte [0x1800b9f99], bl
mov rax, qword [0x1800c2c50]
dec rax
and rcx, rax
mov rax, qword [0x1800c2c48]
mov rcx, qword [rax + rcx*8]
add dword [rcx], ebx
mov r9, qword [0x1800c2c50]
mov r10, qword [0x1800c2c48]
mov rax, qword [0x1800c2c58]
mov r8, qword [0x1800c2c60]
dec rax
add r8, rax
lea rax, [r9 - 1]
and rax, r8
mov rdx, qword [r10 + rax*8]
lea rax, [r9 - 1]
and rax, r8
mov rcx, qword [r10 + rax*8]
mov eax, dword [rdx + 8]
cmp dword [rcx], eax
jle 0x18006c202
lea rax, [r9 - 1]
and rax, r8
mov rax, qword [r10 + rax*8]
mov dword [rax], ebx
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test bl, al
jne 0x18006c225
mov edx, 0xf1
xor ecx, ecx
call fcn.18001089c
test eax, eax
je 0x18006c2a6
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c60]
dec rax
add rcx, rax
mov byte [0x1800b9330], bl
mov rax, qword [0x1800c2c50]
dec rax
and rcx, rax
mov rax, qword [0x1800c2c48]
mov rcx, qword [rax + rcx*8]
dec dword [rcx]
mov rax, qword [0x1800c2c58]
mov r9, qword [0x1800c2c50]
dec rax
mov rdx, qword [0x1800c2c60]
mov r10, qword [0x1800c2c48]
add rdx, rax
lea rax, [r9 - 1]
and rax, rdx
mov rax, qword [r10 + rax*8]
cmp dword [rax], ebx
jge 0x18006c2a6
lea rax, [r9 - 1]
and rax, rdx
mov r8, qword [r10 + rax*8]
lea rax, [r9 - 1]
and rax, rdx
mov rdx, qword [r10 + rax*8]
mov eax, dword [r8 + 8]
mov dword [rdx], eax
mov ecx, 0x26
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test bl, al
je 0x18006c9f8
cmp byte [0x1800ba068], r13b
je 0x18006c2dc
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba068], r13b
mov qword [0x1800ba060], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba060]
jbe 0x18006c9fe
cmp byte [0x1800ba048], r13b
je 0x18006c95d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov byte [0x1800ba048], r13b
jmp 0x18006c952
call fcn.180078a38
mov ecx, 0xa
call fcn.1800100b0
mov ecx, 6
call fcn.1800100b0
mov ecx, 7
call fcn.1800100b0
mov ecx, 9
call fcn.1800100b0
mov ecx, 8
call fcn.1800100b0
mov ebx, 1
lea rdx, [rsp + 0x20]
movabs rcx, 0xe4fa4fbf0bafd2a8
mov dword [rsp + 0x20], ebx
call fcn.18007876c
mov edx, 0xcb
call fcn.180010a90
mov r12d, 0xc9
mov edx, r12d
call fcn.180010a90
lea edx, [r12 + 1]
call fcn.180010a90
lea edx, [r12 - 0xe]
call fcn.180010a90
lea edx, [r12 - 0xd]
call fcn.180010a90
lea edx, [r12 - 0xc]
call fcn.180010a90
lea edx, [r12 - 0xb]
call fcn.180010a90
xor edx, edx
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x2f]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x24]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x2c]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x2b]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x2a]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x29]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x28]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x27]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x26]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x25]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x24]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0xd]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0xe]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x34]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x35]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x36]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x3d]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x3c]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x3a]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x30]
xor ecx, ecx
call fcn.180010adc
lea r13d, [rbx + 0x49]
xor ecx, ecx
mov edx, r13d
call fcn.180010adc
lea edx, [rbx + 0x54]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x32]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x2c]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x4f]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x15]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x62]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x72]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x22]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x23]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x21]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x20]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x12]
xor ecx, ecx
call fcn.180010adc
lea edi, [rbx + 1]
mov ecx, edi
lea edx, [r12 - 0x18]
call fcn.180010adc
lea edx, [r12 - 0x19]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0x1d]
mov ecx, edi
call fcn.180010adc
lea edx, [r12 - 0x1c]
mov ecx, edi
call fcn.180010adc
lea edx, [rbx + 0x2e]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x14]
xor ecx, ecx
call fcn.180010adc
lea edx, [rbx + 0x48]
xor ecx, ecx
call fcn.180010adc
mov edx, r13d
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x40]
xor ecx, ecx
call fcn.180010adc
lea edx, [r12 - 0x41]
xor ecx, ecx
call fcn.180010adc
mov edx, r12d
call fcn.18001080c
movzx ecx, byte [0x1800b9f6b]
xor r12d, r12d
test eax, eax
mov edx, 0xca
cmovne ecx, ebx
mov byte [0x1800b9f6b], cl
call fcn.18001080c
test eax, eax
je 0x18006c5df
cmp qword [0x1800c2c60], rbx
jbe 0x18006c5d8
lea rcx, [0x1800c2c40]
call fcn.180076ef0
jmp 0x18006c5df
mov byte [0x1800b9489], r12b
mov edx, 0xcb
call fcn.18001080c
movzx ecx, byte [0x1800b9300]
test eax, eax
mov edx, 0xbd
cmovne ecx, ebx
mov byte [0x1800b9300], cl
call fcn.18001080c
mov edi, 0x1f4
test eax, eax
jne 0x18006c64d
mov edx, 0xbd
xor ecx, ecx
call fcn.1800107c4
test eax, eax
je 0x18006c655
cmp byte [0x1800ba078], r12b
je 0x18006c63e
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba078], r12b
mov qword [0x1800ba070], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba070]
jbe 0x18006c65b
mov byte [0x1800b937f], bl
jmp 0x18006c65b
mov byte [0x1800ba078], bl
mov edx, 0xbe
call fcn.18001080c
test eax, eax
jne 0x18006c6a8
mov edx, 0xbe
xor ecx, ecx
call fcn.1800107c4
test eax, eax
je 0x18006c6b0
cmp byte [0x1800ba088], r12b
je 0x18006c699
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba088], r12b
mov qword [0x1800ba080], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba080]
jbe 0x18006c6b6
mov byte [0x1800b95b9], bl
jmp 0x18006c6b6
mov byte [0x1800ba088], bl
mov edx, 0xbb
call fcn.18001080c
test eax, eax
je 0x18006c751
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c60]
dec rax
add rcx, rax
mov byte [0x1800b9f99], bl
mov rax, qword [0x1800c2c50]
dec rax
and rcx, rax
mov rax, qword [0x1800c2c48]
mov rcx, qword [rax + rcx*8]
add dword [rcx], ebx
mov r9, qword [0x1800c2c50]
mov r10, qword [0x1800c2c48]
mov rax, qword [0x1800c2c58]
mov r8, qword [0x1800c2c60]
dec rax
add r8, rax
lea rax, [r9 - 1]
and rax, r8
mov rdx, qword [r10 + rax*8]
lea rax, [r9 - 1]
and rax, r8
mov rcx, qword [r10 + rax*8]
mov eax, dword [rdx + 8]
cmp dword [rcx], eax
jle 0x18006c85a
lea rax, [r9 - 1]
and rax, r8
mov rax, qword [r10 + rax*8]
mov dword [rax], ebx
jmp 0x18006c85a
mov edx, 0xbb
xor ecx, ecx
call fcn.1800107c4
test eax, eax
je 0x18006c854
cmp byte [0x1800ba058], r12b
je 0x18006c785
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba058], r12b
mov qword [0x1800ba050], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba050]
jbe 0x18006c85a
cmp byte [0x1800ba048], r12b
je 0x18006c7b9
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, 0x28
mov byte [0x1800ba048], r12b
mov qword [0x1800ba040], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba040]
jbe 0x18006c85a
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c60]
dec rax
add rcx, rax
mov byte [0x1800b9f99], bl
mov rax, qword [0x1800c2c50]
dec rax
and rcx, rax
mov rax, qword [0x1800c2c48]
mov rcx, qword [rax + rcx*8]
add dword [rcx], ebx
mov r9, qword [0x1800c2c50]
mov r10, qword [0x1800c2c48]
mov rax, qword [0x1800c2c58]
mov r8, qword [0x1800c2c60]
dec rax
add r8, rax
lea rax, [r9 - 1]
and rax, r8
mov rdx, qword [r10 + rax*8]
lea rax, [r9 - 1]
and rax, r8
mov rcx, qword [r10 + rax*8]
mov eax, dword [rdx + 8]
cmp dword [rcx], eax
jle 0x18006c84c
lea rax, [r9 - 1]
and rax, r8
mov rax, qword [r10 + rax*8]
mov dword [rax], ebx
mov byte [0x1800ba048], bl
jmp 0x18006c85a
mov byte [0x1800ba058], bl
mov edx, 0xbc
call fcn.18001080c
test eax, eax
je 0x18006c8f5
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c60]
dec rax
add rcx, rax
mov byte [0x1800b9330], bl
mov rax, qword [0x1800c2c50]
dec rax
and rcx, rax
mov rax, qword [0x1800c2c48]
mov rcx, qword [rax + rcx*8]
dec dword [rcx]
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c50]
dec rax
mov r8, qword [0x1800c2c60]
mov r9, qword [0x1800c2c48]
add r8, rax
lea rax, [rcx - 1]
and rax, r8
mov rax, qword [r9 + rax*8]
cmp dword [rax], ebx
jge 0x18006c9fe
lea rax, [rcx - 1]
and rax, r8
mov rdx, qword [r9 + rax*8]
lea rax, [rcx - 1]
and rax, r8
mov rcx, qword [r9 + rax*8]
mov eax, dword [rdx + 8]
mov dword [rcx], eax
jmp 0x18006c9fe
mov edx, 0xbc
xor ecx, ecx
call fcn.1800107c4
test eax, eax
je 0x18006c9f8
cmp byte [0x1800ba068], r12b
je 0x18006c929
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
add rax, rdi
mov byte [0x1800ba068], r12b
mov qword [0x1800ba060], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba060]
jbe 0x18006c9fe
cmp byte [0x1800ba048], r12b
je 0x18006c95d
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov byte [0x1800ba048], r12b
add rax, 0x28
mov qword [0x1800ba040], rax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp rax, qword [0x1800ba040]
jbe 0x18006c9fe
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c60]
dec rax
add rcx, rax
mov byte [0x1800b9330], bl
mov rax, qword [0x1800c2c50]
dec rax
and rcx, rax
mov rax, qword [0x1800c2c48]
mov rcx, qword [rax + rcx*8]
dec dword [rcx]
mov rax, qword [0x1800c2c58]
mov rcx, qword [0x1800c2c50]
dec rax
mov r8, qword [0x1800c2c60]
mov r9, qword [0x1800c2c48]
add r8, rax
lea rax, [rcx - 1]
and rax, r8
mov rax, qword [r9 + rax*8]
cmp dword [rax], ebx
jge 0x18006c9f0
lea rax, [rcx - 1]
and rax, r8
mov rdx, qword [r9 + rax*8]
lea rax, [rcx - 1]
and rax, r8
mov rcx, qword [r9 + rax*8]
mov eax, dword [rdx + 8]
mov dword [rcx], eax
mov byte [0x1800ba048], bl
jmp 0x18006c9fe
mov byte [0x1800ba068], bl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18008e040
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret