Function at 0x1800207f0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
mov rbp, rsp
sub rsp, 0x80
mov r13, rdx
mov ecx, r8d
xor edx, edx
mov edi, r8d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov r8d, 0x20
mov ecx, eax
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
lea rax, [rbp - 0x20]
mov r14, 0xffffffffffffffff
movups xmmword [rbp - 0x40], xmm0
mov rbx, r14
inc rbx
cmp byte [rax + rbx], 0
jne 0x180020841
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x180020bc9
mov qword [rsp + 0xb0], r12
movabs rax, 0x8000000000000000
mov qword [rsp + 0xb8], r15
mov ecx, 0x16
cmp rbx, 0xf
ja 0x1800208b1
mov r8, rbx
mov qword [rbp - 0x30], rbx
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x28], 0xf
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x40], 0
mov r15, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
mov r12, qword [rbp - 0x40]
jmp 0x18002092d
mov r15, rbx
or r15, 0xf
cmp r15, rsi
jbe 0x1800208e4
mov r15, rsi
add rax, 0x27
mov rcx, rax
call fcn.1800ffa74
test rax, rax
je 0x180020b49
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x180020919
cmp r15, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x180020907
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180020bbd
jmp 0x1800208c4
test rcx, rcx
je 0x180020916
call fcn.1800ffa74
mov r12, rax
jmp 0x180020919
xor r12d, r12d
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], 0
test rbx, rbx
sete bl
cmp r15, 0xf
jbe 0x18002096b
lea rdx, [r15 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x180020963
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180020b49
mov rcx, r12
call fcn.1800ffa38
test bl, bl
je 0x180020b58
lea r15, [rbp - 0x43]
test edi, edi
jns 0x1800209c0
neg edi
nop dword [rax]
dec r15
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r15], dil
mov edi, edx
test edx, edx
jne 0x180020980
dec r15
mov byte [r15], 0x2d
jmp 0x1800209e8
dec r15
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r15], dil
mov edi, edx
test edx, edx
jne 0x1800209c0
lea rax, [rbp - 0x43]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
cmp r15, rax
jne 0x180020a1c
movdqa xmm0, xmmword [0x180181820]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rbx, qword [rbp - 0x40]
psrldq xmm0, 8
movq rsi, xmm0
jmp 0x180020af6
lea rdi, [rbp - 0x43]
sub rdi, r15
cmp rdi, rsi
ja 0x180020bb7
cmp rdi, 0xf
ja 0x180020a5f
mov r8, rdi
mov qword [rbp - 0x30], rdi
mov rdx, r15
mov qword [rbp - 0x28], 0xf
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x40], 0
mov rsi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x40]
jmp 0x180020af6
mov rax, rdi
or rax, 0xf
cmp rax, rsi
jbe 0x180020a94
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800ffa74
test rax, rax
je 0x180020ac0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x180020ad8
cmp rax, 0x16
mov rsi, rax
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180020ac7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180020bc3
jmp 0x180020a79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x180020ad6
call fcn.1800ffa74
mov rbx, rax
jmp 0x180020ad8
xor ebx, ebx
mov r8, rdi
mov qword [rbp - 0x40], rbx
mov rdx, r15
mov qword [rbp - 0x30], rdi
mov rcx, rbx
mov qword [rbp - 0x28], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
cmp rsi, 0xf
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x20]
cmova rcx, rbx
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x180020b10
cmp rsi, 0xf
jbe 0x180020b58
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180020b50
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180020b50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.1800ffa38
xorps xmm0, xmm0
lea rax, [rbp - 0x20]
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
inc r14
cmp byte [rax + r14], 0
jne 0x180020b74
mov r8, r14
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.18001b3d0
mov r12, qword [rsp + 0xb0]
mov rax, r13
mov r15, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
call fcn.18001ca90
int3
call fcn.18001cfe0
int3
call fcn.18001cfe0
int3
call fcn.18001ca90
int3