Function at 0x140018010
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x28]
call fcn.140021ef0
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
mov esi, 0x8000
mov edi, 1
test si, ax
je 0x140018053
mov dword [rbx], edi
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x140018066
mov dword [rbx + 4], edi
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x140018079
mov dword [rbx + 8], edi
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x14001808c
mov dword [rbx + 0xc], edi
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x14001809f
mov dword [rbx + 0x10], edi
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x1400180b2
mov dword [rbx + 0x14], edi
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x1400180c5
mov dword [rbx + 0x18], edi
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
test si, ax
je 0x1400180d8
mov dword [rbx + 0x1c], edi
xor esi, esi
mov ebp, 0x1bc
lea r12d, [rsi + 2]
cmp dword [rbx], esi
je 0x140018104
lea ecx, [rsi + 0x5b]
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, r12d
mov edx, eax
mov cl, 0x5b
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx], edi
cmp dword [rbx + 4], esi
je 0x140018127
xor edx, edx
lea ecx, [rdx + 0x5c]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, r12d
mov edx, eax
mov cl, 0x5c
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx + 4], edi
cmp dword [rbx + 8], esi
je 0x14001814c
xor edx, edx
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, r12d
mov edx, eax
mov cl, 0xa5
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx + 8], edi
cmp dword [rbx + 0xc], esi
je 0x140018171
xor edx, edx
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, r12d
mov edx, eax
mov cl, 0xa4
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx + 0xc], edi
cmp dword [rbx + 0x14], esi
je 0x140018194
xor edx, edx
lea ecx, [rdx + 0x11]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, r12d
mov edx, eax
mov cl, 0x11
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx + 0x14], edi
cmp dword [rbx + 0x18], esi
je 0x1400181b9
xor edx, edx
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, r12d
mov edx, eax
mov cl, 0xa3
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx + 0x18], edi
cmp dword [rbx + 0x1c], esi
je 0x1400181de
xor edx, edx
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, r12d
mov edx, eax
mov cl, 0xa2
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx + 0x1c], edi
cmp dword [rbx + 0x10], esi
je 0x140018204
xor edx, edx
lea ecx, [rdx + 0x12]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov r9, rbp
mov r8d, 3
mov edx, eax
mov cl, 0x12
call qword [sym.imp.USER32.dll_keybd_event]
mov dword [rbx + 0x10], edi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret