Function at 0x180006d40
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
xor ecx, ecx
call fcn.18008cfd0
mov ecx, eax
call fcn.180089ad8
call fcn.180089aac
and eax, 0x80000003
jge 0x180006d7a
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
mov ebx, edi
test eax, eax
jne 0x180006e7e
cmp dword [0x18010e3e4], 0xa98b7b17
jne 0x180006e6a
call qword [sym.imp.USER32.dll_GetKBCodePage]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeFreeDataHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
call qword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDesktopWindows]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorFromFileW]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeReconnect]
mov rdx, qword [rbp + 0x6f]
call fcn.1800022f0
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x180006f7c
mov eax, 0xffff1a6d
nop dword [rax]
inc eax
test al, 1
jne 0x180006e90
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov qword [rbp + 0x7f], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x12d
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x12d
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013c30
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016bd0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
jmp 0x18000754d
cmp eax, 2
jne 0x180007258
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x223
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x223
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013a10
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016bd0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18008019c
mov qword [rbp + 0x77], rbx
cmp dword [0x18010e3e4], 0x778c4044
jne 0x180007184
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetAtomNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
mov dword [rbp + 0x67], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x238
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x238
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1800137d0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016bd0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
jmp 0x18000754d
cmp eax, 3
jne 0x180007557
mov dword [rbp + 0x67], edi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x12c
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x12c
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1800163d0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016bd0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18008019c
mov qword [rbp + 0x37], rbx
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov dword [rbp + 0x7f], 0x400
mov qword [rbp + 0x2f], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1cd
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1cd
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x2f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013590
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016bd0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18008019c
mov qword [rbp + 0x27], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x248
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x248
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 0x37]
lea rcx, [rbp + 7]
call fcn.18000f130
mov rbx, rax
cmp dword [0x18010e3e4], 0xdea15642
jne 0x18000747c
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov dword [rbp + 0x67], 0x8000
mov dword [rbp + 0x77], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x1ea
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1ea
xor eax, eax
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], 0
mov qword [rbp - 0x1b], rdi
mov qword [rbp - 0x13], rdi
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], edi
mov dword [rbp - 0x25], edi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x27]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013350
nop
lea rcx, [rbp - 0x51]
call fcn.180016bd0
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], rdi
mov edx, 0x10
call fcn.18008019c
mov rax, rbx
add rsp, 0xe0
pop rdi
pop rbx
pop rbp
ret