Function at 0x18000bbb0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push r15
sub rsp, 0x50
mov rax, qword [0x18007a040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
lea rdx, [rsp + 0x30]
lea rcx, [0x18007ac50]
mov dword [rsp + 0x30], ebx
call fcn.18000f6e0
movabs rsi, 0x142378188
mov r15, rax
mov rsi, qword [rsi]
test rsi, rsi
je 0x18000bea3
mov rcx, qword [rsi + 0xd0]
test rcx, rcx
je 0x18000bea3
mov rdx, qword [rcx]
mov qword [rsp + 0x88], r14
mov r8, qword [rdx + 0x68]
call r8
mov r14, rax
test rax, rax
je 0x18000be9b
mov rcx, qword [rax]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
mov r8, qword [rcx + 0x470]
mov rcx, rax
call r8
test al, al
jne 0x18000bc4b
mov qword [rsp + 0x38], rbx
jmp 0x18000bc50
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x18000be9b
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
mov r8, qword [rax + 0x1d8]
call r8
test rax, rax
je 0x18000be9b
mov qword [rsp + 0x78], rdi
lea rdi, [rax + 0x28]
test rdi, rdi
je 0x18000be96
mov rdi, qword [rdi + 8]
test rdi, rdi
je 0x18000be96
mov rcx, qword [rsi + 0xe0]
test rcx, rcx
je 0x18000be96
mov rax, qword [rcx]
mov rdx, qword [rax + 0xa8]
call rdx
mov rsi, rax
test rax, rax
je 0x18000be96
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x30]
mov rcx, rax
call rdx
mov rdx, rax
test rax, rax
je 0x18000be96
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x80], r12
movabs r12, 0x14148ed80
nop word [rax + rax]
mov rcx, qword [rdx]
mov rax, qword [rcx + 8]
mov rcx, rdx
call rax
mov rcx, qword [r14]
mov ebx, eax
mov rdx, qword [rcx + 0xc8]
mov rcx, r14
call rdx
mov edx, ebx
mov rcx, qword [rax]
mov r8, qword [rcx + 0x78]
mov rcx, rax
call r8
mov rbx, rax
test rax, rax
je 0x18000be71
cmp byte [r15], 0
je 0x18000be71
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x18000be71
mov ebp, 0xa
nop word [rax + rax]
mov edx, dword [rbx + 0x20]
xor r9d, r9d
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 1
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 2
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 3
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
xor r9d, r9d
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 1
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 2
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 3
mov r8d, edx
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
xor r9d, r9d
mov r8d, 0xbad1d01
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 1
mov r8d, 0xbad1d01
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 2
mov r8d, 0xbad1d01
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
mov edx, dword [rbx + 0x20]
mov r9d, 3
mov r8d, 0xbad1d01
mov byte [rsp + 0x20], 0
mov rcx, rdi
call r12
sub rbp, 1
jne 0x18000bd50
mov rax, qword [rsi]
mov rcx, rsi
mov rdx, qword [rax + 0x30]
call rdx
mov rdx, rax
test rax, rax
jne 0x18000bcf0
mov r12, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18003ff40
add rsp, 0x50
pop r15
pop rsi
pop rbx
ret