Function at 0x180052120
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x98
mov rax, qword [0x1801203c0]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov rdi, qword [rbp + 0x7f]
mov r15, r9
mov rbx, r8
mov r14, rcx
call fcn.18000c130
mov rsi, rax
sub rsi, qword [rbx]
cmp byte [0x180143b71], 0
mov qword [rbp - 0x39], rsi
je 0x180052179
cmp byte [0x180143ba1], 0
je 0x180052179
mov byte [rdi], 1
jmp 0x18005238c
cmp byte [0x180143b68], 0
lea rdx, [rbp - 0x49]
mov ebx, 8
mov rcx, r15
je 0x180052253
lea r8, [rbp + 0xf]
mov dword [rbp + 0xf], ebx
call fcn.180086220
mov rcx, qword [rax]
cmp qword [rcx + 0x18], 0
je 0x1800521d2
lea r8, [rbp - 0x51]
mov dword [rbp - 0x51], ebx
lea rdx, [rbp - 0x49]
mov rcx, r15
call fcn.180086220
mov rcx, qword [rax]
mov rax, rsi
sub rax, qword [rcx + 0x18]
cmp rax, 0x1f4
jge 0x1800521d2
xor dil, dil
jmp 0x1800521d5
mov dil, 1
lea r8, [rbp - 0x51]
mov dword [rbp - 0x51], ebx
lea rdx, [rbp - 0x49]
mov rcx, r15
call fcn.180086220
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rax]
test rdx, rdx
je 0x18005238c
test dil, dil
jne 0x18005220e
mov rax, rsi
sub rax, qword [rcx + 0x18]
cmp rax, 0x32
jl 0x18005238c
lea rax, [rdx - 1]
mov qword [r14 + 0x10], rax
cmp qword [r14 + 0x18], 0xf
jbe 0x180052220
mov r14, qword [r14]
lea r8, [rbp - 0x51]
mov byte [r14 + rax], 0
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x51], ebx
mov rcx, r15
call fcn.180086220
neg dil
sbb rcx, rcx
mov rax, qword [rax]
and ecx, 0x1f4
add rcx, rsi
mov qword [rax + 0x18], rcx
jmp 0x18005238c
lea r8, [rbp - 0x51]
mov qword [rsp + 0x90], r13
mov dword [rbp - 0x51], ebx
call fcn.180086220
mov dword [rbp + 0xf], ebx
lea r13, [0x180000000]
mov qword [rsp + 0xd8], r12
mov rdx, qword [rax]
mov qword [rdx + 0x18], 0
nop dword [rax]
nop dword [rax + rax]
mov edx, 2
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp qword [0x1801448a8], 0xf
lea rdi, [0x180144890]
mov r8, qword [0x1801448a0]
mov ebx, eax
cmova rdi, qword [0x180144890]
test r8, r8
je 0x18005253e
movsx r12d, al
mov rcx, rdi
mov edx, r12d
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x18005253e
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x18005253e
movsxd rax, dword [rbp + 0xf]
cmp byte [rax + r13 + 0x143b60], 0
je 0x18005253e
lea r8, [rbp + 0xf]
mov rcx, r15
lea rdx, [rbp - 0x31]
call fcn.180086220
mov rcx, qword [rax]
cmp qword [rcx + 0x18], 0
je 0x1800523a8
lea r8, [rbp + 0xf]
mov rcx, r15
lea rdx, [rbp - 0x21]
call fcn.180086220
mov rcx, qword [rax]
mov rax, rsi
sub rax, qword [rcx + 0x18]
cmp rax, 0x1f4
jge 0x1800523a8
lea r8, [rbp + 0xf]
mov rcx, r15
lea rdx, [rbp - 0x49]
xor r13b, r13b
call fcn.180086220
mov rcx, qword [rax]
mov rax, rsi
sub rax, qword [rcx + 0x18]
cmp rax, 0x32
jge 0x1800523bb
lea r13, [0x180000000]
mov ebx, dword [rbp + 0xf]
inc ebx
mov dword [rbp + 0xf], ebx
cmp ebx, 0x100
jle 0x180052290
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0xd8]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1800906c0
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea r8, [rbp + 0xf]
mov rcx, r15
lea rdx, [rbp - 0x49]
mov r13b, 1
call fcn.180086220
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
mov ecx, setsockopt
shr edi, 0xf
call qword [sym.imp.USER32.dll_GetKeyState]
movzx esi, ax
and sil, 1
and dil, 1
je 0x1800523e9
test sil, sil
jne 0x1800523f5
mov ecx, r12d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
movzx ebx, al
test dil, dil
jne 0x18005243f
test sil, sil
je case.0x180052472.40
movsx edi, bl
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
movzx ebx, al
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
cmp rcx, rdx
jae 0x180052503
lea rax, [rcx + 1]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0xf
jbe 0x180052432
mov rax, qword [r14]
mov byte [rax + rcx], bl
mov byte [rax + rcx + 1], 0
jmp 0x18005250f
movsx edi, bl
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
jne 0x180052402
add edi, 0xffffffd9
cmp edi, 0x57
ja case.0x180052472.40
lea rdx, [0x180000000]
movsxd rax, edi
movzx eax, byte [rdx + rax + 0x525c0]
mov ecx, dword [rdx + rax*4 + 0x52560]
add rcx, rdx
jmp rcx
mov bl, 0x21
jmp case.0x180052472.40
mov bl, 0x40
jmp case.0x180052472.40
mov bl, 0x23
jmp case.0x180052472.40
mov bl, 0x24
jmp case.0x180052472.40
mov bl, 0x25
jmp case.0x180052472.40
mov bl, 0x5e
jmp case.0x180052472.40
mov bl, 0x26
jmp case.0x180052472.40
mov bl, 0x2a
jmp case.0x180052472.40
mov bl, 0x28
jmp case.0x180052472.40
mov bl, 0x29
jmp case.0x180052472.40
mov bl, 0x5f
jmp case.0x180052472.40
mov bl, 0x2b
jmp case.0x180052472.40
mov bl, 0x7b
jmp case.0x180052472.40
mov bl, 0x7d
jmp case.0x180052472.40
mov bl, 0x3a
jmp case.0x180052472.40
mov bl, 0x3c
jmp case.0x180052472.40
mov bl, 0x3e
jmp case.0x180052472.40
mov bl, 0x3f
jmp case.0x180052472.40
mov bl, 0x7e
jmp case.0x180052472.40
mov bl, 0x60
jmp case.0x180052472.40
mov bl, 0x22
jmp case.0x180052472.40
mov bl, 0x7c
jmp case.0x180052472.40
mov bl, 0x5c
jmp case.0x180052472.40
movzx r9d, bl
mov rcx, r14
call fcn.18003bed0
lea r8, [rbp + 0xf]
mov rcx, r15
lea rdx, [rbp - 0x11]
call fcn.180086220
mov rsi, qword [rbp - 0x39]
neg r13b
sbb rcx, rcx
mov rax, qword [rax]
and ecx, 0x1f4
add rcx, rsi
mov qword [rax + 0x18], rcx
jmp 0x180052361
lea r8, [rbp + 0xf]
mov rcx, r15
lea rdx, [rbp - 1]
call fcn.180086220
mov rcx, qword [rax]
mov qword [rcx + 0x18], 0
jmp 0x180052368