Function at 0x18000b470
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x68
cmp byte [0x18013cdb0], 0
je 0x18000b769
mov rax, qword [0x18013cfd0]
lea rdx, [0x18013b800]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x18013cf00]
add rcx, qword [rax + 8]
call fcn.18000b7b0
mov rcx, qword [0x18013b800]
lea rdx, [0x18013b80c]
add rcx, 0x13b0
call fcn.18000b850
mov r8d, dword [0x18013b80c]
cmp r8d, 0xffffffff
je 0x18000b769
mov rax, qword [0x18013ced0]
mov edx, r8d
mov qword [rsp + 0x78], rbx
shr edx, 9
and edx, 0x3f
mov qword [rsp + 0x80], rsi
mov rbx, qword [rax + 0x108]
movabs rsi, 0x7ffd5d15ff558
add rbx, 0x10
shl edx, 3
mov qword [rsp + 0x60], rdi
add rbx, rdx
je 0x18000b568
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x18000b568
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000b561
cmp dword [rsp + 0x50], 0x1000
jne 0x18000b561
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000b561
test al, 0x66
je 0x18000b561
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x18000b561
mov rbx, qword [rbx]
mov r8d, dword [0x18013b80c]
and r8d, 0x1ff
imul ecx, r8d, 0x78
add rbx, rcx
je 0x18000b5cc
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x18000b5cc
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000b5cc
cmp dword [rsp + 0x50], 0x1000
jne 0x18000b5cc
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000b5cc
test al, 0x66
je 0x18000b5cc
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x18000b5cc
mov rbx, qword [rbx]
mov rax, qword [0x18013cfd0]
mov edi, dword [rax + 0x38]
add rdi, rbx
je 0x18000b630
lea rax, [rdi - 0xaa70aa8]
cmp rax, rsi
ja 0x18000b630
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000b630
cmp dword [rsp + 0x50], 0x1000
jne 0x18000b630
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000b630
test al, 0x66
je 0x18000b630
mov rax, qword [rsp + 0x30]
sub rax, rdi
add rax, qword [rsp + 0x48]
cmp rax, 4
jb 0x18000b630
mov edi, dword [rdi]
jmp 0x18000b634
mov edi, dword [rsp + 0x70]
mov rax, qword [0x18013cfd0]
mov ecx, dword [rax + 0x28]
add rbx, rcx
je 0x18000b698
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x18000b698
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000b698
cmp dword [rsp + 0x50], 0x1000
jne 0x18000b698
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000b698
test al, 0x66
je 0x18000b698
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 4
jb 0x18000b698
mov eax, dword [rbx]
jmp 0x18000b69c
mov eax, dword [rsp + 0x70]
cmp byte [0x18013cdb8], 0
mov rsi, qword [rsp + 0x80]
je 0x18000b6b9
cmp dword [0x18013b808], eax
je 0x18000b75f
test edi, edi
jle 0x18000b75f
mov ecx, dword [0x18013c160]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x18013d130], eax
jg 0x18000b76e
lea rcx, [rsp + 0x70]
call fcn.180007cf0
movsxd rax, dword [0x18013cdb4]
mov rbx, qword [rsp + 0x70]
imul rax, rax, 0xf4240
mov rcx, rbx
sub rcx, qword [0x18013d128]
cmp rcx, rax
je 0x18000b716
jl 0x18000b75f
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000b758
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [0x18013d128], rbx
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rcx, [0x18013d130]
call fcn.18004ea38
cmp dword [0x18013d130], 0xffffffff
jne 0x18000b6e8
lea rcx, [0x18013d128]
call fcn.180007cf0
lea rcx, [0x18013d130]
call fcn.18004e9cc
jmp 0x18000b6e8