Function at 0x18000b900
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x68
cmp byte [0x180109380], 0
je 0x18000bbf9
mov rax, qword [0x1801096d0]
lea rdx, [0x180107158]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x180109620]
add rcx, qword [rax + 8]
call fcn.18000bc40
mov rcx, qword [0x180107158]
lea rdx, [0x180107164]
add rcx, 0x13b0
call fcn.18000bce0
mov r8d, dword [0x180107164]
cmp r8d, 0xffffffff
je 0x18000bbf9
mov rax, qword [0x1801095f8]
mov edx, r8d
mov qword [rsp + 0x78], rbx
shr edx, 9
and edx, 0x3f
mov qword [rsp + 0x80], rsi
mov rbx, qword [rax + 0x108]
movabs rsi, 0x7ffd5d15ff558
add rbx, 0x10
shl edx, 3
mov qword [rsp + 0x60], rdi
add rbx, rdx
je 0x18000b9f8
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x18000b9f8
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000b9f1
cmp dword [rsp + 0x50], 0x1000
jne 0x18000b9f1
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000b9f1
test al, 0x66
je 0x18000b9f1
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x18000b9f1
mov rbx, qword [rbx]
mov r8d, dword [0x180107164]
and r8d, 0x1ff
imul ecx, r8d, 0x78
add rbx, rcx
je 0x18000ba5c
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x18000ba5c
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000ba5c
cmp dword [rsp + 0x50], 0x1000
jne 0x18000ba5c
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000ba5c
test al, 0x66
je 0x18000ba5c
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 8
jb 0x18000ba5c
mov rbx, qword [rbx]
mov rax, qword [0x1801096d0]
mov edi, dword [rax + 0x38]
add rdi, rbx
je 0x18000bac0
lea rax, [rdi - 0xaa70aa8]
cmp rax, rsi
ja 0x18000bac0
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000bac0
cmp dword [rsp + 0x50], 0x1000
jne 0x18000bac0
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000bac0
test al, 0x66
je 0x18000bac0
mov rax, qword [rsp + 0x30]
sub rax, rdi
add rax, qword [rsp + 0x48]
cmp rax, 4
jb 0x18000bac0
mov edi, dword [rdi]
jmp 0x18000bac4
mov edi, dword [rsp + 0x70]
mov rax, qword [0x1801096d0]
mov ecx, dword [rax + 0x28]
add rbx, rcx
je 0x18000bb28
lea rax, [rbx - 0xaa70aa8]
cmp rax, rsi
ja 0x18000bb28
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18000bb28
cmp dword [rsp + 0x50], 0x1000
jne 0x18000bb28
mov eax, dword [rsp + 0x54]
test eax, 0x101
jne 0x18000bb28
test al, 0x66
je 0x18000bb28
mov rax, qword [rsp + 0x30]
sub rax, rbx
add rax, qword [rsp + 0x48]
cmp rax, 4
jb 0x18000bb28
mov eax, dword [rbx]
jmp 0x18000bb2c
mov eax, dword [rsp + 0x70]
cmp byte [0x180109381], 0
mov rsi, qword [rsp + 0x80]
je 0x18000bb49
cmp dword [0x180107160], eax
je 0x18000bbef
test edi, edi
jle 0x18000bbef
mov ecx, dword [0x180108630]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov eax, dword [rdx + rax]
cmp dword [0x180109830], eax
jg 0x18000bbfe
lea rcx, [rsp + 0x70]
call fcn.18000b820
cvttss2si rax, dword [0x1800becec]
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
sub rcx, qword [0x180109828]
imul rax, rax, 0xf4240
cmp rcx, rax
jl 0x18000bbef
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x18000bbe8
xor edi, edi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [0x180109828], rbx
mov rbx, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x60]
add rsp, 0x68
ret
lea rcx, [0x180109830]
call fcn.180064e3c
cmp dword [0x180109830], 0xffffffff
jne 0x18000bb78
lea rcx, [0x180109828]
call fcn.18000b820
lea rcx, [0x180109830]
call fcn.180064dd0
jmp 0x18000bb78