Function at 0x1800211d0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r13
push r14
mov rbp, rsp
sub rsp, 0x80
mov r13, rdx
mov ecx, r8d
xor edx, edx
mov edi, r8d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov r8d, 0x20
mov ecx, eax
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xorps xmm0, xmm0
lea rax, [rbp - 0x20]
mov rsi, 0xffffffffffffffff
movups xmmword [rbp - 0x40], xmm0
mov rbx, rsi
inc rbx
cmp byte [rax + rbx], 0
jne 0x180021221
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x1800215a8
mov qword [rsp + 0xb0], r12
movabs rax, 0x8000000000000000
mov qword [rsp + 0xb8], r15
mov ecx, 0x16
cmp rbx, 0xf
ja 0x180021291
mov r8, rbx
mov qword [rbp - 0x30], rbx
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x28], 0xf
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x40], 0
mov r15, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
mov r12, qword [rbp - 0x40]
jmp 0x18002130d
mov r15, rbx
or r15, 0xf
cmp r15, r14
jbe 0x1800212c4
mov r15, r14
add rax, 0x27
mov rcx, rax
call fcn.180111264
test rax, rax
je 0x180021529
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x1800212f9
cmp r15, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
test rcx, rcx
jne 0x1800212d9
xor r12d, r12d
jmp 0x1800212f9
cmp rcx, 0x1000
jb 0x1800212f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18002159c
jmp 0x1800212a4
call fcn.180111264
mov r12, rax
mov r8, rbx
lea rdx, [rbp - 0x20]
mov rcx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], 0
test rbx, rbx
sete bl
cmp r15, 0xf
jbe 0x18002134b
lea rdx, [r15 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x180021343
mov r12, qword [r12 - 8]
add rdx, 0x27
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021529
mov rcx, r12
call fcn.180111228
test bl, bl
je 0x180021538
lea r15, [rbp - 0x43]
test edi, edi
jns 0x1800213a0
neg edi
nop dword [rax]
dec r15
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r15], dil
mov edi, edx
test edx, edx
jne 0x180021360
dec r15
mov byte [r15], 0x2d
jmp 0x1800213c8
dec r15
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r15], dil
mov edi, edx
test edx, edx
jne 0x1800213a0
lea rax, [rbp - 0x43]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
cmp r15, rax
jne 0x1800213fc
movdqa xmm0, xmmword [0x180196230]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rbx, qword [rbp - 0x40]
psrldq xmm0, 8
movq r14, xmm0
jmp 0x1800214d6
lea rdi, [rbp - 0x43]
sub rdi, r15
cmp rdi, r14
ja 0x180021596
cmp rdi, 0xf
ja 0x18002143f
mov r8, rdi
mov qword [rbp - 0x30], rdi
mov rdx, r15
mov qword [rbp - 0x28], 0xf
lea rcx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi - 0x40], 0
mov r14, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x40]
jmp 0x1800214d6
mov rax, rdi
or rax, 0xf
cmp rax, r14
jbe 0x180021474
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180111264
test rax, rax
je 0x1800214a9
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1800214b8
cmp rax, 0x16
mov r14, rax
mov eax, 0x16
cmovb r14, rax
lea rcx, [r14 + 1]
test rcx, rcx
jne 0x180021491
xor ebx, ebx
jmp 0x1800214b8
cmp rcx, 0x1000
jb 0x1800214b0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800215a2
jmp 0x180021459
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180111264
mov rbx, rax
mov r8, rdi
mov qword [rbp - 0x40], rbx
mov rdx, r15
mov qword [rbp - 0x30], rdi
mov rcx, rbx
mov qword [rbp - 0x28], r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
cmp r14, 0xf
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x20]
cmova rcx, rbx
sub rdx, rcx
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800214f0
cmp r14, 0xf
jbe 0x180021538
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180021530
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180021530
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.180111228
xorps xmm0, xmm0
lea rax, [rbp - 0x20]
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
mov qword [r13 + 0x18], 0
inc rsi
cmp byte [rax + rsi], 0
jne 0x180021554
mov r8, rsi
lea rdx, [rbp - 0x20]
mov rcx, r13
call fcn.18001bf20
mov r12, qword [rsp + 0xb0]
mov rax, r13
mov r15, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
call fcn.18001d640
int3
call fcn.18001db70
int3
call fcn.18001db70
int3
call fcn.18001d640
int3