Function at 0x18000ad18
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor esi, esi
mov rbx, r9
cmp byte [0x1800f6169], sil
mov rdi, r8
mov r11, rdx
je 0x18000b081
mov rax, qword [rdx]
mov rcx, r11
xor edx, edx
mov r10, qword [rax + 0x1d8]
call r10
test rax, rax
je 0x18000b081
mov r9, qword [rax + 0x10]
test r9, r9
je 0x18000b081
mov r8, qword [rsp + 0x60]
lea r10d, [rsi + 0xd]
mov rdx, qword [r8 + 0x70]
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000ad90
cmp word [rax + 0x1c], r10w
jge 0x18000ad8a
mov rax, qword [rax + 0x10]
jmp 0x18000ad90
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000ad7d
cmp byte [rcx + 0x19], sil
jne 0x18000adb9
cmp r10w, word [rcx + 0x1c]
jl 0x18000adb9
cmp rcx, rdx
je 0x18000adb9
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
mov rdx, qword [r8 + 0x70]
mov r10d, 0xe
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000addf
cmp word [rax + 0x1c], r10w
jge 0x18000add9
mov rax, qword [rax + 0x10]
jmp 0x18000addf
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000adcc
cmp byte [rcx + 0x19], sil
jne 0x18000ae08
cmp r10w, word [rcx + 0x1c]
jl 0x18000ae08
cmp rcx, rdx
je 0x18000ae08
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
mov rdx, qword [r8 + 0x70]
mov r10d, 0x3a
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000ae2e
cmp word [rax + 0x1c], r10w
jge 0x18000ae28
mov rax, qword [rax + 0x10]
jmp 0x18000ae2e
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000ae1b
cmp byte [rcx + 0x19], sil
jne 0x18000ae57
cmp r10w, word [rcx + 0x1c]
jl 0x18000ae57
cmp rcx, rdx
je 0x18000ae57
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
mov rdx, qword [r8 + 0x70]
mov r10d, 0x3b
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000ae7d
cmp word [rax + 0x1c], r10w
jge 0x18000ae77
mov rax, qword [rax + 0x10]
jmp 0x18000ae7d
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000ae6a
cmp byte [rcx + 0x19], sil
jne 0x18000aea6
cmp r10w, word [rcx + 0x1c]
jl 0x18000aea6
cmp rcx, rdx
je 0x18000aea6
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
mov rdx, qword [r8 + 0x70]
mov r10d, 0x3f
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000aecc
cmp word [rax + 0x1c], r10w
jge 0x18000aec6
mov rax, qword [rax + 0x10]
jmp 0x18000aecc
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000aeb9
cmp byte [rcx + 0x19], sil
jne 0x18000aef5
cmp r10w, word [rcx + 0x1c]
jl 0x18000aef5
cmp rcx, rdx
je 0x18000aef5
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
mov rdx, qword [r8 + 0x70]
mov r10d, 0x55
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000af1b
cmp word [rax + 0x1c], r10w
jge 0x18000af15
mov rax, qword [rax + 0x10]
jmp 0x18000af1b
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000af08
cmp byte [rcx + 0x19], sil
jne 0x18000af44
cmp r10w, word [rcx + 0x1c]
jl 0x18000af44
cmp rcx, rdx
je 0x18000af44
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
mov rdx, qword [r8 + 0x70]
mov r10d, 0x57
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000af6a
cmp word [rax + 0x1c], r10w
jge 0x18000af64
mov rax, qword [rax + 0x10]
jmp 0x18000af6a
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000af57
cmp byte [rcx + 0x19], sil
jne 0x18000af93
cmp r10w, word [rcx + 0x1c]
jl 0x18000af93
cmp rcx, rdx
je 0x18000af93
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
mov rdx, qword [r8 + 0x70]
mov r8d, 0x56
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000afb9
cmp word [rax + 0x1c], r8w
jge 0x18000afb3
mov rax, qword [rax + 0x10]
jmp 0x18000afb9
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], sil
je 0x18000afa6
cmp byte [rcx + 0x19], sil
jne 0x18000afe2
cmp r8w, word [rcx + 0x1c]
jl 0x18000afe2
cmp rcx, rdx
je 0x18000afe2
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x24]
mov qword [rcx + 0x20], rax
xor eax, eax
mov word [rsp + 0x20], 0x2f2b
mov byte [rsp + 0x22], al
mov r8d, esi
movsxd rdx, r8d
lea eax, [r8 + 0x40]
inc r8d
xor byte [rsp + rdx + 0x20], al
cmp r8d, 2
jb 0x18000aff2
mov rax, qword [r9]
mov rcx, r9
mov byte [rsp + 0x22], sil
mov rdx, qword [rax + 0x60]
call rdx
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180070c68
test rax, rax
je 0x18000b081
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18000b081
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x30]
cmp eax, 0x32
ja 0x18000b057
movabs rcx, 0x600000003e068
bt rcx, rax
jb 0x18000b081
cmp byte [0x1800f6130], sil
jne 0x18000b081
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x1800f5f60], rax
jne 0x18000b081
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x58]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x60]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret