Function at 0x18000d0a0
Capabilities:
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov rax, qword [0x1802240e0]
xor rax, rsp
mov qword [rbp + 7], rax
mov r13, r9
mov r12, r8
mov esi, edx
mov r15, rcx
xor r14d, r14d
mov dword [rbp - 0x49], 1
cmp edx, 0x487
ja 0x18000d4af
je 0x18000d4a5
cmp edx, 0x112
ja 0x18000d21a
je 0x18000d1f8
cmp edx, 0x10
ja 0x18000d169
je 0x18000d15f
mov eax, edx
sub eax, 2
je 0x18000d152
sub eax, 1
je 0x18000d11e
cmp eax, 2
mov dword [rbp - 0x49], r14d
mov r9, r13
mov r8, r12
mov edx, esi
mov rcx, r15
call fcn.180134234
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.18017dee0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x18000d88e
call fcn.180014b70
jmp 0x18000d88e
mov eax, esi
sub eax, 0x4a
je 0x18000d1e8
sub eax, 0xb6
je 0x18000d182
cmp eax, 0x11
je 0x18000d898
jmp 0x18000d11e
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18000d11e
cmp r12, 0x56
jne 0x18000d11e
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x18000d88e
lea ecx, [r12 - 0x47]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x18000d1c2
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x18000d88e
mov ecx, InitCommonControls
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x18000d1dd
mov rdx, rax
mov rcx, r15
call fcn.180018730
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x18000d88e
mov r8, r13
mov rdx, r12
call fcn.18000f650
jmp 0x18000d88e
mov rax, qword [rcx]
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov edx, 0x112
mov rcx, r15
call qword [rax + 0xc8]
mov r14, rax
jmp 0x18000d88e
cmp esi, 0x20a
ja 0x18000d455
je 0x18000d11e
mov eax, esi
sub eax, 0x113
je 0x18000d248
sub eax, 0xed
je 0x18000d11e
cmp eax, 1
jmp 0x18000d11e
mov dword [rbp - 0x49], r14d
cmp r12d, 0x68
jne 0x18000d88e
mov ecx, dword [rcx + 0xb68]
inc ecx
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
sub ecx, eax
mov dword [r15 + 0xb68], ecx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1801c14e0]
movdqu xmmword [rbp - 0x29], xmm1
mov word [rbp - 0x39], r14w
lea r8d, [r12 - 0x4c]
lea rdx, str.pngpichome_vipmembermember
lea rcx, [rbp - 0x39]
call fcn.1800055c0
nop
mov edx, dword [r15 + 0xb68]
inc edx
lea rcx, [rbp - 0x19]
call fcn.18000acb0
nop
mov r9, rax
cmp qword [rax + 0x18], 8
jb 0x18000d2ca
mov r9, qword [rax]
mov rdx, qword [rax + 0x10]
mov rcx, qword [rbp - 0x29]
mov r8, qword [rbp - 0x21]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x18000d311
lea rdi, [rcx + rdx]
mov qword [rbp - 0x29], rdi
lea rbx, [rbp - 0x39]
cmp r8, 8
cmovae rbx, qword [rbp - 0x39]
lea r8, [rdx + rdx]
lea rcx, [rbx + rcx*2]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r14w
lea rbx, [rbp - 0x39]
jmp 0x18000d322
mov qword [rsp + 0x20], rdx
lea rcx, [rbp - 0x39]
call fcn.1800093d0
mov rbx, rax
mov rax, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
mov rcx, rdx
sub rcx, rax
cmp rcx, 4
jb 0x18000d364
lea rdi, [rax + 4]
mov qword [rbx + 0x10], rdi
cmp rdx, 8
jb 0x18000d347
mov rbx, qword [rbx]
lea rcx, [rbx + rax*2]
mov r8d, 8
lea rdx, str..png
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], r14w
jmp 0x18000d382
mov qword [rsp + 0x20], 4
lea r9, str..png
mov edx, 4
mov rcx, rbx
call fcn.1800093d0
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x18000d3c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d3c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d3c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18017df04
movdqa xmm0, xmmword [0x1801c14e0]
movdqu xmmword [rbp - 9], xmm0
mov word [rbp - 0x19], r14w
mov rcx, qword [r15 + 0xb70]
test rcx, rcx
je 0x18000d3fb
lea rdx, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rdx, qword [rbp - 0x39]
mov rax, qword [rcx]
call qword [rax + 0x310]
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x18000d43e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d439
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18017df04
movdqa xmm0, xmmword [0x1801c14e0]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], r14w
jmp 0x18000d88e
cmp esi, 0x233
je 0x18000d498
cmp esi, 0x2e0
je 0x18000d47b
cmp esi, 0x486
jne 0x18000d11e
call fcn.1800190a0
jmp 0x18000d88e
mov rax, qword [rcx]
movzx edx, r12w
call qword [rax + 0x120]
lea rcx, [r15 + 0x58]
mov edx, eax
call fcn.18012fff0
jmp 0x18000d11e
mov rdx, r12
call fcn.180018730
jmp 0x18000d88e
call fcn.180018e10
jmp 0x18000d88e
cmp esi, 0x18b4
ja 0x18000d76d
je 0x18000d753
cmp esi, 0x6bc
ja 0x18000d734
je 0x18000d63e
mov eax, esi
sub eax, 0x488
je 0x18000d571
sub eax, 1
je 0x18000d471
cmp eax, 1
jne 0x18000d11e
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1801c14e0]
movdqu xmmword [rbp - 0x29], xmm1
mov word [rbp - 0x39], r14w
lea r8d, [rax + 6]
lea rdx, str.2345Pic
lea rcx, [rbp - 0x39]
call fcn.1800055c0
nop
lea rcx, [rbp - 0x39]
call fcn.1800e3970
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x18000d43e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d439
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
movsxd rbx, r13d
mov rax, qword [0x18022ad80]
sub rax, qword [0x18022ad78]
sar rax, 5
cmp rbx, rax
jae 0x18000d898
call fcn.1800240b0
cmp byte [rax + 0xa8], r14b
jne 0x18000d626
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1801c14e0]
movdqu xmmword [rbp - 0x29], xmm1
mov word [rbp - 0x39], r14w
mov r8d, 7
lea rdx, str.2345Pic
lea rcx, [rbp - 0x39]
call fcn.1800055c0
nop
lea rcx, [rbp - 0x39]
call fcn.1800e34f0
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x18000d43e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d439
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
shl rbx, 5
add rbx, qword [0x18022ad78]
mov rcx, rbx
call fcn.1800e3730
jmp 0x18000d88e
xorps xmm0, xmm0
movdqa xmm1, xmmword [0x1801c14e0]
mov word [rbp - 0x39], r14w
lea rcx, [rbp - 0x39]
movdqu xmmword [rbp - 0x29], xmm0
movdqu xmmword [rbp - 0x29], xmm1
test r12d, r12d
jne 0x18000d6ca
lea r8d, [r12 + 0x22]
lea rdx, str.Opening_login_page__please_wait...
call fcn.1800055c0
nop
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.18000de70
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x18000d43e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d439
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, 0x25
lea rdx, str.Opening_member_center__please_wait...
call fcn.1800055c0
nop
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.18000de70
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x18000d43e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d439
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d439
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp esi, 0x1788
je 0x18000d753
lea eax, [rdx - 0x17ec]
cmp eax, 1
jbe 0x18000d753
cmp esi, 0x1850
jne 0x18000d11e
call fcn.1800240b0
mov rcx, rax
call fcn.1800242c0
mov rcx, r15
call fcn.18000d8a0
jmp 0x18000d88e
cmp esi, 0x1f5a
ja 0x18000d868
je 0x18000d1e8
mov eax, esi
sub eax, 0x1b70
je 0x18000d7b5
sub eax, 0x3e8
je 0x18000d7a5
cmp eax, 1
jne 0x18000d11e
mov rdx, r12
call fcn.18000f420
jmp 0x18000d88e
mov r8, r13
mov rdx, r12
call fcn.18000fae0
jmp 0x18000d88e
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1801c14e0]
movdqu xmmword [rbp - 0x29], xmm1
mov word [rbp - 0x39], r14w
mov r8d, 7
lea rdx, str.btn_all
lea rcx, [rbp - 0x39]
call fcn.1800055c0
nop
cmp qword [r15 + 0xbe8], 0
je 0x18000d7fd
lea rdx, [rbp - 0x39]
mov rcx, r15
call fcn.1800191d0
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x18000d840
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000d83b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000d83b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18017df04
movdqa xmm0, xmmword [0x1801c14e0]
movdqu xmmword [rbp - 0x29], xmm0
mov word [rbp - 0x39], r14w
lea rcx, [r15 + 0x930]
call fcn.180022330
mov rcx, r15
call fcn.1800175f0
jmp 0x18000d88e
mov eax, esi
sub eax, 0x1fbc
je 0x18000d889
cmp eax, 1
jne 0x18000d11e
movzx ecx, al
call fcn.1800d30b0
call fcn.1800d3b90
jmp 0x18000d88e
call fcn.180017b10
cmp dword [rbp - 0x49], 0
je 0x18000d122
mov rax, r14
jmp 0x18000d132