Function at 0x180029150
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 1], 0
mov rbx, rcx
je 0x18002917a
lea rcx, str.GTA5.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [rax + 0x19b1d70], 0xbf800000
xor edi, edi
cmp byte [rbx + 2], dil
je 0x1800291df
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
inc dword [rax + 8]
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], reloc.WLDAP32.dll_Ordinal_27
inc dword [rax + 8]
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xfe99b66d079cf6bc
inc dword [rax + 8]
call fcn.1800263c0
call fcn.180026520
cmp byte [rbx + 3], dil
je 0x180029247
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xa6294919e56ff02a
inc dword [rax + 8]
call fcn.1800263c0
call fcn.180026520
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xa0ebb943c300e693
inc dword [rax + 8]
call fcn.1800263c0
call fcn.180026520
cmp byte [rbx + 4], dil
je 0x180029276
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180029276
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180029276
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbx + 5]
call fcn.18002b210
cmp byte [rbx + 6], dil
je 0x1800292a4
call fcn.180026520
movabs rcx, 0xd220bdd222ac4a1e
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800263c0
call fcn.180026520
cmp byte [rbx + 8], dil
je 0x1800292ff
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xbf286c554784f3df
inc dword [rax + 8]
call fcn.1800263c0
call fcn.180026520
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
jmp 0x18002934a
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xbf286c554784f3df
inc dword [rax + 8]
call fcn.1800263c0
call fcn.180026520
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
inc dword [rax + 8]
movabs rcx, 0x1098355a16064bb3
call fcn.1800263c0
call fcn.180026520
cmp byte [rbx + 9], dil
je 0x180029400
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xd821490579791273
inc dword [rax + 8]
call fcn.1800263c0
call fcn.180026520
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
lea rbx, str.scr_rcbarry2
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rcx + rdx*8], rbx
movabs rcx, 0xb80d8756b4668ab6
inc dword [rax + 8]
call fcn.1800263c0
call fcn.180026520
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov rcx, qword [rax + 0x10]
mov edx, dword [rax + 8]
mov qword [rcx + rdx*8], rbx
movabs rcx, 0x6c38af3693a69a91
jmp 0x180029424
call fcn.180026520
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026520
mov rcx, qword [rax + 0x10]
mov edx, dword [rax + 8]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xd821490579791273
inc dword [rax + 8]
call fcn.1800263c0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180026520