Function at 0x180007580
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x180046400]
xor rax, rsp
mov qword [rsp + 0xb0], rax
lea rax, [0x180007330]
mov dword [rsp + 0x60], 0x50
mov qword [rsp + 0x68], rax
xor esi, esi
mov rax, qword [0x180048588]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x64], 3
mov qword [rsp + 0x70], rsi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x80], rax
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0xa8], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
xor ecx, ecx
mov qword [rsp + 0x88], rax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
lea rdi, str.Overlay
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x180007a6e
lea rdx, str.Halo:_The_Master_Chief_Collection
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180048670], rax
lea ebx, [rsi + 1]
test rax, rax
je 0x180007707
lea rdx, [0x180048688]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x180048670]
lea rdx, [0x1800486c8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x180048694]
mov r9d, 0x80000000
sub eax, dword [0x18004868c]
mov r8, rdi
mov ecx, dword [0x180048690]
mov rdx, rdi
sub ecx, dword [0x180048688]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [0x180048664], ecx
mov ecx, 0x80028
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
mov dword [0x180048678], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
lea rcx, str.Succesfully_got_hWnd_
mov qword [0x180048680], rax
call fcn.180008480
jmp 0x180007713
lea rcx, str.Unable_to_find_hWnd
call fcn.1800084b0
mov rcx, qword [0x180048680]
mov r9d, ebx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x180048680]
mov r9d, 2
mov r8b, 0xff
xor edx, edx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov rcx, qword [0x180048680]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdi, qword [0x180048680]
lea rdx, [0x1800485c8]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
js 0x180007a5a
mov eax, dword [0x180048664]
lea rdx, [0x1800485d8]
mov rcx, qword [0x1800485c8]
xor r9d, r9d
mov qword [rsp + 0x38], rdx
mov r8d, ebx
mov dword [0x1800485f0], eax
lea rdx, [0x1800485f0]
mov eax, dword [0x180048678]
mov dword [0x1800485f8], 0x15
mov dword [0x1800485f4], eax
mov dword [0x18004861c], ebx
mov dword [0x180048620], 0x50
mov qword [0x180048610], rdi
mov dword [0x180048604], esi
mov dword [0x180048608], ebx
mov dword [0x180048618], ebx
mov rax, qword [rcx]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0xa0]
test eax, eax
js 0x180007a5a
cmp qword [0x1800485b0], rsi
jne 0x180007820
mov rcx, qword [0x1800485d8]
lea rdx, [0x1800485b0]
call qword [sym.imp.d3dx9_43.dll_D3DXCreateLine]
mov rcx, qword [0x1800485d8]
mov eax, 0x66666667
imul dword [0x180048678]
mov r9d, 0x12c
xor r8d, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
lea rax, [0x1800485b8]
mov qword [rsp + 0x58], rax
lea rax, str.Arial
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
mov dword [0x1800485c0], edx
call qword [sym.imp.d3dx9_43.dll_D3DXCreateFontW]
lea rcx, str.D3D_Initiated
call fcn.1800084e0
xor dil, dil
mov qword [rsp + 0xd0], rbp
mov ecx, 0x7b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rdx, qword [0x180048680]
lea rcx, [0x180048698]
test ax, ax
movzx edi, dil
mov dword [rsp + 0x20], ebx
cmovne edi, ebx
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1800078f1
lea rcx, [0x180048698]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [0x180048698]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rdx, str.Halo:_The_Master_Chief_Collection
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x180048670], rax
test rax, rax
je 0x180007a79
lea rdx, [0x180048688]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [0x180048670]
lea rdx, [0x1800486c8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [0x180048690]
mov edx, 0xfffffff0
sub eax, dword [0x180048688]
mov rcx, qword [0x180048670]
mov dword [0x180048664], eax
mov eax, dword [0x180048694]
sub eax, dword [0x18004868c]
mov dword [0x180048678], eax
call qword [sym.imp.USER32.dll_GetWindowLongW]
mov r10d, dword [0x18004868c]
mov r11d, dword [0x180048688]
bt eax, 0x17
jae 0x1800079fa
mov eax, dword [0x180048690]
mov r9d, dword [0x180048694]
sub eax, r11d
mov esi, dword [0x1800486d4]
sub r9d, r10d
sub esi, dword [0x1800486cc]
mov ebp, dword [0x1800486d0]
sub ebp, dword [0x1800486c8]
mov dword [0x180048664], eax
sub eax, dword [0x1800486d0]
cdq
mov dword [0x180048678], r9d
sub eax, edx
mov dword [0x180046f64], esi
sar eax, 1
sub r9d, eax
mov dword [0x180046f60], ebp
sub r9d, dword [0x1800486d4]
add r11d, eax
add r10d, r9d
mov dword [0x18004867c], eax
mov dword [0x18004868c], r10d
mov dword [0x1800486d8], r9d
mov dword [0x180048688], r11d
jmp 0x180007a06
mov esi, dword [0x180046f64]
mov ebp, dword [0x180046f60]
mov rcx, qword [0x180048680]
mov r9d, ebp
mov dword [rsp + 0x28], ebx
mov r8d, r10d
mov edx, r11d
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_MoveWindow]
test dil, dil
je 0x1800078a0
mov rbp, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000d220
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, str.D3D_Failed_to_Initiate
call fcn.1800084b0
mov ecx, ebx
call fcn.1800181a0
int3
mov ecx, 1
call fcn.1800181a0
int3
xor ecx, ecx
call fcn.1800181a0
int3