Function at 0x18009a4c0
Capabilities:
Check for unmoving mouse cursor
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x13d0
call fcn.1800cbf60
sub rsp, rax
mov rax, qword [0x180101040]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov r14, rcx
cmp byte [rcx + 0x48], 0
je 0x18009a247
cmp byte [0x1801c55d0], 0
jne 0x18009a247
mov rbx, qword [0x1801c55e0]
mov rax, qword [0x1801c5628]
mov rdx, qword [rax]
mov rax, qword [rbx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801c5778]
mov rcx, rbx
call r9
mov rdx, qword [rbx]
mov r9, qword [rdx + 0xc0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call r9
test al, al
jne 0x180099dd7
mov rax, qword [r14 + 0x98]
cmp qword [rax + 8], 0
je 0x18009a247
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
mov rbp, rdx
sar rbp, 0xb
mov rax, rbp
shr rax, 0x3f
add rbp, rax
mov eax, dword [0x1801c514c]
test eax, eax
jne 0x180099e10
mov eax, ebp
mov dword [0x1801c514c], eax
mov ecx, ebp
sub ecx, eax
mov eax, 0x3e8
cdq
idiv dword [str._n_n_n_n]
cmp ecx, eax
jl 0x18009a247
mov edi, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18009a247
mov rcx, qword [0x1801c55e0]
mov rax, qword [0x1801c5628]
mov rdx, qword [rax]
mov rax, qword [rcx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801c58f0]
call r9
mov rsi, rax
test rax, rax
je 0x180099ea3
mov rcx, qword [0x1801c55e0]
mov rdx, qword [rcx]
mov r8, qword [rdx + 0xa8]
mov rdx, rax
call r8
mov rbx, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [0x1801c55e0]
mov rdx, qword [rcx]
mov r8, qword [rdx + 0xb8]
mov rdx, rsi
call r8
jmp 0x180099eaa
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov rax, qword [r14 + 0x88]
cmp qword [rax + 8], 0
je 0x18009a06a
mov rsi, qword [0x1801c55e0]
test rbx, rbx
je 0x18009a032
mov rdx, rbx
mov rcx, rsi
cmp dword [0x1801bd154], 7
jne 0x180099f71
mov r8, qword [0x1801c5b00]
call fcn.18004e0e0
mov r15, rax
test rax, rax
je 0x18009a06a
mov rcx, qword [rsi]
mov r8, qword [rcx + 0xf8]
mov rdx, rax
mov rcx, rsi
call r8
mov r12, rax
test rax, rax
je 0x18009a06a
mov rcx, qword [rsi]
mov r10, qword [rcx + 0x480]
lea r9, str.Lnet_minecraft_world_phys_HitResult_Type_
lea r8, str.BLOCK
mov rdx, rax
mov rcx, rsi
call r10
test rax, rax
je 0x18009a06a
mov rdx, qword [rsi]
mov r9, qword [rdx + 0x488]
mov r8, rax
mov rdx, r12
mov rcx, rsi
call r9
test rax, rax
je 0x18009a06a
mov rdx, qword [rsi]
mov r9, qword [rdx + 0xc0]
mov r8, r15
jmp 0x18009a020
mov rax, qword [rsi]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801c57d8]
call r9
mov r12, rax
test rax, rax
je 0x18009a06a
mov rcx, qword [rsi]
mov r8, qword [rcx + 0xf8]
mov rdx, rax
mov rcx, rsi
call r8
mov r15, rax
test rax, rax
je 0x18009a06a
mov ecx, dword [0x1801bd154]
test ecx, ecx
je 0x180099fd2
cmp ecx, 6
je 0x180099fd2
mov rcx, qword [rsi]
mov r10, qword [rcx + 0x480]
lea r9, str.Lnet_minecraft_util_MovingObjectPosition_MovingObjectType_
jmp 0x180099fe3
mov rax, qword [rsi]
mov r10, qword [rax + 0x480]
lea r9, str.Lnet_minecraft_util_math_RayTraceResult_Type_
lea r8, str.BLOCK
mov rdx, r15
mov rcx, rsi
call r10
mov r8, rax
test rax, rax
je 0x18009a06a
mov rax, qword [rsi]
mov r9, qword [rax + 0x488]
mov rdx, r15
mov rcx, rsi
call r9
test rax, rax
je 0x18009a06a
mov rcx, qword [rsi]
mov r9, qword [rcx + 0xc0]
mov r8, r12
mov rdx, rax
mov rcx, rsi
call r9
test al, al
setne al
test al, al
je 0x18009a06a
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x2c]
shl r9d, 0x10
movzx eax, word [rsp + 0x28]
or r9, rax
mov r8, rdi
mov edx, 0x201
mov rcx, qword [0x1801c5670]
call qword [sym.imp.USER32.dll_PostMessageA]
nop
jmp 0x18009a225
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov r8, rdi
mov edx, 0x201
mov rcx, qword [0x1801c5670]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov r8, rdi
mov edx, 0x202
mov rcx, qword [0x1801c5670]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [r14 + 0x90]
cmp qword [rax + 8], 0
je 0x18009a159
mov ecx, dword [0x1801c5338]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov rax, qword [r14 + 0x80]
ucomiss xmm0, dword [rax + 8]
jp 0x18009a151
jne 0x18009a151
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1801c5670]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1801c5670]
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x1801c5338], 0
jmp 0x18009a159
inc ecx
mov dword [0x1801c5338], ecx
mov dword [0x1801c514c], ebp
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
nop dword [rax]
nop dword [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edi
mov dword [rsp + rdi*4 + 0x34], eax
inc rdi
cmp rdi, 0x270
jb 0x18009a180
mov dword [rsp + 0x30], 0x270
mov rax, qword [r14 + 0x78]
cvttss2si ebp, dword [rax + 8]
btc ebp, 0x1f
mov rax, qword [r14 + 0x70]
cvttss2si ecx, dword [rax + 8]
btc ecx, 0x1f
sub ecx, ebp
cmp ecx, 0xffffffff
jne 0x18009a1d6
lea rcx, [rsp + 0x30]
call fcn.18004deb0
mov ecx, eax
jmp 0x18009a218
lea edi, [rcx + 1]
lea rcx, [rsp + 0x30]
call fcn.18004deb0
mov esi, edi
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jae 0x18009a214
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp ecx, edx
jae 0x18009a214
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.18004deb0
mov ecx, eax
imul rcx, rsi
cmp ecx, edi
jb 0x18009a200
shr rcx, 0x20
lea eax, [rcx + rbp]
btc eax, 0x1f
mov dword [str._n_n_n_n], eax
mov rcx, qword [0x1801c55e0]
test rcx, rcx
je 0x18009a247
test rbx, rbx
je 0x18009a247
mov rax, qword [rcx]
mov rdx, rbx
mov r8, qword [rax + 0xb0]
call r8
nop
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1800c6fb0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov rcx, qword [rcx + 8]
jmp 0x180099d30