Function at 0x18009ecb0
Capabilities:
Check for unmoving mouse cursor
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12d0]
mov eax, 0x13d0
call fcn.1800cf8f0
sub rsp, rax
mov rax, qword [0x180106040]
xor rax, rsp
mov qword [rbp + 0x12c0], rax
mov r15, rcx
cmp byte [rcx + 0x48], 0
je 0x18009e8c6
cmp byte [0x1801d5220], 0
jne 0x18009e8c6
mov rbx, qword [0x1801d4b38]
mov rax, qword [0x1801d4b80]
mov rdx, qword [rax]
mov rax, qword [rbx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801d4cd0]
mov rcx, rbx
call r9
mov rdx, qword [rbx]
mov r9, qword [rdx + 0xc0]
xor r8d, r8d
mov rdx, rax
mov rcx, rbx
call r9
test al, al
jne 0x18009e3bc
mov rax, qword [r15 + 0x98]
cmp qword [rax + 8], 0
je 0x18009e8c6
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, rax
movabs rax, 0x346dc5d63886594b
imul rcx
mov r14, rdx
sar r14, 0xb
mov rax, r14
shr rax, 0x3f
add r14, rax
mov eax, dword [0x1801d4898]
test eax, eax
jne 0x18009e3f6
mov eax, r14d
mov dword [0x1801d4898], eax
mov ecx, r14d
sub ecx, eax
mov eax, 0x3e8
cdq
idiv dword [0x180110c5c]
cmp ecx, eax
jl 0x18009e8c6
mov edi, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18009e8c6
mov rcx, qword [0x1801d4b38]
mov rax, qword [0x1801d4b80]
mov rdx, qword [rax]
mov rax, qword [rcx]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801d4e60]
call r9
mov rsi, rax
test rax, rax
je 0x18009e48a
mov rcx, qword [0x1801d4b38]
mov rdx, qword [rcx]
mov r8, qword [rdx + 0xa8]
mov rdx, rax
call r8
mov rbx, rax
mov qword [rsp + 0x28], rax
mov rcx, qword [0x1801d4b38]
mov rdx, qword [rcx]
mov r8, qword [rdx + 0xb8]
mov rdx, rsi
call r8
jmp 0x18009e491
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov rax, qword [r15 + 0x88]
cmp qword [rax + 8], 0
je 0x18009e651
mov rsi, qword [0x1801d4b38]
test rbx, rbx
je 0x18009e619
mov rdx, rbx
mov rcx, rsi
cmp dword [0x1801cc364], 7
jne 0x18009e558
mov r8, qword [0x1801d5070]
call fcn.18004c910
mov r12, rax
test rax, rax
je 0x18009e651
mov rcx, qword [rsi]
mov r8, qword [rcx + 0xf8]
mov rdx, rax
mov rcx, rsi
call r8
mov r13, rax
test rax, rax
je 0x18009e651
mov rcx, qword [rsi]
mov r10, qword [rcx + 0x480]
lea r9, str.Lnet_minecraft_world_phys_HitResult_Type_
lea r8, str.BLOCK
mov rdx, rax
mov rcx, rsi
call r10
test rax, rax
je 0x18009e651
mov rdx, qword [rsi]
mov r9, qword [rdx + 0x488]
mov r8, rax
mov rdx, r13
mov rcx, rsi
call r9
test rax, rax
je 0x18009e651
mov rdx, qword [rsi]
mov r9, qword [rdx + 0xc0]
mov r8, r12
jmp 0x18009e607
mov rax, qword [rsi]
mov r9, qword [rax + 0x2f8]
mov r8, qword [0x1801d4d30]
call r9
mov r13, rax
test rax, rax
je 0x18009e651
mov rcx, qword [rsi]
mov r8, qword [rcx + 0xf8]
mov rdx, rax
mov rcx, rsi
call r8
mov r12, rax
test rax, rax
je 0x18009e651
mov ecx, dword [0x1801cc364]
test ecx, ecx
je 0x18009e5b9
cmp ecx, 6
je 0x18009e5b9
mov rcx, qword [rsi]
mov r10, qword [rcx + 0x480]
lea r9, str.Lnet_minecraft_util_MovingObjectPosition_MovingObjectType_
jmp 0x18009e5ca
mov rax, qword [rsi]
mov r10, qword [rax + 0x480]
lea r9, str.Lnet_minecraft_util_math_RayTraceResult_Type_
lea r8, str.BLOCK
mov rdx, r12
mov rcx, rsi
call r10
mov r8, rax
test rax, rax
je 0x18009e651
mov rax, qword [rsi]
mov r9, qword [rax + 0x488]
mov rdx, r12
mov rcx, rsi
call r9
test rax, rax
je 0x18009e651
mov rcx, qword [rsi]
mov r9, qword [rcx + 0xc0]
mov r8, r13
mov rdx, rax
mov rcx, rsi
call r9
test al, al
setne al
test al, al
je 0x18009e651
lea rcx, [rsp + 0x28]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x2c]
shl r9d, 0x10
movzx eax, word [rsp + 0x28]
or r9, rax
mov r8, rdi
mov edx, 0x201
mov rcx, qword [0x1801d5228]
call qword [sym.imp.USER32.dll_PostMessageA]
nop
jmp 0x18009e8a4
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov r8, rdi
mov edx, 0x201
mov rcx, qword [0x1801d5228]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov r8, rdi
mov edx, 0x202
mov rcx, qword [0x1801d5228]
call qword [sym.imp.USER32.dll_PostMessageA]
mov rax, qword [r15 + 0x90]
cmp qword [rax + 8], 0
je 0x18009e740
mov ecx, dword [0x1801d4890]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
mov rax, qword [r15 + 0x80]
ucomiss xmm0, dword [rax + 8]
jp 0x18009e738
jne 0x18009e738
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov edx, 0x204
mov r8d, 2
mov rcx, qword [0x1801d5228]
call qword [sym.imp.USER32.dll_PostMessageA]
movzx r9d, word [rsp + 0x24]
shl r9d, 0x10
movzx eax, word [rsp + 0x20]
or r9, rax
mov edx, 0x205
mov r8d, 2
mov rcx, qword [0x1801d5228]
call qword [sym.imp.USER32.dll_PostMessageA]
mov dword [0x1801d4890], 0
jmp 0x18009e740
inc ecx
mov dword [0x1801d4890], ecx
mov dword [0x1801d4898], r14d
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x12b4], 0xffffffff
mov dword [rsp + 0x34], eax
mov r9d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edi
mov dword [rsp + rdi*4 + 0x34], eax
inc rdi
cmp rdi, r9
jb 0x18009e761
mov dword [rsp + 0x30], r9d
mov rax, qword [r15 + 0x70]
cvttss2si edx, dword [rax + 8]
mov rax, qword [r15 + 0x78]
cvttss2si ecx, dword [rax + 8]
lea eax, [rcx - 0x80000000]
mov r15d, 0x80000000
lea r14d, [rcx + r15]
cmp ecx, r15d
cmovae r14d, eax
lea eax, [rdx - 0x80000000]
lea edi, [rdx + r15]
cmp edx, r15d
cmovae edi, eax
sub edi, r14d
cmp edi, 0xffffffff
jne 0x18009e842
lea r8, [rsp + 0x38]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, dword [r8 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x630]
shr edx, 1
xor ecx, edx
mov dword [r8 + 0x9bc], ecx
lea r8, [r8 + 4]
sub r9, 1
jne 0x18009e7d0
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + rax*4 + 0x34]
mov eax, ecx
shr eax, 0xb
and eax, dword [rbp + 0x12b4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov r8d, ecx
shr r8d, 0x12
xor r8d, ecx
jmp 0x18009e88a
inc edi
lea rcx, [rsp + 0x30]
call fcn.1800788d0
mov esi, edi
mov r8d, eax
imul r8, rsi
cmp r8d, edi
jae 0x18009e886
mov eax, edi
neg eax
xor edx, edx
div edi
mov edi, edx
cmp r8d, edx
jae 0x18009e886
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
call fcn.1800788d0
mov r8d, eax
imul r8, rsi
cmp r8d, edi
jb 0x18009e870
shr r8, 0x20
lea edx, [r14 + r8]
lea eax, [rdx + r15]
lea ecx, [rdx - 0x80000000]
cmp edx, r15d
cmovae ecx, eax
mov dword [0x180110c5c], ecx
mov rcx, qword [0x1801d4b38]
test rcx, rcx
je 0x18009e8c6
test rbx, rbx
je 0x18009e8c6
mov rax, qword [rcx]
mov rdx, rbx
mov r8, qword [rax + 0xb0]
call r8
nop
mov rcx, qword [rbp + 0x12c0]
xor rcx, rsp
call fcn.1800caa50
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rcx + 8]
jmp 0x18009e310