Function at 0x1800049b0
Capabilities:
Log keystrokes

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0x50
mov r14, rdx
xor edx, edx
mov eax, r8d
div dword [rcx + 0x8c0]
mov rbp, rcx
mov r13d, eax
test edx, edx
jne 0x180004cb8
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r15
xor r15d, r15d
mov r12d, r15d
test eax, eax
jle 0x180004cae
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
movaps xmmword [rsp + 0x30], xmm6
movss xmm6, dword [0x180024a28]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov rcx, qword [rbp + 0x8d8]
mov eax, r12d
imul eax, dword [rbp + 0x8c0]
cdqe
mov edx, 0x76
add rax, r14
mov qword [rbp + 0x8b8], rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, qword [rbp + 0x8d8]
movaps xmm2, xmm6
dec eax
mov edx, 0x75
movd xmm0, eax
mov rax, qword [rbp + 0x8b8]
mov rsi, rax
movd xmm1, dword [rax + 0x10]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
divss xmm2, xmm0
mulss xmm2, xmm1
cvttss2si rbx, xmm2
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
movd xmm1, dword [rsi + 0x14]
dec eax
movaps xmm2, xmm6
movd xmm0, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rsi + 4]
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
mulss xmm2, xmm1
cvttss2si rdi, xmm2
cmp eax, 0x200
ja 0x180004b97
je 0x180004b8a
sub eax, 0x100
je 0x180004b26
dec eax
je 0x180004ac1
sub eax, 3
je 0x180004b26
dec eax
jne case.default.0x180004bb6
mov ecx, dword [rsi + 8]
cmp ecx, 0x25
je 0x180004aff
cmp ecx, 0x27
je 0x180004aff
cmp ecx, 0x26
je 0x180004aff
cmp ecx, 0x28
je 0x180004aff
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rbp + 0x8b8]
lea r8d, [r9 + 2]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180004bb6
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rbp + 0x8b8]
lea r8d, [r9 + 3]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180004bb6
mov ecx, dword [rsi + 8]
cmp ecx, 0x25
je 0x180004b63
cmp ecx, 0x27
je 0x180004b63
cmp ecx, 0x26
je 0x180004b63
cmp ecx, 0x28
je 0x180004b63
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rax, qword [rbp + 0x8b8]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180004bb6
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rbp + 0x8b8]
lea r8d, [r9 + 1]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180004bb6
xor r9d, r9d
mov ecx, 0x8001
jmp 0x180004c7b
add eax, 0xfffffdff
cmp eax, 9
ja case.default.0x180004bb6
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x4cc4]
add rcx, rdx
jmp rcx
xor r9d, r9d
mov ecx, 0x8002
jmp 0x180004c7b
xor r9d, r9d
mov ecx, 0x8004
jmp 0x180004c7b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8008
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8010
jmp 0x180004c7b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8006
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8006
jmp 0x180004c7b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8018
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8018
jmp 0x180004c7b
xor r9d, r9d
mov ecx, 0x8020
jmp 0x180004c7b
xor r9d, r9d
mov ecx, 0x8040
jmp 0x180004c7b
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8060
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8060
jmp 0x180004c7b
movsx r9d, word [rsi + 0xa]
mov ecx, 0x8800
mov r8d, edi
mov edx, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
inc r12d
cmp r12d, r13d
jl 0x180004a07
movaps xmm6, xmmword [rsp + 0x30]
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r14
pop r13
pop rbp
ret