Function at 0x180063210
Capabilities:
Log keystrokes via application hook
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb30]
sub rsp, 0xc30
mov esi, dword [rbp + 0xb80]
mov r12, r9
imul r15d, esi, 0x6a4
mov r14, r8
mov r13, rdx
mov ebx, esi
cmp esi, r15d
ja 0x1800634c3
mov rdi, qword [rsp + 0x40]
xor edx, edx
cmp ebx, 0x5a94
ja 0x1800633db
je 0x1800633ca
cmp ebx, 0x44
je 0x180063389
cmp ebx, 0x48
je 0x180063335
cmp ebx, 0xfd
je 0x180063325
cmp ebx, 0x2d6c
je 0x1800632ba
cmp ebx, 0x3018
jne 0x1800634b2
mov eax, dword [rbp + 0xaa4]
mov word [0x1800d5918], dx
jmp 0x1800634c9
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1800632f0
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov rdx, qword [str.V1224_angTable]
lea rax, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov r9d, 4
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movsxd rdi, eax
jmp 0x1800634a9
movzx eax, word [r14]
mov word [rbp + 0x398], ax
jmp 0x1800634b2
mov eax, dword [r14]
lea r9, [rbp + 0xb80]
mov dword [rbp + 0xa9c], eax
lea rdx, [rbp + 0x740]
mov eax, dword [r13]
xor r8d, r8d
mov ecx, 0xad
mov dword [rbp + 0xaa0], eax
mov dword [rbp + 0xb80], 0x200
mov qword [rsp + 0x20], r12
call fcn.18006bdd0
mov ecx, 0xffffff25
lea rdx, [rbp + 0x540]
call qword [0x1800d5910]
jmp 0x1800634a9
cmp qword [0x1800d57c8], 0
mov dword [rsp + 0x30], 1
jne 0x1800634b2
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x18004f190]
mov r8, rax
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1800d57c8], rax
jmp 0x1800634a9
test rdi, rdi
mov rax, rdx
sete al
mov rdi, rax
jmp 0x1800634b2
cmp ebx, 0x87bc
je 0x180063484
cmp ebx, 0xa8ff
je 0x180063460
cmp ebx, 0x15101
je 0x180063447
cmp ebx, 0x1f903
jne 0x1800634b2
movzx eax, word [rbp + 0x4aa]
mov word [0x1800d5918], ax
test ax, ax
jne 0x1800634b2
lea rax, [rsp + 0x50]
mov dword [rbp + 0xb80], 0x200
mov rdx, rcx
mov qword [rsp + 0x20], rax
mov ecx, 0xad
lea r9, [rbp + 0xb80]
xor r8d, r8d
call fcn.18006bdd0
jmp 0x1800634a9
mov qword [rbp + 0x4a2], rdx
mov ecx, 0xfffffec2
lea rdx, [rsp + 0x50]
call qword [0x1800d5910]
jmp 0x1800634a9
mov eax, dword [r12]
mov dword [rbp + 0x4ac], eax
mov eax, dword [r13]
mov dword [rbp + 0x4b0], eax
mov word [rbp + 0x4aa], dx
mov byte [rbp + 0x3a2], 0
jmp 0x1800634b2
mov rax, qword [r14]
lea rdx, [rbp + 0xb80]
mov r8d, 0x92
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
mov dword [rbp + 0xb80], edi
call fcn.18004ff10
mov rcx, qword [rbp + 0xb60]
xor edx, edx
imul eax, esi, 0xaa
add ebx, eax
cmp ebx, r15d
jbe 0x180063264
mov eax, dword [rbp + 0xb80]
lea r11, [rsp + 0xc30]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret