Function at 0x1800035b0
Capabilities:
Delete directory
Log keystrokes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x18], 0
mov rbx, rcx
jne 0x180003655
call fcn.18004be38
mov r9d, eax
mov eax, 0x55555556
imul r9d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, 1
inc r9d
mov dword [rbx + 0x18], r9d
call fcn.180045fdc
mov edx, dword [rbx + 0x18]
mov rdi, rax
sub edx, 1
je 0x180003638
sub edx, 1
je 0x180003625
cmp edx, 1
jne 0x180003648
mov edx, 0x3ec0
mov rcx, rax
call fcn.180004f40
mov qword [rbx + 0x10], rax
jmp 0x180003648
mov edx, 0x3ec0
mov rcx, rdi
call fcn.180004f40
mov qword [rbx + 8], rax
jmp 0x180003648
mov edx, 0x3ec0
mov rcx, rdi
call fcn.180004f40
mov qword [rbx], rax
mov edx, 1
mov rcx, rdi
call fcn.180045ef0
mov edx, dword [0x1800d5574]
xor esi, esi
cmp edx, 0xbd5ece42
jne 0x180003733
mov eax, esi
xor edx, edx
xchg dword [rsi], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSubMenu]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableScrollBar]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], esi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.USER32.dll_TabbedTextOutW]
call qword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
mov edx, dword [0x1800d5574]
mov ecx, dword [rbx + 0x18]
mov rdi, rsi
sub ecx, 1
je 0x180003754
sub ecx, 1
je 0x18000374e
cmp ecx, 1
jne 0x180003757
mov rdi, qword [rbx + 0x10]
jmp 0x180003757
mov rdi, qword [rbx + 8]
jmp 0x180003757
mov rdi, qword [rbx]
cmp edx, 0xd2209654
jne 0x18000383b
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefRawInputProc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
lea rcx, str.4vgQwAtAuA6kNCSHr
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
mov qword [rsp + 0x30], rsi
lea rdx, str.t8vGA5MckK4S4Z2zRzAH
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefRawInputProc]
mov rbx, qword [rsp + 0x50]
mov rax, rdi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret