Function at 0x18008e540
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180151040]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
xor r13d, r13d
lea rdi, [0x1803f0cf8]
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
movabs r12, 0xff00ff00ff00ff00
cmp dword [0x1803f0d00], 0x12
je 0x18008e6f0
lea r14, [rsp + 0x98]
movabs rbp, 0x7fffffffffffffff
mov r15d, 0xff
mov rax, qword [0x1803f0d28]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsi + 0x38]
lea rcx, [0x1803f0cf8]
call rax
test eax, eax
je 0x18008e5f0
lea rcx, [0x1803f0cf8]
call qword [0x1803f0cd8]
lea rcx, [0x1803f0cf8]
call qword [0x1803f0d30]
cmp byte [rsi + 0x32], 0
je 0x18008e651
mov rdi, qword [0x1803f0c60]
lea rcx, [rsp + 0x58]
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rsp + 0x58]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 0xe40], xmm0
movd xmm1, dword [rsp + 0x5c]
cvtdq2ps xmm1, xmm1
movss dword [rdi + 0xe44], xmm1
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18008e64a
mov byte [rdi + 0xe48], 1
mov byte [rdi + 0x3860], 1
jmp 0x18008e651
mov byte [rdi + 0xe48], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r14
mov rdi, qword [r14]
xor rdi, r12
mov qword [rsp + 0x40], rdi
mov qword [r14], r13
mov rcx, rsi
call fcn.18008d820
movsxd rax, dword [0x1803f0010]
cmp eax, 1
jle 0x18008e6dd
mov rbx, rax
lea rcx, [rsp + 0x38]
call fcn.1800582a0
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x18008e6d2
js 0x18008e6d2
imul r8, rbx, 0xf4240
mov rdx, rbp
sub rdx, r8
cmp rax, rdx
je 0x18008e6cd
mov ecx, 1
cmovl ecx, r15d
test cl, cl
jns 0x18008e6cd
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x18008e6d2
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x30]
call fcn.180096240
nop
xor rdi, r12
mov qword [r14], rdi
cmp dword [0x1803f0d00], 0x12
jne 0x18008e5b0
mov dword [rsp + 0x30], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
lea r15, [rsp + 0x98]
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r15
mov rbx, qword [r15]
xor rbx, r12
mov qword [rsp + 0x40], rbx
mov qword [r15], r13
mov ecx, r13d
lea rbp, [0x180094400]
lea r14, [0x180000000]
mov rax, qword [0x1803f1e70]
test rax, rax
je 0x18008e769
mov rdx, r13
nop dword [rax]
cmp rax, rbp
je 0x18008e758
inc ecx
mov edx, ecx
mov rax, qword [r14 + rcx*8 + 0x3f1e70]
test rax, rax
jne 0x18008e740
jmp 0x18008e769
mov rdi, qword [r14 + rdx*8 + 0x3f6080]
test rdi, rdi
jne 0x18008e84f
mov edx, 0x1f4
xor ecx, ecx
mov r9d, 0x40
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x18008e792
mov rdi, r13
jmp 0x18008e82e
mov rax, rbp
mov rcx, rdi
mov edx, 3
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x18008e7a0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
mov eax, dword [rax + 0x70]
mov dword [rcx + 0x70], eax
mov rax, qword [0x1803f53d0]
mov qword [r14 + rax*8 + 0x3f1e70], rbp
mov qword [r14 + rax*8 + 0x3f6080], rdi
inc rax
mov qword [0x1803f53d0], rax
lea rdx, [rsi + 0x38]
lea r8, [rsp + 0x30]
mov rcx, qword [sym.imp.USER32.dll_ShowWindow]
call rdi
nop
xor rbx, r12
mov qword [r15], rbx
mov rax, qword [0x1803f0d08]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180101a90
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret