Function at 0x180002d10
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov r14, rdx
xor edx, edx
mov eax, r8d
div dword [rcx + 0x160]
mov ebx, r8d
mov rsi, rcx
test edx, edx
jne 0x180003031
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r15
call fcn.180003a60
xor edx, edx
mov eax, ebx
div dword [rsi + 0x160]
xor r15d, r15d
mov r13d, eax
mov r12d, r15d
test eax, eax
jle 0x18000301f
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rdi
movaps xmmword [rsp + 0x30], xmm6
movss xmm6, dword [0x180061428]
nop
xor ecx, ecx
call qword [sym.imp.USER32.dll_BlockInput]
mov rcx, qword [rsi + 0x150]
mov eax, r12d
imul eax, dword [rsi + 0x160]
cdqe
mov edx, 0x76
add rax, r14
mov qword [rsi + 0x158], rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov rcx, qword [rsi + 0x150]
movaps xmm2, xmm6
dec eax
mov edx, 0x75
movd xmm0, eax
mov rax, qword [rsi + 0x158]
mov rbp, rax
movd xmm1, dword [rax + 0x10]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
divss xmm2, xmm0
mulss xmm2, xmm1
cvttss2si rbx, xmm2
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
movd xmm1, dword [rbp + 0x14]
dec eax
movaps xmm2, xmm6
movd xmm0, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rbp + 4]
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
mulss xmm2, xmm1
cvttss2si rdi, xmm2
cmp eax, 0x200
ja 0x180002f10
je 0x180002f03
sub eax, 0x100
je 0x180002e9f
dec eax
je 0x180002e3a
sub eax, 3
je 0x180002e9f
dec eax
jne case.default.0x180002f2f
mov ecx, dword [rbp + 8]
cmp ecx, 0x25
je 0x180002e78
cmp ecx, 0x27
je 0x180002e78
cmp ecx, 0x26
je 0x180002e78
cmp ecx, 0x28
je 0x180002e78
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rsi + 0x158]
lea r8d, [r9 + 2]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180002f2f
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rsi + 0x158]
lea r8d, [r9 + 3]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180002f2f
mov ecx, dword [rbp + 8]
cmp ecx, 0x25
je 0x180002edc
cmp ecx, 0x27
je 0x180002edc
cmp ecx, 0x26
je 0x180002edc
cmp ecx, 0x28
je 0x180002edc
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
xor r8d, r8d
mov edx, eax
mov rax, qword [rsi + 0x158]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180002f2f
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov edx, eax
mov rax, qword [rsi + 0x158]
lea r8d, [r9 + 1]
movzx ecx, byte [rax + 8]
call qword [sym.imp.USER32.dll_keybd_event]
jmp case.default.0x180002f2f
xor r9d, r9d
mov ecx, 0x8001
jmp 0x180002ff4
add eax, 0xfffffdff
cmp eax, 9
ja case.default.0x180002f2f
lea rdx, [0x180000000]
mov ecx, dword [rdx + rax*4 + 0x303c]
add rcx, rdx
jmp rcx
xor r9d, r9d
mov ecx, 0x8002
jmp 0x180002ff4
xor r9d, r9d
mov ecx, 0x8004
jmp 0x180002ff4
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8008
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8010
jmp 0x180002ff4
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8006
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8006
jmp 0x180002ff4
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8018
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8018
jmp 0x180002ff4
xor r9d, r9d
mov ecx, 0x8020
jmp 0x180002ff4
xor r9d, r9d
mov ecx, 0x8040
jmp 0x180002ff4
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, 0x8060
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
xor r9d, r9d
mov ecx, 0x8060
jmp 0x180002ff4
movsx r9d, word [rbp + 0xa]
mov ecx, 0x8800
mov r8d, edi
mov edx, ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.USER32.dll_mouse_event]
inc r12d
cmp r12d, r13d
jl 0x180002d80
movaps xmm6, xmmword [rsp + 0x30]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x80]
mov r15, qword [rsp + 0x40]
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret