Function at 0x180047cf0
Capabilities:
Allocate or change rwx memory
Create thread
Log keystrokes via polling
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
mov rax, qword [0x180071010]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov ebp, ebx
mov esi, ebx
nop word [rax + rax]
test rsi, rsi
jne 0x180047d5a
lea rcx, str.gameassembly.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rcx, str.unityplayer.dll
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rbp, rbp
je 0x180047d30
mov qword [rsp + 0x28], rbx
lea r8, [0x180047a20]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movss xmm7, dword [0x180065d44]
mov r15d, 0xc3
mov r14d, 0x90c3c031
nop dword [rax + rax]
mov eax, dword [0x1800720ac]
cmp eax, 0xc
jne 0x180047f4f
cmp byte [0x180072155], 0
movaps xmm6, xmm7
je 0x180047e18
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x180047dc9
imul rax, rax, 0x64
jmp 0x180047de7
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
sub rax, qword [0x1800720e8]
cmp rax, 0x17d7840
jl 0x180047e10
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x180047e10
movss xmm6, dword [0x18007129c]
jmp 0x180047e18
movss xmm6, dword [0x180071298]
mov rax, qword [rbp + 0x8caa6a0]
lea r9, [rsp + 0x30]
mov edx, 4
mov rbx, qword [rax + 0xc0]
lea r8d, [rdx + 0x3c]
lea rcx, [rbx + 0x1dc]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov edx, 4
mov dword [rbx + 0x1dc], 0x3f800000
lea rcx, [rbx + 0x1dc]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsi + 0x1d21d78]
lea r9, [rsp + 0x34]
mov edx, 4
lea rcx, [rbx + 0xfc]
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x34]
lea r9, [rsp + 0x34]
mov edx, 4
movss dword [rbx + 0xfc], xmm6
lea rcx, [rbx + 0xfc]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x180072154], 0
lea r9, [rsp + 0x38]
mov edx, 1
lea rcx, [rbp + 0x51292c0]
mov edi, 0x40
cmovne edi, r15d
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov edx, 1
mov byte [rbp + 0x51292c0], dil
lea rcx, [rbp + 0x51292c0]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x180072151], 0
lea r9, [rsp + 0x3c]
mov edx, 1
lea rcx, [rbp + 0x5800f40]
mov edi, 0x40
cmovne edi, r15d
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x3c]
lea r9, [rsp + 0x3c]
mov edx, 1
mov byte [rbp + 0x5800f40], dil
lea rcx, [rbp + 0x5800f40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x1800720ac]
cmp eax, 0xf
jne 0x180047fc5
cmp byte [0x180072158], 0
je 0x180047f67
movss xmm0, dword [0x1800712a0]
jmp 0x180047f6a
movaps xmm0, xmm7
mov r9b, 1
mov r8, rsi
mov rdx, rbp
call fcn.180047bb0
cmp byte [0x180072157], 0
lea r9, [rsp + 0x40]
mov edx, 4
lea rcx, [rbp + 0x5da5f20]
mov edi, 0x83485340
cmovne edi, r14d
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov edx, 4
mov dword [rbp + 0x5da5f20], edi
lea rcx, [rbp + 0x5da5f20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [0x18007215a], 0
je 0x180048006
mov edi, dword [0x1800712a8]
cmp edi, 1
jle 0x180048047
mov edx, 4
lea r9, [rsp + 0x44]
lea rcx, [rsi + 0x1c4e000]
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x44]
lea r9, [rsp + 0x44]
mov dword [rsi + 0x1c4e000], edi
jmp 0x180048035
mov edx, 4
lea r9, [rsp + 0x48]
lea rcx, [rsi + 0x1c4e000]
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x48]
lea r9, [rsp + 0x48]
mov dword [rsi + 0x1c4e000], 0x3c
mov edx, 4
lea rcx, [rsi + 0x1c4e000]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180047d90