Function at 0x18002a440
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
cmp byte [rcx + 1], 0
mov rbx, rcx
je 0x18002a46f
lea rcx, str.GTA5.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [rax + 0x19b1d70], 0xbf800000
xor esi, esi
movabs rbp, 0xfe99b66d079cf6bc
cmp byte [rbx + 2], sil
je 0x18002a4d7
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], reloc.WLDAP32.dll_Ordinal_27
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
mov rcx, rbp
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
cmp byte [rbx + 3], sil
je 0x18002a53f
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
movabs rcx, 0xa6294919e56ff02a
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
movabs rcx, 0xa0ebb943c300e693
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
cmp byte [rbx + 4], sil
je 0x18002a56e
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18002a56e
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18002a56e
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbx + 5]
movaps xmmword [rsp + 0x20], xmm6
call fcn.18002dfd0
cmp byte [rbx + 6], sil
je 0x18002a5a1
call fcn.180026870
movabs rcx, 0xd220bdd222ac4a1e
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026710
call fcn.180026870
cmp byte [rbx + 8], sil
je 0x18002a5fc
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xbf286c554784f3df
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
jmp 0x18002a647
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
movabs rcx, 0xbf286c554784f3df
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
movabs rcx, 0x1098355a16064bb3
mov qword [rsp + 0x48], rdi
call fcn.180026710
call fcn.180026870
cmp byte [rbx + 9], sil
je 0x18002a702
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xd821490579791273
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
lea rdi, str.scr_rcbarry2
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rcx + rdx*8], rdi
movabs rcx, 0xb80d8756b4668ab6
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov rcx, qword [rax + 0x10]
mov edx, dword [rax + 8]
mov qword [rcx + rdx*8], rdi
movabs rcx, 0x6c38af3693a69a91
jmp 0x18002a726
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov rcx, qword [rax + 0x10]
mov edx, dword [rax + 8]
mov dword [rcx + rdx*8], esi
movabs rcx, 0xd821490579791273
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
movzx edx, byte [rbx + 0x18]
call fcn.18002d1a0
movzx edx, byte [rbx + 0x19]
mov rcx, rbx
call fcn.18002dbd0
cmp byte [rbx + 0x20], sil
je 0x18002a78c
call fcn.180026870
movabs rcx, 0xf4f2c0d4ee209e20
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026710
call fcn.180026870
call fcn.180026870
movabs rcx, 0x9e4cfff989258472
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026710
call fcn.180026870
cmp byte [rbx + 0x21], sil
je 0x18002a7ec
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], esi
inc dword [rax + 8]
call fcn.180026870
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], 0x50
inc dword [rax + 8]
call fcn.180026870
mov rcx, rbp
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], 1
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
cmp byte [rbx + 0x22], sil
je 0x18002a8b8
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xc60ca000
inc dword [rax + 8]
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0xc62be000
inc dword [rax + 8]
call fcn.180026870
movabs rdi, 0x5006d96c995a5827
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0x41f00000
mov rcx, rdi
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0x461c4000
inc dword [rax + 8]
call fcn.180026870
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], 0x463b8000
inc dword [rax + 8]
call fcn.180026870
mov rcx, rdi
mov r8d, dword [rax + 8]
mov rdx, qword [rax + 0x10]
mov dword [rdx + r8*8], 0x41f00000
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
movss xmm6, dword [rbx + 0xc]
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
movss dword [rcx + rdx*8], xmm6
movabs rcx, 0x643e26ea6e024d92
inc dword [rax + 8]
call fcn.180026710
movss xmm6, dword [rbx + 0x10]
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
movss dword [rcx + rdx*8], xmm6
movabs rcx, 0xb96b00e976be977f
inc dword [rax + 8]
call fcn.180026710
movss xmm6, dword [rbx + 0x14]
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
movss dword [rcx + rdx*8], xmm6
movabs rcx, 0xee09ecedbabe47fc
inc dword [rax + 8]
call fcn.180026710
call fcn.180026870
movaps xmm6, xmmword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
cmp byte [rbx + 0xa], sil
je 0x18002a986
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0x3f000000
jmp 0x18002a9a4
call fcn.180026870
mov dword [rax + 8], esi
mov dword [rax + 0x18], esi
call fcn.180026870
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 0x3f800000
inc dword [rax + 8]
movabs rcx, 0x1d408577d440e81e
call fcn.180026710
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rsi
jmp fcn.180026870