Function at 0x180028c40
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 1], 0
mov rbx, rcx
je 0x180028c6a
lea rcx, str.GTA5.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [rax + 0x19b1d70], 0xbf800000
xor edi, edi
cmp byte [rbx + 2], dil
je 0x180028ccf
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
inc dword [rax + 8]
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], reloc.WLDAP32.dll_Ordinal_27
inc dword [rax + 8]
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xfe99b66d079cf6bc
inc dword [rax + 8]
call fcn.180026140
call fcn.1800262a0
cmp byte [rbx + 3], dil
je 0x180028d37
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xa6294919e56ff02a
inc dword [rax + 8]
call fcn.180026140
call fcn.1800262a0
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xa0ebb943c300e693
inc dword [rax + 8]
call fcn.180026140
call fcn.1800262a0
cmp byte [rbx + 4], dil
je 0x180028d66
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180028d66
mov ecx, reloc.WS2_32.dll_WSAStartup
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180028d66
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
movzx edx, byte [rbx + 5]
call fcn.18002a760
cmp byte [rbx + 6], dil
je 0x180028d94
call fcn.1800262a0
movabs rcx, 0xd220bdd222ac4a1e
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.180026140
call fcn.1800262a0
cmp byte [rbx + 8], dil
je 0x180028def
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xbf286c554784f3df
inc dword [rax + 8]
call fcn.180026140
call fcn.1800262a0
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
jmp 0x180028e3a
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xbf286c554784f3df
inc dword [rax + 8]
call fcn.180026140
call fcn.1800262a0
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], edi
inc dword [rax + 8]
movabs rcx, 0x1098355a16064bb3
call fcn.180026140
call fcn.1800262a0
cmp byte [rbx + 9], dil
je 0x180028ef0
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov dword [rcx + rdx*8], 1
movabs rcx, 0xd821490579791273
inc dword [rax + 8]
call fcn.180026140
call fcn.1800262a0
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
lea rbx, str.scr_rcbarry2
mov edx, dword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rcx + rdx*8], rbx
movabs rcx, 0xb80d8756b4668ab6
inc dword [rax + 8]
call fcn.180026140
call fcn.1800262a0
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov rcx, qword [rax + 0x10]
mov edx, dword [rax + 8]
mov qword [rcx + rdx*8], rbx
movabs rcx, 0x6c38af3693a69a91
jmp 0x180028f14
call fcn.1800262a0
mov dword [rax + 8], edi
mov dword [rax + 0x18], edi
call fcn.1800262a0
mov rcx, qword [rax + 0x10]
mov edx, dword [rax + 8]
mov dword [rcx + rdx*8], edi
movabs rcx, 0xd821490579791273
inc dword [rax + 8]
call fcn.180026140
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1800262a0