Function at 0x18000a2f0
Capabilities:
Get disk information
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x18], xmm6
cmp edx, 1
jne 0x18000a56e
lea rdi, [0x180009810]
add rdi, 0x1b1
lea rax, [0x180009ec0]
add rax, 0x144
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], 0x144
mov eax, dword [rbp - 0x1d]
mov dword [rbp - 0x2d], eax
xor esi, esi
movaps xmm6, xmmword [rbp - 0x39]
nop word [rax + rax]
cmp dword [0x1800d1998], 0xc326f976
jne 0x18000a49e
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyState]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SwitchDesktop]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterHotKey]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToAscii]
call qword [sym.imp.USER32.dll_GetProcessWindowStation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawTextExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBeep]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawTextW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [0x1800d1998], 0xa5ef8dca
mov qword [rbp - 0x39], rdi
mov dword [rbp - 0x31], 0x1b1
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call fcn.18000d090
xor eax, eax
mov qword [rbp - 0x19], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rsi
lea ecx, [rax + 0x10]
call fcn.18004ddf8
mov qword [rax + 8], rsi
mov qword [rbp - 9], rax
lea rcx, [rbp - 9]
mov qword [rax], rcx
mov word [rbp + 0x27], 0
mov qword [rbp + 0x2d], rsi
mov qword [rbp + 0x35], rsi
xor eax, eax
mov word [rbp + 0x2a], ax
mov byte [rbp + 0x2c], al
mov word [rbp + 0x2d], ax
mov byte [rbp + 0x2f], al
mov word [rbp + 0x30], ax
mov byte [rbp + 0x32], al
mov word [rbp + 0x33], ax
mov byte [rbp + 0x35], al
mov word [rbp + 0x36], ax
mov byte [rbp + 0x38], al
mov word [rbp + 0x39], ax
mov byte [rbp + 0x3b], al
mov dword [rbp - 0xd], esi
mov dword [rbp + 0x23], esi
movdqa xmmword [rbp - 0x29], xmm6
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.18000ea80
mov ebx, dword [rbp - 0x15]
lea rcx, [rbp - 9]
call fcn.180011890
mov rcx, qword [rbp - 9]
mov qword [rbp - 9], rsi
mov edx, 0x10
call fcn.18004dd0c
test ebx, ebx
je 0x18000a350
mov eax, 1
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret