Function at 0x180001310
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Log keystrokes via polling
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x180055240]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r14d, r14d
mov qword [0x1800571e8], rax
call rax
mov dword [0x180057200], eax
mov dword [0x1800571d0], eax
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x1800571d8], rax
call rax
mov qword [0x1800571f0], rax
lea rcx, [0x180057210]
mov qword [0x1800571f8], rax
mov rax, qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov qword [0x1800571e0], rax
call rax
mov rax, qword [0x180057210]
mov qword [0x180057208], rax
call fcn.18003f800
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18003fec0
lea rdx, [0x18003e860]
lea rcx, [0x1800571e8]
call fcn.18003f1c0
lea rdx, [fcn.18003e8a0]
lea rcx, [0x1800571d8]
call fcn.18003f1c0
lea rdx, [0x18003e940]
lea rcx, [0x1800571e0]
call fcn.18003f1c0
call fcn.18003f8c0
mov byte [0x1800571c1], 1
call qword [sym.imp.KERNEL32.dll_AllocConsole]
lea ecx, [r14 + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, rax
lea r8, [0x180045810]
lea rdx, str.CONOUT_
lea rcx, [0x180057108]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_freopen_s]
lea rcx, str.welcome_bf_hack_n
call fcn.1800010d0
call fcn.180004950
lea ecx, [r14 + 0x10]
call fcn.180042900
mov qword [rbp - 0x29], rax
xorps xmm0, xmm0
mov rbx, rax
movups xmmword [rax], xmm0
mov qword [rax], r14
mov qword [rax + 8], r14
call fcn.180041040
lea rcx, str.MH_init._n
call fcn.1800010d0
mov rdx, rbx
call fcn.180001920
mov rsi, qword [0x180055500]
test rsi, rsi
je 0x1800015eb
lea ecx, [r14 + 0x28]
call fcn.180042900
mov qword [rbp - 0x29], rax
lea rdx, [0x180008160]
mov rbx, rax
mov qword [rbp - 0x31], 0xf
xorps xmm0, xmm0
lea r8, [rbx + 0x20]
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
lea rax, str.SetWeaponDamage
mov rcx, qword [0x180057248]
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x29]
movups xmm0, xmmword [rbp - 0x39]
mov qword [rbp - 0x29], rcx
mov qword [rbx + 0x10], rax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x18], rdx
mov qword [r8], rcx
call fcn.180040d90
test eax, eax
je 0x180001512
mov rdx, qword [rbx + 0x10]
lea rcx, str.hook_failed:__p__n
mov rdx, qword [rdx]
call fcn.1800010d0
xor r9d, r9d
lea r8, str.hook_error
lea rdx, str.hook_failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdi, qword [rsi]
mov qword [rsi], rbx
test rdi, rdi
je 0x180001533
mov rcx, qword [rdi + 0x10]
call fcn.1800410e0
mov edx, 0x28
mov rcx, rdi
call fcn.1800428f8
mov ecx, 0x28
call fcn.180042900
mov qword [rbp - 0x29], rax
lea rdx, [0x180008180]
mov rbx, rax
mov qword [rbp - 0x31], 6
xorps xmm0, xmm0
lea r8, [rbx + 0x20]
xor eax, eax
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x20], rax
lea rax, str.AddExp
mov rcx, qword [0x180057270]
mov qword [rbp - 0x39], rax
lea rax, [rbp - 0x29]
movups xmm0, xmmword [rbp - 0x39]
mov qword [rbp - 0x29], rcx
mov qword [rbx + 0x10], rax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x18], rdx
mov qword [r8], rcx
call fcn.180040d90
test eax, eax
je 0x1800015c8
mov rdx, qword [rbx + 0x10]
lea rcx, str.hook_failed:__p__n
mov rdx, qword [rdx]
call fcn.1800010d0
xor r9d, r9d
lea r8, str.hook_error
lea rdx, str.hook_failed
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdi, qword [rsi + 8]
mov qword [rsi + 8], rbx
test rdi, rdi
je 0x1800015eb
mov rcx, qword [rdi + 0x10]
call fcn.1800410e0
mov edx, 0x28
mov rcx, rdi
call fcn.1800428f8
cmp qword [0x180055500], r14
je 0x1800015fb
xor ecx, ecx
call fcn.180041030
call fcn.180040be0
xor edx, edx
lea rcx, str.UnrealWindow
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x58], r14
xor r9d, r9d
mov qword [0x180057148], rax
xor r8d, r8d
mov qword [rbp + 0x17], rax
xor ecx, ecx
lea rax, [rbp + 0x3f]
mov qword [rbp - 5], r14
mov qword [rsp + 0x50], rax
lea edx, [r9 + 1]
mov qword [rsp + 0x48], r14
lea rax, [0x180057168]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x29]
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rax
mov qword [rbp + 0xf], 2
mov qword [rbp + 0x27], 2
mov qword [rbp - 0x19], r14
mov dword [rbp - 9], 0x1c
mov dword [rbp - 0x11], 0x3c
mov dword [rbp - 0xd], 1
mov dword [rbp + 0xb], 0x20
mov qword [rbp + 3], 1
mov qword [rbp + 0x1f], 1
mov dword [rbp - 0x29], 0xb000
mov dword [rbp - 0x25], 0xa000
call qword [sym.imp.d3d11.dll_D3D11CreateDeviceAndSwapChain]
test eax, eax
jne 0x1800017a8
mov rax, qword [0x180057168]
lea r9, [rbp + 0x43]
mov edx, 0x400
mov r8d, 0x40
mov rcx, qword [rax]
mov qword [0x180057158], rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x180057158]
lea r9, [rbp + 0x3b]
mov edx, 0x400
mov r8d, 0x40
mov rax, qword [rcx + 0x40]
mov qword [0x180057180], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x180057158]
lea rax, [0x180001b00]
lea r9, [rbp + 0x3b]
mov edx, 0x400
mov rbx, qword [rcx + 0x40]
mov qword [rcx + 0x40], rax
mov r8d, dword [rbp + 0x3b]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x180057158]
lea r9, [rbp + 0x37]
mov edx, 0x400
mov qword [0x180057160], rbx
mov r8d, 0x40
mov rax, qword [rcx + 0x68]
mov qword [0x180057188], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x180057158]
lea rax, [0x180002850]
lea r9, [rbp + 0x37]
mov edx, 0x400
mov rbx, qword [rcx + 0x68]
mov qword [rcx + 0x68], rax
mov r8d, dword [rbp + 0x37]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [0x180057168]
mov qword [0x180057198], rbx
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [0x180055264], r14b
je 0x1800017d5
mov ecx, 0x23
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1800017d5
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x180055264], r14b
jne 0x1800017b1
mov rdx, qword [0x180057160]
mov ecx, 8
call fcn.180001a00
mov rdx, qword [0x180057198]
mov ecx, 0xd
call fcn.180001a00
mov r8, qword [0x180057150]
mov edx, 0xfffffffc
mov rcx, qword [0x180057148]
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rdi, qword [0x1800554a0]
mov rbx, qword [0x180055498]
cmp rbx, rdi
je 0x180001839
mov rcx, qword [rbx]
cmp byte [rcx], r14b
je 0x180001830
call fcn.1800082a0
add rbx, 0x10
cmp rbx, rdi
jne 0x180001823
cmp qword [0x180055500], r14
je 0x180001859
xor ecx, ecx
call fcn.180041020
cmp qword [0x180055500], r14
je 0x180001859
xor ecx, ecx
call fcn.1800410e0
xor edx, edx
call fcn.180001920
call fcn.18003f800
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18003fec0
lea rdx, [0x18003e860]
lea rcx, [0x1800571e8]
call fcn.18003f690
lea rdx, [fcn.18003e8a0]
lea rcx, [0x1800571d8]
call fcn.18003f690
lea rdx, [0x18003e940]
lea rcx, [0x1800571e0]
call fcn.18003f690
call fcn.18003f8c0
mov ecx, 0x3e8
mov byte [0x1800571c1], r14b
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180057108]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x180001230]
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180042550
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret