Function at 0x18001eb20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
cmp byte [0x1801cdcce], 0
je 0x18001f4a5
mov rax, qword [0x1801cd7c0]
mov rcx, qword [rax]
test rcx, rcx
je 0x18001f4a5
mov qword [r11 - 0x20], r14
mov r14, qword [rcx + 8]
test r14, r14
je 0x18001f4a0
mov qword [r11 - 0x28], r15
mov r15, qword [r14 + 0x30]
test r15, r15
je 0x18001f49b
mov eax, dword [r14 + 0x98]
movsd xmm0, qword [r14 + 0x90]
mov dword [rbp - 0x11], eax
mov eax, dword [0x1801cd81c]
movsd qword [rbp - 0x19], xmm0
cmp byte [rax + r14], 0x40
je 0x18001f49b
movss xmm0, dword [0x180166cc0]
comiss xmm0, dword [r14 + 0x280]
ja 0x18001f49b
mov rax, qword [0x1801ce128]
mov qword [r11 - 0x18], r12
xor r12d, r12d
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x10], rdi
test rax, rax
jne 0x18001ec83
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18001ec64
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18001ec64
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18001ec5f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x18001ec40
cmp edx, 0x95466b05
je 0x18001ecaa
test r8d, r8d
jne 0x18001ec20
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18001ec79
cmp qword [rax + 0x30], r12
jne 0x18001ebf0
mov rax, r12
mov qword [0x1801ce128], rax
mov ecx, 0xa0
call rax
test ax, ax
setne byte [0x1801cd2b3]
cmp byte [reloc.WS2_32.dll_accept], r12b
je 0x18001ecc5
movd xmm0, dword [reloc.WS2_32.dll_accept]
cvtdq2ps xmm0, xmm0
jmp 0x18001ecdc
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18001ec7c
test ax, ax
je 0x18001ecd4
movss xmm0, dword [0x180166c34]
jmp 0x18001ecdc
movss xmm0, dword [0x180166c24]
mov rax, qword [0x1801ce128]
movss dword [0x1801cbc34], xmm0
test rax, rax
jne 0x18001eda3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18001ed84
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18001ed84
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18001ed7f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x18001ed60
cmp edx, 0x95466b05
je 0x18001edc5
test r8d, r8d
jne 0x18001ed40
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18001ed99
cmp qword [rax + 0x30], r12
jne 0x18001ed10
mov rax, r12
mov qword [0x1801ce128], rax
mov ecx, dword [0x1801ce108]
call rax
test ax, ax
je 0x18001ede0
cmp dword [reloc.WS2_32.dll_accept], r12d
mov eax, r12d
sete al
mov dword [reloc.WS2_32.dll_accept], eax
jmp 0x18001ede6
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18001ed9c
mov eax, dword [reloc.WS2_32.dll_accept]
test eax, eax
je 0x18001f47b
movaps xmmword [rsp + 0x60], xmm6
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm7
movups xmmword [r15 + 0x30], xmm0
mov rax, qword [0x1801ce128]
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm9
test rax, rax
jne 0x18001eed3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18001eeb4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18001eeb4
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18001eeaf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x18001ee90
cmp edx, 0x95466b05
je 0x18001ef17
test r8d, r8d
jne 0x18001ee70
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18001eec9
cmp qword [rax + 0x30], r12
jne 0x18001ee40
mov rax, r12
mov qword [0x1801ce128], rax
mov ecx, dword [0x1801cbc70]
call rax
movss xmm7, dword [rbp - 0x11]
xorps xmm6, xmm6
movss xmm8, dword [rbp - 0x15]
movss xmm9, dword [rbp - 0x19]
test ax, ax
jns 0x18001efd6
mov qword [r14 + 0x320], r12
mov dword [r14 + 0x328], r12d
mov rax, qword [0x1801cd7e0]
test rax, rax
je 0x18001ef32
mov rax, qword [rax]
jmp 0x18001ef36
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18001eecc
mov rax, qword [rbp + 0x67]
movsd xmm1, qword [rax + 0x3d0]
ucomiss xmm1, xmm6
mov ecx, dword [rax + 0x3d8]
mov dword [rbp - 0x11], ecx
movsd qword [rbp - 0x19], xmm1
jp 0x18001ef7e
jne 0x18001ef7e
movss xmm0, dword [rbp - 0x15]
ucomiss xmm0, xmm6
jp 0x18001ef7e
jne 0x18001ef7e
movd xmm3, ecx
ucomiss xmm3, xmm6
jp 0x18001ef83
jne 0x18001ef83
movsd xmm0, qword [rax + 0x40]
movss xmm3, dword [rax + 0x48]
movaps xmm1, xmm0
movsd qword [rbp - 0x19], xmm0
jmp 0x18001ef83
movss xmm3, dword [rbp - 0x11]
movss xmm2, dword [0x1801cbc34]
movaps xmm0, xmm2
mulss xmm0, xmm1
movaps xmm1, xmm2
mulss xmm1, dword [rbp - 0x15]
addss xmm0, xmm9
mulss xmm2, xmm3
addss xmm1, xmm8
addss xmm2, xmm7
movss dword [r14 + 0x90], xmm0
movss dword [r14 + 0x94], xmm1
unpcklps xmm0, xmm1
movss dword [r14 + 0x98], xmm2
movsd qword [r15 + 0x50], xmm0
movss dword [r15 + 0x58], xmm2
mov rax, qword [0x1801ce128]
test rax, rax
jne 0x18001f093
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x18001f074
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x18001f074
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x18001f06f
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x18001f050
cmp edx, 0x95466b05
je 0x18001f0c3
test r8d, r8d
jne 0x18001f030
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18001f089
cmp qword [rax + 0x30], r12
jne 0x18001f000
mov rax, r12
mov qword [0x1801ce128], rax
mov ecx, dword [0x1801cbc74]
call rax
test ax, ax
jns 0x18001f18f
mov qword [r14 + 0x320], r12
mov dword [r14 + 0x328], r12d
mov rax, qword [0x1801cd7e0]
test rax, rax
je 0x18001f0de
mov rax, qword [rax]
jmp 0x18001f0e2
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18001f08c
mov rax, qword [rbp + 0x67]
movsd xmm2, qword [rax + 0x3d0]
ucomiss xmm2, xmm6
mov ecx, dword [rax + 0x3d8]
mov dword [rbp - 0x11], ecx
movsd qword [rbp - 0x19], xmm2
jp 0x18001f12a
jne 0x18001f12a
movss xmm0, dword [rbp - 0x15]
ucomiss xmm0, xmm6
jp 0x18001f12a
jne 0x18001f12a
movd xmm5, ecx
ucomiss xmm5, xmm6
jp 0x18001f12f
jne 0x18001f12f
movsd xmm0, qword [rax + 0x40]
movss xmm5, dword [rax + 0x48]
movaps xmm2, xmm0
movsd qword [rbp - 0x19], xmm0
jmp 0x18001f12f
movss xmm5, dword [rbp - 0x11]
movss xmm1, dword [0x1801cbc34]
movaps xmm4, xmm9
movaps xmm0, xmm1
mulss xmm5, xmm1
mulss xmm0, xmm2
movaps xmm3, xmm8
movaps xmm2, xmm7
subss xmm2, xmm5
subss xmm4, xmm0
movss xmm0, dword [rbp - 0x15]
mulss xmm0, xmm1
movss dword [r14 + 0x90], xmm4
subss xmm3, xmm0
movaps xmm0, xmm4
movss dword [r14 + 0x94], xmm3
movss dword [r14 + 0x98], xmm2
unpcklps xmm0, xmm3
movsd qword [r15 + 0x50], xmm0
movss dword [r15 + 0x58], xmm2
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18001f243
mov qword [r14 + 0x320], r12
mov dword [r14 + 0x328], r12d
mov rax, qword [0x1801cd7e0]
test rax, rax
je 0x18001f1c2
mov rax, qword [rax]
jmp 0x18001f1c6
mov rax, qword [rbp + 0x67]
movsd xmm1, qword [rax + 0x3d0]
ucomiss xmm1, xmm6
movsd qword [rbp - 0x19], xmm1
jp 0x18001f208
jne 0x18001f208
movss xmm0, dword [rbp - 0x15]
ucomiss xmm0, xmm6
jp 0x18001f208
jne 0x18001f208
movss xmm0, dword [rax + 0x3d8]
ucomiss xmm0, xmm6
jp 0x18001f208
jne 0x18001f208
movsd xmm0, qword [rax + 0x40]
mov eax, dword [rax + 0x48]
movaps xmm1, xmm0
mov dword [rbp - 0x11], eax
movsd qword [rbp - 0x19], xmm0
mulss xmm1, dword [0x1801cbc34]
addss xmm1, xmm9
movss dword [r14 + 0x90], xmm1
movaps xmm0, xmm1
movss dword [r14 + 0x94], xmm8
movss dword [r14 + 0x98], xmm7
unpcklps xmm0, xmm8
movsd qword [r15 + 0x50], xmm0
movss dword [r15 + 0x58], xmm7
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18001f2f7
mov qword [r14 + 0x320], r12
mov dword [r14 + 0x328], r12d
mov rax, qword [0x1801cd7e0]
test rax, rax
je 0x18001f276
mov rax, qword [rax]
jmp 0x18001f27a
mov rax, qword [rbp + 0x67]
movsd xmm1, qword [rax + 0x3d0]
ucomiss xmm1, xmm6
movsd qword [rbp - 0x19], xmm1
jp 0x18001f2bc
jne 0x18001f2bc
movss xmm0, dword [rbp - 0x15]
ucomiss xmm0, xmm6
jp 0x18001f2bc
jne 0x18001f2bc
movss xmm0, dword [rax + 0x3d8]
ucomiss xmm0, xmm6
jp 0x18001f2bc
jne 0x18001f2bc
movsd xmm0, qword [rax + 0x40]
mov eax, dword [rax + 0x48]
movaps xmm1, xmm0
mov dword [rbp - 0x11], eax
movsd qword [rbp - 0x19], xmm0
mulss xmm1, dword [0x1801cbc34]
movaps xmm0, xmm9
subss xmm0, xmm1
movss dword [r14 + 0x90], xmm0
movss dword [r14 + 0x94], xmm8
movss dword [r14 + 0x98], xmm7
unpcklps xmm0, xmm8
movsd qword [r15 + 0x50], xmm0
movss dword [r15 + 0x58], xmm7
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18001f3b3
mov qword [r14 + 0x320], r12
mov dword [r14 + 0x328], r12d
mov rax, qword [0x1801cd7e0]
test rax, rax
je 0x18001f32a
mov rax, qword [rax]
jmp 0x18001f32e
mov rax, qword [rbp + 0x67]
movsd xmm0, qword [rax + 0x3d0]
ucomiss xmm0, xmm6
mov ecx, dword [rax + 0x3d8]
mov dword [rbp - 0x11], ecx
movsd qword [rbp - 0x19], xmm0
jp 0x18001f373
jne 0x18001f373
movss xmm0, dword [rbp - 0x15]
ucomiss xmm0, xmm6
jp 0x18001f373
jne 0x18001f373
movd xmm1, ecx
ucomiss xmm1, xmm6
jp 0x18001f378
jne 0x18001f378
movsd xmm0, qword [rax + 0x40]
movss xmm1, dword [rax + 0x48]
movsd qword [rbp - 0x19], xmm0
jmp 0x18001f378
movss xmm1, dword [rbp - 0x11]
mulss xmm1, dword [0x1801cbc34]
movaps xmm0, xmm9
movss dword [r14 + 0x90], xmm9
movss dword [r14 + 0x94], xmm8
addss xmm1, xmm7
unpcklps xmm0, xmm8
movss dword [r14 + 0x98], xmm1
movsd qword [r15 + 0x50], xmm0
movss dword [r15 + 0x58], xmm1
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18001f465
mov qword [r14 + 0x320], r12
mov dword [r14 + 0x328], r12d
mov rax, qword [0x1801cd7e0]
test rax, rax
je 0x18001f3e6
mov rax, qword [rax]
jmp 0x18001f3ea
mov rax, qword [rbp + 0x67]
movsd xmm0, qword [rax + 0x3d0]
ucomiss xmm0, xmm6
mov ecx, dword [rax + 0x3d8]
mov dword [rbp - 0x11], ecx
movsd qword [rbp - 0x19], xmm0
jp 0x18001f425
jne 0x18001f425
movss xmm0, dword [rbp - 0x15]
ucomiss xmm0, xmm6
jp 0x18001f425
jne 0x18001f425
movd xmm0, ecx
ucomiss xmm0, xmm6
jp 0x18001f42a
jne 0x18001f42a
movss xmm0, dword [rax + 0x48]
jmp 0x18001f42a
movss xmm0, dword [rbp - 0x11]
mulss xmm0, dword [0x1801cbc34]
movss dword [r14 + 0x90], xmm9
movss dword [r14 + 0x94], xmm8
subss xmm7, xmm0
movaps xmm0, xmm9
unpcklps xmm0, xmm8
movss dword [r14 + 0x98], xmm7
movsd qword [r15 + 0x50], xmm0
movss dword [r15 + 0x58], xmm7
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm9, xmmword [rsp + 0x30]
mov rbx, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0xb0]
mov r12, qword [rsp + 0x80]
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x90
pop rbp
ret