Function at 0x140036b50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x210
vmovaps xmmword [rax - 0x48], xmm6
vmovaps xmmword [rax - 0x58], xmm7
vmovaps xmmword [rax - 0x68], xmm8
vmovaps xmmword [rax - 0x78], xmm9
vmovaps xmmword [rax - 0x88], xmm10
vmovaps xmmword [rax - 0x98], xmm11
vmovaps xmmword [rax - 0xa8], xmm12
vmovaps xmmword [rax - 0xb8], xmm13
vmovaps xmmword [rax - 0xc8], xmm14
vmovaps xmmword [rax - 0xd8], xmm15
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
vmovss xmm15, dword [0x14011f068]
vmovsd xmm14, qword [0x14011f0c8]
vmovss xmm12, dword [0x14011ef20]
vmovss xmm13, dword [0x14011f014]
xor r12d, r12d
lea r14, [r15 + 0x160]
movabs r13, 0xb2f4fc0794908cf3
vxorps xmm11, xmm11, xmm11
movabs rsi, 0x431bde82d7b634db
nop
cmp qword [r15 + 0xc8], r12
je 0x140036c10
mov rcx, r15
call fcn.1400367d0
cmp byte [0x1401320e8], r12b
mov rdi, rax
je 0x140036e7e
mov ecx, dword [0x1401d8288]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x68], rax
xor r9d, r9d
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [0x1401d8280]
xor r8d, r8d
mov dword [rsp + 0x48], 0x10
xor edx, edx
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rcx
mov rcx, qword [r15 + 0xd8]
add rcx, 0x1898
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [0x1401d82d8]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x160], r12
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x70], 8
mov dword [rbp - 0x68], r12d
mov dword [rbp - 0x64], 4
call fcn.14008af30
cmp qword [rbp + 0x160], r12
je 0x140036e7e
cmp byte [0x1401d84f8], r12b
je 0x140036d06
lea rcx, [rbp + 0x168]
call fcn.140031d10
mov byte [0x1401d84f8], r12b
mov rcx, qword [rax]
mov qword [0x1401d84e8], rcx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140036d27
imul rcx, rcx, 0x64
jmp 0x140036d93
cmp rbx, 0x16e3600
jne 0x140036d72
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
jmp 0x140036d89
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
mov qword [0x1401d84f0], rcx
mov rax, rsi
sub rcx, qword [0x1401d84e8]
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1401d8674], edx
test rdi, rdi
je 0x140036e7e
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, edx
vcomiss xmm0, dword [0x1401d8320]
jb 0x140036e7e
cmp byte [0x1401d83f8], r12b
jne 0x140036df8
mov ecx, dword [0x1401d8414]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140036e7e
movzx esi, byte [0x1401320f5]
movzx ebx, byte [0x1401320fd]
test sil, sil
je 0x140036e25
mov rcx, r14
call fcn.140034120
cmp rax, 0xffffffffffffffff
je 0x140036e25
call fcn.140002690
mov byte [0x1401d84f8], 1
test bl, bl
je 0x140036e69
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140036e36
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140036e69
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x160], 0x3e8
call fcn.140034420
call fcn.140002690
mov byte [0x1401d84f8], 1
test sil, sil
jne 0x140036e7e
test bl, bl
jne 0x140036e7e
call fcn.140002690
mov byte [0x1401d84f8], 1
cmp byte [0x1401320f4], r12b
je 0x14003736a
test rdi, rdi
je 0x14003736a
mov ecx, dword [0x1401d8410]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003736a
cmp byte [0x1401d8400], r12b
mov rsi, qword [rdi]
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x18]
mov ecx, dword [0x1401d84e0]
je 0x140036ede
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, r12d
jmp 0x140036f29
test ecx, ecx
je 0x140036f23
sub ecx, 1
je 0x140036f1b
sub ecx, 1
je 0x140036f13
sub ecx, 1
je 0x140036f0b
cmp ecx, 1
jne 0x140036f06
mov eax, 0x25
nop dword [rax + rax]
sub rax, 1
jne 0x140036f00
mov r9d, r12d
jmp 0x140036f29
mov r9d, 2
jmp 0x140036f29
mov r9d, 0x42
jmp 0x140036f29
mov r9d, 0x43
jmp 0x140036f29
mov r9d, 0x6e
mov r8, rdi
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140031fa0
vmovsd xmm6, qword [rbp + 0x60]
vmovsd xmm7, qword [rbp + 0x50]
vmovsd xmm8, qword [rbp + 0x58]
mov rcx, rsi
vmovsd qword [rbp - 0x38], xmm6
call fcn.140034b00
mov ecx, dword [0x1401d8288]
add rax, 0x168
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov dword [rsp + 0x48], 0x10
lea rax, [rbp - 0x80]
mov qword [rsp + 0x68], rax
xor r8d, r8d
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [0x1401d8280]
xor edx, edx
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
vxorpd xmm0, xmm0, xmm0
mov qword [rsp + 0x60], rcx
mov rcx, qword [0x1401d82d8]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
vmovsd qword [rbp - 0x70], xmm0
vmovupd xmmword [rbp - 0x80], xmm0
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x70], 0x18
mov dword [rbp - 0x58], r12d
mov dword [rbp - 0x54], 4
call fcn.14008af30
cmp byte [0x1401320fc], r12b
vsubsd xmm0, xmm7, qword [0x1401d7738]
vsubsd xmm1, xmm8, qword [0x1401d7740]
vsubsd xmm2, xmm6, qword [0x1401d7748]
vmulsd xmm3, xmm0, xmm0
vfmadd231sd xmm3, xmm1, xmm1
vfmadd231sd xmm3, xmm2, xmm2
vsqrtsd xmm0, xmm3, xmm3
vmulsd xmm10, xmm0, qword [0x14011f018]
je 0x14003717c
mov r9d, 0x6e
lea rdx, [rbp - 0x10]
mov r8, rdi
mov rcx, rbx
call fcn.140031fa0
movzx ebx, byte [0x1401d847b]
vmovsd xmm9, qword [rbp + 0x60]
vmovsd xmm7, qword [rbp + 0x50]
vmovsd xmm8, qword [rbp + 0x58]
vmovsd qword [rbp - 0x38], xmm9
test bl, bl
je 0x1400370cf
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140037072
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400370c7
cmp byte [0x1401d84f9], r12b
je 0x140037093
vmovss dword [0x140132390], xmm15
vmovss xmm1, dword [0x14011f214]
vandps xmm2, xmm1, xmmword [0x14011f570]
vcvtss2sd xmm0, xmm2, xmm2
vdivsd xmm1, xmm10, xmm0
vcvtsd2ss xmm4, xmm1, xmm1
vmovss xmm1, dword [0x14011f298]
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm7, xmm0, xmm14
jmp 0x140037142
test bl, bl
jne 0x14003717c
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.1400341c0
mov rcx, rax
call fcn.140034c10
mov rdx, r14
lea rcx, [rsp + 0x50]
vmovaps xmm6, xmm0
call fcn.1400341c0
mov rcx, rax
call fcn.140035a30
vucomiss xmm6, xmm11
vmovaps xmm5, xmm0
je 0x14003717c
vxorps xmm1, xmm1, xmm1
vmovss xmm2, xmm1, xmm6
vandps xmm3, xmm2, xmmword [0x14011f570]
vcvtss2sd xmm1, xmm3, xmm3
vdivsd xmm2, xmm10, xmm1
vmulss xmm1, xmm5, dword [0x14011f290]
vcvtsd2ss xmm4, xmm2, xmm2
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm7, xmm0, xmm14
vxorps xmm0, xmm0, xmm0
vmovss xmm1, xmm0, xmm1
vmulsd xmm2, xmm3, qword [rbp - 0x78]
vmulsd xmm0, xmm3, qword [rbp - 0x70]
vfmadd231sd xmm8, xmm2, xmm14
vandps xmm2, xmm1, xmmword [0x14011f570]
vmovaps xmm3, xmm9
vfmadd231sd xmm3, xmm0, xmm14
vmulss xmm0, xmm2, xmm4
vmulss xmm1, xmm0, dword [0x14011f120]
vcvtss2sd xmm2, xmm1, xmm1
vaddsd xmm3, xmm3, xmm2
vmovsd qword [rbp - 0x38], xmm3
vunpcklpd xmm0, xmm7, xmm8
vmovups xmmword [rsp + 0x50], xmm0
vmovsd xmm0, qword [rbp - 0x38]
lea r8, [rbp + 0x158]
lea rdx, [rsp + 0x50]
vmovsd qword [rsp + 0x60], xmm0
vmovss dword [rbp + 0x158], xmm11
vmovss dword [rbp + 0x15c], xmm11
call fcn.140038340
test al, al
je 0x14003736a
vmovss xmm0, dword [rbp + 0x158]
vucomiss xmm0, xmm11
vmovss xmm4, dword [0x140132390]
vmovss xmm1, dword [0x1401d84b4]
vmovss xmm2, dword [0x1401d84b0]
vmovaps xmm7, xmm11
vmovaps xmm6, xmm11
je 0x14003720e
vsubss xmm0, xmm0, xmm1
vdivss xmm7, xmm0, xmm4
vaddss xmm3, xmm7, xmm1
vaddss xmm1, xmm1, xmm1
vcomiss xmm3, xmm1
ja 0x140037209
vcomiss xmm3, xmm11
jae 0x14003720e
vmovaps xmm7, xmm11
vmovss xmm0, dword [rbp + 0x15c]
vucomiss xmm0, xmm11
je 0x14003723f
vsubss xmm1, xmm0, xmm2
vdivss xmm6, xmm1, xmm4
vaddss xmm3, xmm6, xmm2
vaddss xmm0, xmm2, xmm2
vcomiss xmm3, xmm0
ja 0x14003723a
vcomiss xmm3, xmm11
jae 0x14003723f
vmovaps xmm6, xmm11
cmp byte [0x1401d83f0], r12b
jne 0x14003736a
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm7
vsubss xmm7, xmm0, xmm13
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
mov rax, qword [0x1401d8328]
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm6
vsubss xmm2, xmm0, xmm13
test rax, rax
jne 0x140037353
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rbx, rdi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140037334
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140037334
mov r10d, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r10]
mov ecx, 0x811c9dc5
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14003732f
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140037310
cmp ecx, 0x20785c9b
je 0x140037386
test r8d, r8d
jne 0x1400372f0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
je 0x140037349
cmp qword [rax + 0x30], r12
jne 0x1400372c0
mov rax, r12
mov qword [0x1401d8328], rax
vcvttss2si r8d, xmm2
vcvttss2si edx, xmm7
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov ecx, 1
call rax
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x160], 1
call fcn.140034420
jmp 0x140036c04
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14003734c