Function at 0x140030804
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
movaps xmmword [rax - 0x78], xmm11
movaps xmmword [rax - 0x88], xmm13
movaps xmmword [rax - 0x98], xmm14
movaps xmmword [rax - 0xa8], xmm15
mov rax, qword [0x140043010]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor ebx, ebx
cmp byte [0x140043050], bl
je 0x1400308d7
mov rcx, qword [0x140044140]
add rcx, 0x1cc8
movd xmm2, dword [0x140043058]
cvtdq2ps xmm2, xmm2
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [0x140044228]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x70], xmm0
movss dword [rbp + 0x74], xmm1
movss xmm1, dword [0x14003e0e4]
movss dword [rsp + 0x28], xmm1
lea rdx, [rbp + 0x70]
call fcn.14001ca38
mov edx, 5
lea ecx, [rdx - 3]
mov eax, dword [0x1400442a4]
test eax, eax
jne 0x1400308f5
mov dword [0x1400442d8], 0x6a
jmp 0x14003091d
cmp eax, 1
jne 0x140030906
mov dword [0x1400442d8], 0x42
jmp 0x14003091d
cmp eax, ecx
jne 0x140030912
mov dword [0x1400442d8], edx
jmp 0x14003091d
cmp eax, 3
jne 0x14003091d
mov dword [0x1400442d8], ecx
mov r14d, 4
mov eax, dword [0x1400435bc]
test eax, eax
jne 0x14003093c
mov dword [0x1400442a0], 1
jmp 0x1400309e2
cmp eax, 1
jne 0x14003094c
mov dword [0x1400442a0], ecx
jmp 0x1400309e2
cmp eax, ecx
jne 0x14003095c
mov dword [0x1400442a0], r14d
jmp 0x1400309e2
cmp eax, 3
jne 0x140030969
mov dword [0x1400442a0], edx
jmp 0x1400309e2
cmp eax, r14d
jne 0x14003097a
mov dword [0x1400442a0], 6
jmp 0x1400309e2
cmp eax, edx
jne 0x14003098a
mov dword [0x1400442a0], 3
jmp 0x1400309e2
cmp eax, 6
jne 0x14003099b
mov dword [0x1400442a0], 8
jmp 0x1400309e2
cmp eax, 7
jne 0x1400309ac
mov dword [0x1400442a0], 9
jmp 0x1400309e2
cmp eax, 8
jne 0x1400309bd
mov dword [0x1400442a0], 0xc
jmp 0x1400309e2
cmp eax, 9
je 0x1400309e2
cmp eax, 0xa
jne 0x1400309d3
mov dword [0x1400442a0], 0x10
jmp 0x1400309e2
cmp eax, 0xb
jne 0x1400309e2
mov dword [0x1400442a0], 0x11
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
mov qword [rbp + 0x98], rbx
mov rax, qword [0x140044338]
sub rax, qword [0x140044330]
sar rax, 3
movabs rsi, 0xaaaaaaaaaaaaaaab
imul rax, rsi
test rax, rax
je 0x140030ae3
movabs rcx, 0xaaaaaaaaaaaaaaa
cmp rax, rcx
ja 0x140031484
lea rax, [rax + rax*2]
lea rbx, [rax*8]
cmp rbx, 0x1000
jb 0x140030a71
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x14003147e
call fcn.14003357c
test rax, rax
je 0x140030a6a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140030a85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x140030a83
mov rcx, rbx
call fcn.14003357c
mov rdi, rax
jmp 0x140030a85
xor edi, edi
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], rdi
lea rax, [rbx + rdi]
mov qword [rbp + 0x98], rax
mov rbx, qword [0x140044338]
mov rdx, qword [0x140044330]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 3
imul rbx, rsi
lea rax, [rbx + rbx*2]
lea rcx, [rdi + rax*8]
mov qword [rbp + 0x90], rcx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x60]
call fcn.140032e80
nop
movss xmm15, dword [0x14003e1ec]
mov rsi, rbx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0xb0], rbx
mov rcx, qword [0x140044150]
add rcx, 0x1078a7d8
call fcn.14003290c
mov qword [0x140044240], rax
lea rcx, [rax + 0x1b8]
call fcn.14003290c
lea rcx, [rax + 0x38]
call fcn.14003290c
mov rcx, rax
call fcn.14003290c
mov qword [0x140044220], rax
lea rcx, [rax + 0x30]
call fcn.14003290c
mov qword [0x140044148], rax
lea rcx, [rax + 0x330]
call fcn.14003290c
mov qword [0x1400441f0], rax
lea rcx, [rax + 0x2a8]
call fcn.14003290c
mov qword [0x1400441e0], rax
mov rcx, qword [0x1400441f0]
add rcx, 0x190
call fcn.14003290c
mov qword [0x140044230], rax
mov rcx, qword [0x140044240]
add rcx, 0x30
call fcn.14003290c
mov qword [0x140044208], rax
lea rcx, [rax + 0xa0]
mov dword [rbp + 0x80], ebx
mov eax, dword [0x140044158]
mov dword [rbp + 0x38], eax
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x48], pe_nt_image_headers64
mov byte [rbp + 0x4a], bl
lea rax, [rbp + 0x80]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x20]
call fcn.1400328d8
mov rcx, qword [0x140044208]
add rcx, 0x98
call fcn.14003290c
mov r13, rax
mov r15d, ebx
cmp dword [rbp + 0x80], ebx
jbe 0x1400313a9
movss xmm10, dword [0x14003e0c0]
mov rcx, qword [0x1400441f0]
add rcx, 0x8f8
call fcn.14003290c
movsxd rax, r15d
lea rcx, [rax*8]
add rcx, r13
call fcn.14003290c
mov r14, rax
lea rcx, [rax + 0x310]
call fcn.14003290c
mov rdi, rax
lea rcx, [r14 + 0x4480]
call fcn.140032a10
ucomiss xmm0, dword [0x14003e1b0]
jp 0x140031399
jne 0x140031399
mov rcx, qword [0x1400441e0]
add rcx, 0x10b0
call fcn.140032c60
mov ebx, eax
lea rcx, [r14 + 0x2a8]
call fcn.14003290c
lea rcx, [rax + 0x10b0]
call fcn.140032c60
cmp ebx, eax
je 0x140031397
cmp r14, qword [0x1400441f0]
je 0x140031397
mov r8d, 0x6a
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14002d220
mov rdx, qword [0x140044230]
add rdx, 0x128
lea rcx, [rbp - 0x80]
call fcn.140032a7c
movups xmm7, xmmword [rax]
movups xmmword [0x1400442a8], xmm7
movsd xmm0, qword [rax + 0x10]
movsd qword [0x1400442b8], xmm0
movsd xmm9, qword [rsp + 0x48]
movaps xmm1, xmm9
movaps xmm0, xmm7
unpckhpd xmm0, xmm7
subsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e114]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm6, xmm0
movsd xmm8, qword [rsp + 0x40]
movaps xmm1, xmm8
subsd xmm1, xmm7
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e114]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
movsd xmm7, qword [rsp + 0x50]
movaps xmm1, xmm7
subsd xmm1, qword [0x1400442b8]
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e114]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm11, xmm0
divss xmm11, dword [0x14003e1d8]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.14002d220
movups xmm13, xmmword [rbp - 0x40]
movaps xmmword [rsp + 0x40], xmm13
movsd xmm14, qword [rbp - 0x30]
movsd qword [rsp + 0x50], xmm14
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.14002da5c
movaps xmm0, xmm7
addsd xmm0, qword [0x14003e140]
cvtpd2ps xmm3, xmm0
cvtpd2ps xmm2, xmm9
cvtpd2ps xmm0, xmm8
cvtps2pd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
cvtps2pd xmm2, xmm2
movsd qword [rsp + 0x48], xmm2
cvtps2pd xmm0, xmm3
movsd qword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14002da5c
movaps xmm0, xmm8
unpcklpd xmm0, xmm9
movaps xmmword [rbp - 0x40], xmm0
movsd qword [rbp - 0x30], xmm7
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.14002da5c
movsd xmm8, qword [rbp - 0x18]
movaps xmm0, xmm8
subsd xmm0, qword [rbp - 0x58]
andps xmm0, xmmword [0x14003e300]
cvtpd2ps xmm9, xmm0
cvtps2pd xmm0, xmm9
mulsd xmm0, qword [0x14003e100]
cvtpd2ps xmm7, xmm0
movd xmm0, dword [0x1400435d8]
cvtdq2ps xmm0, xmm0
xor ebx, ebx
comiss xmm0, xmm11
jbe 0x14003131c
movsd xmm6, qword [rbp - 0x20]
cmp byte [0x140043051], bl
je 0x140030eb5
mov rcx, rdi
call fcn.1400307c0
test al, al
je 0x140030e6d
mov dword [rsp + 0x30], 0xff2ee800
jmp 0x140030e81
mov rcx, rdi
call fcn.1400307c0
test al, al
jne 0x140030eb5
mov dword [rsp + 0x30], 0xff0019ff
movaps xmm0, xmm7
mulss xmm0, xmm10
cvtps2pd xmm1, xmm0
movaps xmm2, xmm6
lea rax, [rsp + 0x30]
subsd xmm2, xmm1
mov qword [rsp + 0x20], rax
cvttss2si r9d, xmm9
cvttss2si r8d, xmm7
cvttsd2si edx, xmm8
cvttsd2si ecx, xmm2
call fcn.14002e440
cmp byte [0x14004413e], bl
je 0x140030f1b
mov rcx, rdi
call fcn.1400307c0
test al, al
je 0x140030ed3
mov dword [rsp + 0x30], 0xff2ee800
jmp 0x140030ee7
mov rcx, rdi
call fcn.1400307c0
test al, al
jne 0x140030f1b
mov dword [rsp + 0x30], 0xff0019ff
movaps xmm0, xmm7
mulss xmm0, xmm10
cvtps2pd xmm1, xmm0
movaps xmm2, xmm6
lea rax, [rsp + 0x30]
subsd xmm2, xmm1
mov qword [rsp + 0x20], rax
cvttss2si r9d, xmm9
cvttss2si r8d, xmm7
cvttsd2si edx, xmm8
cvttsd2si ecx, xmm2
call fcn.14002ea28
mov rcx, rdi
call fcn.1400307c0
test al, al
je 0x140031026
mov dword [rbp + 0x70], 0xe0aba1a3
mov word [rbp + 0x74], 0x82ea
xor eax, eax
mov byte [rbp + 0x76], al
mov edx, ebx
movsxd rcx, edx
lea eax, [rdx - 0x7d]
xor byte [rbp + rcx + 0x70], al
inc edx
cmp edx, 6
jb 0x140030f3f
mov byte [rbp + 0x76], bl
xorps xmm2, xmm2
cvtss2sd xmm2, xmm11
movq r8, xmm2
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xc0]
call fcn.140032ccc
movaps xmm0, xmmword [0x14003e2e0]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002704
mov ebx, eax
movaps xmm5, xmm8
subsd xmm5, qword [0x14003e150]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm5
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
movss dword [rsp + 0x68], xmm0
movss dword [rsp + 0x6c], xmm1
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x80]
call fcn.140032600
nop
mov dword [rsp + 0x20], ebx
movss xmm3, dword [0x14003e1c4]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x1400441f8]
call fcn.14002dcd0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14003111c
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031117
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031117
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400307c0
test al, al
jne 0x14003111e
mov dword [rbp + 0x78], 0xebe3aaa6
mov word [rbp + 0x7c], 0x8d
mov edx, ebx
movsxd rcx, edx
lea eax, [rdx - 0x7d]
xor byte [rbp + rcx + 0x78], al
inc edx
cmp edx, 5
jb 0x140031045
mov byte [rbp + 0x7d], bl
xorps xmm2, xmm2
cvtss2sd xmm2, xmm11
movq r8, xmm2
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x20]
call fcn.140032ccc
movaps xmm0, xmmword [0x14003e2c0]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002704
mov ebx, eax
movaps xmm5, xmm8
subsd xmm5, qword [0x14003e150]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm5
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
movss dword [rsp + 0x70], xmm0
movss dword [rsp + 0x74], xmm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140032600
nop
mov dword [rsp + 0x20], ebx
movss xmm3, dword [0x14003e1c4]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x1400441f8]
call fcn.14002dcd0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x14003111c
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031117
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031477
call fcn.140033504
xor ebx, ebx
movsd xmm9, qword [rbp - 0x60]
cmp byte [0x14004413c], bl
je 0x1400311c8
mov r10, qword [0x140044140]
movaps xmm0, xmmword [0x14003e2a0]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002704
movsd xmm5, qword [rbp - 0x58]
cvtpd2ps xmm5, xmm5
mulss xmm7, xmm10
xorps xmm2, xmm2
cvtss2sd xmm2, xmm7
movaps xmm0, xmm2
addsd xmm0, xmm9
cvtpd2ps xmm0, xmm0
movss dword [rsp + 0x78], xmm0
movss dword [rsp + 0x7c], xmm5
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm8
movaps xmm0, xmm6
subsd xmm0, xmm2
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
mov dword [rsp + 0x28], 0xf
movss xmm0, dword [0x14003e0d4]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x60]
lea rcx, [r10 + 0x1cc8]
call fcn.14001c824
cmp byte [0x14004413a], bl
je 0x1400311e4
movaps xmmword [rbp - 0x20], xmm13
movsd qword [rbp - 0x10], xmm14
lea rcx, [rbp - 0x20]
call fcn.14003064c
cmp byte [0x140043052], bl
je 0x14003131c
mov rcx, rdi
call fcn.1400307c0
test al, al
je 0x140031286
mov ecx, dword [0x14004422c]
test ecx, ecx
je 0x140031257
sub ecx, 1
je 0x140031247
cmp ecx, 1
jne 0x140031286
mov eax, 0x431bde83
imul dword [0x14004415c]
mov r10d, edx
sar r10d, 0x12
mov eax, r10d
shr eax, 0x1f
add r10d, eax
cvttsd2si r8d, xmm6
cvttsd2si r9d, xmm8
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, r10d
jmp 0x140031271
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
jmp 0x14003122f
cvttsd2si r9d, qword [rbp - 0x58]
cvttsd2si r8d, xmm9
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, dword [0x14004415c]
sar eax, 1
mov ecx, eax
lea rax, [0x140043230]
mov qword [rsp + 0x20], rax
call fcn.14002e38c
mov rcx, rdi
call fcn.1400307c0
test al, al
jne 0x14003131c
mov ecx, dword [0x14004422c]
test ecx, ecx
je 0x1400312ed
sub ecx, 1
je 0x1400312c7
cmp ecx, 1
jne 0x14003131c
mov eax, 0x6b5fca6b
imul dword [0x14004415c]
mov r10d, edx
sar r10d, 0x16
mov eax, r10d
shr eax, 0x1f
add r10d, eax
jmp 0x1400312d5
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
cvttsd2si r8d, xmm6
cvttsd2si r9d, xmm8
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, r10d
jmp 0x140031307
cvttsd2si r9d, qword [rbp - 0x58]
cvttsd2si r8d, xmm9
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, dword [0x14004415c]
sar eax, 1
mov ecx, eax
lea rax, [0x140043230]
mov qword [rsp + 0x20], rax
call fcn.14002e38c
mov eax, dword [0x140044228]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm2, qword [rbp]
subsd xmm2, xmm0
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm1, qword [rbp + 8]
subsd xmm1, xmm0
mulsd xmm1, xmm1
mulsd xmm2, xmm2
addsd xmm1, xmm2
cvtpd2ps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm6, xmm0
mov rcx, rdi
call fcn.1400307c0
test al, al
je 0x140031399
movd xmm1, dword [0x140043058]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm6
jbe 0x140031399
comiss xmm15, xmm6
jbe 0x140031399
movaps xmm15, xmm6
mov rsi, r14
jmp 0x140031399
xor ebx, ebx
inc r15d
cmp r15d, dword [rbp + 0x80]
jb 0x140030c0f
cmp byte [0x140044139], bl
je 0x1400313d7
cmp byte [0x14004413b], bl
je 0x1400313fe
test rsi, rsi
je 0x1400313d7
mov ecx, dword [0x1400442a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400313d7
mov rcx, rsi
call fcn.14003074c
cmp byte [0x14004413b], bl
je 0x1400313fe
test rsi, rsi
je 0x1400313fe
mov ecx, dword [0x1400442a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400313fe
mov rcx, rsi
call fcn.14003074c
nop
lea rcx, [rbp + 0xa0]
call fcn.140031ef0
nop
lea rcx, [rbp + 0x88]
call fcn.140031ef0
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1400330e0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm13, xmmword [r11 - 0x70]
movaps xmm14, xmmword [r11 - 0x80]
movaps xmm15, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14002cb38
int3
call fcn.140032ef8
int3