Function at 0x1400020a0
Capabilities:
Access peb ldr_data
Create thread
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x150
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
mov rax, qword [0x140321090]
xor rax, rsp
mov qword [rbp + 0x18], rax
xor r15d, r15d
cmp byte [0x1403b2d50], r15b
jne 0x14000218e
movabs rdi, 0x7ffffffed5fa0dff
movabs rsi, 0x7fffffffffffffff
movabs r14, 0x12a05f200
nop dword [rax + rax]
lea rcx, [0x1403b2cd0]
call fcn.140026880
cmp byte [0x1403b2d50], r15b
jne 0x14000218e
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov r8, rax
cmp rbx, 0x989680
jne 0x140002146
imul rax, r8, 0x64
jmp 0x140002169
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
mov rax, r8
cqo
idiv rbx
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rdi
jge 0x140002178
lea rcx, [rax + r14]
mov qword [rbp - 0x80], rcx
jmp 0x14000217c
mov qword [rbp - 0x80], rsi
lea rcx, [rbp - 0x80]
call fcn.140004710
cmp byte [0x1403b2d50], r15b
je 0x140002110
mov ecx, dword [0x1403b2d98]
call fcn.140082720
call fcn.1400828f0
mov ecx, 1
call fcn.1400efb80
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140004be0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140002a3b
cmp dword [rbp - 0x68], 0
jne 0x1400021ed
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14000220d
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov ecx, 1
call fcn.1400efb80
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140004c10]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140002a2b
cmp dword [rbp - 0x68], 0
jne 0x140002264
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140002284
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov ecx, 1
call fcn.1400efb80
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140004c40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140002a1b
cmp dword [rbp - 0x68], 0
jne 0x1400022db
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400022fb
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
mov ecx, 1
call fcn.1400efb80
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x140004c70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140002a0b
cmp dword [rbp - 0x68], 0
jne 0x140002352
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140002372
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x70], xmm0
cmp byte [0x1403b223a], 0
je 0x1400029c1
xor eax, eax
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x28], 1
mov byte [rbp - 0x24], 1
mov rax, qword [0x1403b22a0]
mov qword [rbp - 0x40], rax
mov rax, qword [0x1403b2248]
mov qword [0x1403b23e8], rax
mov rax, qword [0x1403b22a8]
mov qword [0x1403b23f0], rax
call fcn.140039890
mov rcx, qword [rbp - 0x40]
call fcn.140066ca0
mov rdx, qword [0x1403b23f0]
mov rcx, qword [0x1403b23e8]
call fcn.1400669f0
call fcn.14007a210
lea rcx, [0x1403b30f0]
call fcn.140006580
nop
call fcn.14007a560
lea rax, [0x1401066b0]
mov qword [rsp + 0x40], rax
lea rax, [0x1400821c0]
mov qword [rsp + 0x48], rax
movzx eax, byte [rbp - 0x68]
mov byte [rsp + 0x50], al
movzx eax, byte [rbp - 0x67]
mov byte [rsp + 0x51], al
movzx eax, byte [rbp - 0x66]
mov byte [rsp + 0x52], al
movzx eax, byte [rbp - 0x65]
mov byte [rsp + 0x53], al
lea rax, [rbp - 0x40]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x50], rax
lea rdx, [rsp + 0x40]
call fcn.140082f10
nop
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140002479
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
cmp rcx, rdx
setne dl
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
movups xmmword [rbp + 8], xmm0
movss xmm6, dword [0x14030a514]
movss xmm7, dword [0x14030a5c8]
movss xmm8, dword [0x14030a550]
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x1403b22a0]
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400024d8
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x18]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, qword [0x140395278]
movzx eax, byte [rbp - 0x24]
mov byte [rcx + 0x58], al
lea rcx, [0x1403b2cd0]
call fcn.14002bc10
call fcn.14002e110
mov r8d, dword [rbp - 0x20]
mov r9d, dword [rbp - 0x1c]
test r9d, r9d
jne 0x140002509
test r8d, r8d
je 0x140002586
mov rcx, qword [0x1403b22d0]
test rcx, rcx
je 0x14000252a
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1403b22d0], r15
mov r9d, dword [rbp - 0x1c]
mov r8d, dword [rbp - 0x20]
mov rcx, qword [0x1403b22b8]
mov rax, qword [rcx]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor edx, edx
call qword [rax + 0x68]
mov qword [rbp - 0x20], r15
mov rcx, qword [0x1403b22b8]
mov rax, qword [rcx]
lea r9, [rbp - 0x80]
lea r8, [0x140108418]
xor edx, edx
call qword [rax + 0x48]
mov rcx, qword [0x1403b2248]
mov rax, qword [rcx]
lea r9, [0x1403b22d0]
xor r8d, r8d
mov rdx, qword [rbp - 0x80]
call qword [rax + 0x48]
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov ecx, dword [reloc.WLDAP32.dll_Ordinal_45]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x1400025f0
cmp byte [0x1403b2ca0], 0
jne 0x1400025f7
mov byte [0x1403b2ca0], 1
cmp byte [rbp - 0x24], 0
sete al
mov byte [rbp - 0x24], al
mov edx, 0xffffffec
mov rcx, qword [rbp - 0x40]
test al, al
je 0x1400025d8
mov r8d, 0x80000a8
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x1400025f7
mov r8d, 0x80800a8
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x1400025f7
mov byte [0x1403b2ca0], 0
lea rdx, [rbp - 0x70]
mov rcx, qword [0x1403b22b0]
call qword [sym.imp.USER32.dll_GetClientRect]
mov r9d, 2
lea r8, [rbp - 0x70]
xor edx, edx
mov rcx, qword [0x1403b22b0]
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [rbp - 0x64]
mov r8d, dword [rbp - 0x6c]
sub eax, r8d
mov r9d, dword [rbp - 0x68]
mov edx, dword [rbp - 0x70]
sub r9d, edx
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
mov rcx, qword [0x1403b22a0]
call qword [sym.imp.USER32.dll_MoveWindow]
movzx eax, byte [reloc.WS2_32.dll_accept]
cmp al, byte [0x140395184]
je 0x14000271f
mov byte [0x140395184], al
neg al
sbb esi, esi
and esi, 0x11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400026f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400026f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x4f2fe57f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400026f1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400026d0
cmp r8d, 0x8734d881
je 0x1400026fb
test r9d, r9d
jne 0x1400026b0
mov rax, qword [rax]
jmp 0x140002680
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
mov edx, esi
mov rcx, qword [0x1403b22a0]
call r8
mov rax, qword [0x140395278]
test rax, rax
je 0x140002734
mov rcx, qword [rax + 0x98]
jmp 0x140002737
mov rcx, r15
cmp qword [rcx + 0x48], 0
jne 0x140002743
call fcn.140066390
call fcn.140067770
call fcn.14003c0e0
mov rax, qword [0x140395278]
cmp byte [0x1403939c4], 0
je 0x140002821
mov rax, qword [rax + 0x4b00]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.14003b790
mov rbx, rax
movaps xmm0, xmmword [0x14030abf0]
movups xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call fcn.1400375b0
mov edi, eax
movd xmm2, dword [reloc.WS2_32.dll_ioctlsocket]
cvtdq2ps xmm2, xmm2
mov rax, qword [0x140395278]
movss xmm1, dword [rax + 0x14]
mulss xmm1, xmm6
movss xmm0, dword [rax + 0x10]
mulss xmm0, xmm6
movss dword [rsp + 0x30], xmm0
movss dword [rsp + 0x34], xmm1
test edi, 0xff000000
je 0x140002821
comiss xmm6, xmm2
ja 0x140002821
subss xmm2, xmm6
mov dword [rsp + 0x28], 0x167
movss dword [rsp + 0x20], xmm7
xorps xmm3, xmm3
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14005bf50
movss dword [rsp + 0x28], xmm8
mov dword [rsp + 0x20], 1
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.14005a590
mov dword [rbx + 0x78], r15d
mov rax, qword [0x140395278]
cmp byte [0x1403939c5], 0
je 0x1400028e6
mov rax, qword [rax + 0x4b00]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax]
call fcn.14003b790
mov rbx, rax
movaps xmm0, xmmword [0x14030aa50]
movups xmmword [rbp - 0x50], xmm0
lea rcx, [rbp - 0x50]
call fcn.1400375b0
mov edi, eax
movd xmm2, dword [0x140393928]
cvtdq2ps xmm2, xmm2
mov rcx, qword [0x140395278]
movss xmm1, dword [rcx + 0x14]
mulss xmm1, xmm6
movss xmm0, dword [rcx + 0x10]
mulss xmm0, xmm6
movss dword [rsp + 0x38], xmm0
movss dword [rsp + 0x3c], xmm1
test eax, 0xff000000
je 0x1400028e6
comiss xmm6, xmm2
ja 0x1400028e6
subss xmm2, xmm6
mov dword [rsp + 0x28], 0x167
movss dword [rsp + 0x20], xmm7
xorps xmm3, xmm3
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14005bf50
movss dword [rsp + 0x28], xmm8
mov dword [rsp + 0x20], 1
mov r9d, edi
mov r8d, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x80]
mov rcx, rbx
call fcn.14005a590
mov dword [rbx + 0x78], r15d
cmp byte [0x1403939ac], 0
je 0x1400028f4
call fcn.140024b10
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140002902
call fcn.140022100
lea rcx, [rbp - 0x40]
call fcn.140081210
call fcn.14003dcd0
call fcn.14003e0d0
mov rcx, qword [0x1403b22a8]
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [0x1403b22d0]
lea edx, [r9 + 1]
call qword [rax + 0x108]
mov rcx, qword [0x1403b22a8]
mov rax, qword [rcx]
lea r8, [0x1403b2cb8]
mov rdx, qword [0x1403b22d0]
call qword [rax + 0x190]
mov rax, qword [0x140395278]
mov rax, qword [rax + 0x4b00]
mov rcx, qword [rax]
add rcx, 0x48
mov rax, r15
cmp byte [rcx], r15b
cmovne rax, rcx
mov rcx, rax
call fcn.140065920
mov rcx, qword [0x1403b22b8]
mov rax, qword [rcx]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x40]
cmp byte [0x1403939f0], 0
jne 0x1400029f9
movsxd rax, dword [reloc.WS2_32.dll_accept]
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
call fcn.140003ae0
cmp dword [rbp - 0x10], 0x12
jne 0x1400024a1
call fcn.140066bb0
call fcn.140066ee0
call fcn.140039970
nop
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1400efb60
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140066bb0
call fcn.140066ee0
call fcn.140039970
nop
jmp 0x1400029c1
mov dword [rbp - 0x68], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x68], r15d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3