Function at 0x14001bb70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1403d3080]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor esi, esi
cmp byte [0x1403de1d0], sil
jne 0x14001c17a
movabs r14, 0x7fffffffffffffff
mov r15d, 0xff
nop dword [rax]
nop word [rax + rax]
mov eax, dword [0x1403de1e0]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x48]
call fcn.140001c50
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x14001bc25
js 0x14001bc25
imul r8, rbx, 0xf4240
mov rdx, r14
sub rdx, r8
cmp rax, rdx
je 0x14001bc20
mov ecx, 1
cmovl ecx, r15d
test cl, cl
jns 0x14001bc20
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x14001bc25
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.140004c20
cmp byte [0x1403de0a0], 0
je 0x14001c16d
cmp qword [0x140416008], 0
je 0x14001c16d
mov ecx, dword [0x1403de0a4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14001bd4e
cmp byte [0x1404156d9], al
je 0x14001c16d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001bd16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001bd16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x52125153
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001bd11
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001bcf0
cmp r8d, 0x4056fefb
je 0x14001bd1b
test r9d, r9d
jne 0x14001bcd0
mov rax, qword [rax]
jmp 0x14001bca0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r8d, Ordinal_45
lea rdx, [rbp + 8]
lea ecx, [r8 - 0x27]
call rax
mov byte [0x1404156d9], 0
jmp 0x14001c16d
mov rcx, qword [0x140415820]
test rcx, rcx
je 0x14001bd7f
cmp dword [0x14041578c], 0
je 0x14001bd7f
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x30]
mov rdx, qword [0x140415df0]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14001bdb6
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [0x140415d40]
call fcn.14002d740
mov rdx, qword [rax]
add rdx, 0x18
lea rcx, [rsp + 0x70]
call fcn.14001ab20
jmp 0x14001bdeb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rsp + 0x70]
call fcn.14001aa30
nop
cmp dword [rsp + 0x78], 0
jle 0x14001c070
movups xmm0, xmmword [0x140416008]
movups xmmword [rbp + 8], xmm0
movups xmm6, xmmword [0x140416018]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [0x140415820]
test rdx, rdx
jne 0x14001be27
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x40], edx
xorps xmm1, xmm1
jmp 0x14001be62
test rbx, rbx
je 0x14001be5c
cmp dword [0x14041578c], 0
je 0x14001be5c
add rdx, 0x90
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [0x140415820]
movss xmm1, dword [rsp + 0x38]
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
subss xmm0, xmm1
movaps xmm1, xmm6
shufps xmm1, xmm6, 0xaa
subss xmm1, dword [rsp + 0x3c]
shufps xmm6, xmm6, 0xff
subss xmm6, dword [rsp + 0x40]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
mulss xmm6, xmm6
addss xmm1, xmm6
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x14001bea9
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x14001beb1
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [0x1403de0ac]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
setbe al
cmp byte [rbp - 0x7f], 0
je 0x14001bed5
movzx eax, al
cmp byte [0x1403de0a8], 0
cmove eax, esi
movzx edi, al
cmp byte [rbp - 0x50], 0
cmovne edi, esi
test rbx, rbx
je 0x14001bf0c
cmp dword [0x14041578c], 0
je 0x14001bf0c
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp]
mov rdx, qword [0x140415de8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp], 0
je 0x14001c070
test dil, dil
je 0x14001c070
cmp byte [0x1404156d9], 0
jne 0x14001c15b
movsxd rbx, dword [0x1403de0b0]
lea rcx, [rsp + 0x50]
call fcn.140001c50
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
test rbx, rbx
je 0x14001bf7d
js 0x14001bf7d
imul r8, rbx, 0xf4240
mov rax, r14
sub rax, r8
cmp rcx, rax
je 0x14001bf78
mov edx, 1
cmovl edx, r15d
test dl, dl
jns 0x14001bf78
lea rax, [rcx + r8]
mov qword [rsp + 0x30], rax
jmp 0x14001bf7d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.140004c20
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001c036
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001c036
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x33d5affd
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001c031
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001c010
cmp r8d, 0x6351d95
je 0x14001c03b
test r9d, r9d
jne 0x14001bff0
mov rax, qword [rax]
jmp 0x14001bfc0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_45
lea rdx, [rbp + 8]
lea ecx, [r8 - 0x27]
call r9
mov byte [0x1404156d9], 1
jmp 0x14001c15b
cmp byte [0x1404156d9], 0
je 0x14001c15b
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3c], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov dword [rbp + 0x38], esi
mov dword [rbp + 0x4c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001c126
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001c126
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xd51ceec
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001c121
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001c100
cmp r8d, 0x678f596
je 0x14001c12b
test r9d, r9d
jne 0x14001c0e0
mov rax, qword [rax]
jmp 0x14001c0b0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_45
lea rdx, [rbp + 0x38]
lea ecx, [r8 - 0x27]
call r9
mov byte [0x1404156d9], 0
lea rcx, [rbp - 0x48]
call fcn.140005180
lea rcx, [rbp - 0x78]
call fcn.140003520
cmp byte [0x1403de1d0], 0
je 0x14001bbd0
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1401617c0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret