Function at 0x140025490
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1403150c0]
xor rax, rsp
mov qword [rbp + 0x40], rax
cmp byte [0x1403376b8], 0
jne 0x140025811
movabs rsi, 0x7fffffffffffffff
mov r14d, 1
xor r15d, r15d
nop
mov eax, dword [0x1403376c8]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x38]
call fcn.140001e00
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x140025535
js 0x140025535
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x140025530
mov ecx, 0xff
cmovge ecx, r14d
test cl, cl
jns 0x140025530
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x140025535
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.140004d00
cmp byte [0x1403374e4], 0
je 0x140025804
cmp qword [0x140339740], 0
je 0x140025804
lea rcx, [rbp - 0x60]
call fcn.140024490
mov qword [rbp + 0x38], 0
movd xmm1, dword [0x1403374f0]
cvtdq2ps xmm1, xmm1
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
movzx r9d, byte [0x1403374ec]
mov r8d, dword [0x1403374f8]
call fcn.140032b50
test al, al
je 0x140025710
cmp byte [rbp - 0x20], 0
jne 0x1400257fb
cmp byte [rbp + 0x34], 0
je 0x1400257fb
mov ecx, dword [0x1403374e8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140025710
cmp byte [0x1403393b1], 0
jne 0x1400257fb
movsxd rbx, dword [0x1403374fc]
lea rcx, [rsp + 0x40]
call fcn.140001e00
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x140025622
js 0x140025622
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x14002561d
mov ecx, 0xff
cmovge ecx, r14d
test cl, cl
jns 0x14002561d
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x140025622
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.140004d00
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x4c], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x5c], 2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400256d6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400256d6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x863e6972
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400256d1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400256b0
cmp r8d, 0x66285d44
je 0x1400256db
test r9d, r9d
jne 0x140025690
mov rax, qword [rax]
jmp 0x140025660
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_41
lea rdx, [rsp + 0x48]
mov ecx, r14d
call r9
mov byte [0x1403393b1], 1
jmp 0x1400257fb
cmp byte [0x1403393b1], 0
je 0x1400257fb
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x74], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov dword [rsp + 0x70], r15d
mov dword [rbp - 0x7c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400257c6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400257c6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xfb54e7f0
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400257c1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400257a0
cmp r8d, 0xe7f9802
je 0x1400257cb
test r9d, r9d
jne 0x140025780
mov rax, qword [rax]
jmp 0x140025750
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_41
lea rdx, [rsp + 0x70]
mov ecx, r14d
call r9
mov byte [0x1403393b1], 0
lea rcx, [rbp - 0x60]
call fcn.140005520
cmp byte [0x1403376b8], 0
je 0x1400254e0
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.1400f2ba0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret