Function at 0x180004530
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, ebx
xor r14d, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebp, eax
cmp bl, 1
jne 0x1800045bd
xorps xmm0, xmm0
lea ecx, [r14 + 0x20]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
call fcn.18000faac
mov qword [rdi], rax
mov qword [rdi + 0x10], 0x11
mov qword [rdi + 0x18], 0x1f
movups xmm0, xmmword [str.Left_Mouse_Button]
movups xmmword [rax], xmm0
movzx ecx, byte [0x180012410]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], r14b
jmp 0x1800048c7
cmp bl, 2
jne 0x18000460b
xorps xmm0, xmm0
mov ecx, 0x20
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
call fcn.18000faac
mov qword [rdi], rax
mov qword [rdi + 0x10], 0x12
mov qword [rdi + 0x18], 0x1f
movups xmm0, xmmword [str.Right_Mouse_Button]
movups xmmword [rax], xmm0
movzx ecx, word [0x180012428]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], r14b
jmp 0x1800048c7
cmp bl, 4
jne 0x180004663
xorps xmm0, xmm0
mov ecx, 0x20
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
call fcn.18000faac
mov qword [rdi], rax
mov qword [rdi + 0x10], 0x13
mov qword [rdi + 0x18], 0x1f
movups xmm0, xmmword [str.Middle_Mouse_Button]
movups xmmword [rax], xmm0
movzx ecx, word [0x180012440]
mov word [rax + 0x10], cx
movzx ecx, byte [0x180012442]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], r14b
jmp 0x1800048c7
cmp bl, 5
jne 0x1800046a6
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_1]
movsd qword [rdi], xmm0
mov eax, dword [0x180012450]
mov dword [rdi + 8], eax
movzx eax, byte [0x180012454]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], r14b
jmp 0x1800048c7
cmp bl, 6
jne 0x1800046e9
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_2]
movsd qword [rdi], xmm0
mov eax, dword [0x180012460]
mov dword [rdi + 8], eax
movzx eax, byte [0x180012464]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], r14b
jmp 0x1800048c7
lea eax, [rbx - 0x21]
cmp eax, 0x84
ja case.0x18000470e.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x4908]
mov ecx, dword [rdx + rax*4 + 0x4900]
add rcx, rdx
jmp rcx
bts ebp, 8
mov rax, qword gs:[0x60]
shl ebp, 0x10
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov esi, dword [rcx + r10 + 0x88]
add rsi, r10
cmp rsi, r10
je 0x1800047a7
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x1800047a7
mov ebx, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xad06f8b9
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800047a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180004780
cmp r8d, 0x7ffa1c31
je 0x1800047ac
test r9d, r9d
jne 0x180004760
mov rax, qword [rax]
jmp 0x180004730
mov ecx, dword [rsi + 0x24]
mov r8d, 0x80
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x30]
add rax, r10
mov ecx, ebp
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], r14
nop dword [rax]
inc rbx
cmp byte [rax + rbx], r14b
jne 0x1800047f0
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x1800048f2
cmp rbx, 0xf
ja 0x180004837
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x18], 0xf
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], r14b
jmp 0x1800048c7
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x18000486c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000faac
test rax, rax
je 0x180004893
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x1800048a7
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x18000489a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800048f8
jmp 0x180004851
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1800048a7
call fcn.18000faac
mov r14, rax
mov r8, rbx
mov qword [rdi], r14
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x10], rbx
mov rcx, r14
mov qword [rdi + 0x18], rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000f7f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1800016a0
int3
call fcn.180001600
int3