Function at 0x140010450
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x1330]
mov eax, 0x1430
call fcn.1400ce490
sub rsp, rax
mov rax, qword [0x140100080]
xor rax, rsp
mov qword [rbp + 0x1320], rax
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x40]
add rdx, qword [0x14011b4d8]
xor r15d, r15d
mov rdi, rcx
mov qword [rsp + 0x1468], r14
mov rcx, qword [0x14011b510]
mov qword [rsp + 0x20], r15
lea r9d, [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x40]
lea r9d, [r15 + 8]
mov rcx, qword [0x14011b510]
lea r8, [rsp + 0x70]
add rdx, 0x20
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov r14, qword [rsp + 0x70]
cmp byte [rdi + 0x2a], r15b
je 0x140010560
mov rdx, qword [0x14011b4c0]
lea r9d, [r15 + 8]
add rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x40]
mov rcx, qword [0x14011b510]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x40]
lea r9d, [r15 + 8]
add rdx, qword [0x14011b4e0]
lea r8, [rsp + 0x50]
mov rcx, qword [0x14011b510]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x50]
lea r9d, [r15 + 4]
movss xmm0, dword [rdi + 0x30]
lea r8, [rsp + 0x40]
mov rcx, qword [0x14011b510]
add rdx, 0x4c
movss dword [rsp + 0x40], xmm0
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14011b4c0]
lea r8, [rsp + 0x50]
add rdx, qword [0x14011b4a8]
mov r9d, 8
mov rcx, qword [0x14011b510]
mov qword [rsp + 0x20], r15
cmp byte [rdi + 0x2b], r15b
je 0x140010598
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov byte [rsp + 0x30], 1
jmp 0x1400105a3
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov byte [rsp + 0x30], r15b
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rcx, qword [0x14011b510]
add rdx, 0x189
mov r9d, 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x1458], rbx
cmp byte [rdi + 0x29], r15b
je 0x14001077f
mov qword [rsp + 0x1460], rsi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1314], 0xffffffff
mov edx, 1
mov dword [rbp - 0x6c], eax
nop
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 - 0x6c], eax
inc rdx
cmp rdx, 0x270
jb 0x140010600
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x270
call fcn.140010e60
mov ebx, eax
lea rcx, [rbp - 0x70]
shl rbx, 8
call fcn.140010e60
mov esi, eax
lea rcx, [rbp - 0x70]
shl rsi, 8
shr rsi, 0x20
shr rbx, 0x20
call fcn.140010e60
mov rdx, qword [0x14011b4c0]
lea r8, [rsp + 0x50]
add rdx, qword [0x14011b4a8]
mov r9d, 8
mov ecx, eax
shl rcx, 8
shr rcx, 0x20
mov byte [rsp + 0x42], cl
mov rcx, qword [0x14011b510]
mov byte [rsp + 0x40], bl
mov byte [rsp + 0x41], sil
mov byte [rsp + 0x43], 0xff
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
mov rcx, qword [0x14011b510]
add rdx, 0x48
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
je 0x140010777
mov rcx, qword [0x14011b510]
lea r8, [rsp + 0x50]
add rdx, 0x20
mov qword [rsp + 0x20], r15
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x140010777
mov ebx, dword [rsp + 0x40]
lea rdx, [rsi + 0xa4]
mov rcx, qword [0x14011b510]
lea r8, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14011b510]
lea rdx, [rsi + 0xa9]
mov r9d, 4
mov dword [rsp + 0x40], ebx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x14011b510]
lea rdx, [rsi + 0xa8]
mov r9d, 4
mov dword [rsp + 0x40], ebx
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rsi, qword [rsp + 0x1460]
cmp byte [rdi], r15b
je 0x1400107ea
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x40]
mov rcx, qword [0x14011b510]
add rdx, 0x280
mov r9d, 4
mov dword [rsp + 0x40], 0x43480000
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14011b4d0]
lea r8, [rsp + 0x40]
add rdx, qword [0x14011b4a8]
mov r9d, 4
mov rcx, qword [0x14011b510]
mov dword [rsp + 0x40], 0x42c80000
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x14011b510]
add rdx, 0x2c
mov r9d, 1
mov qword [rsp + 0x20], r15
mov byte [rsp + 0x30], r9b
cmp byte [rdi + 1], r15b
jne 0x14001081c
mov byte [rsp + 0x30], gethostname
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x30]
mov rcx, qword [0x14011b510]
add rdx, 0x189
mov r9d, 1
mov qword [rsp + 0x20], r15
mov byte [rsp + 0x30], r9b
cmp byte [rdi + 2], r15b
jne 0x140010857
mov byte [rsp + 0x30], r15b
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 3], r15b
je 0x140010abe
call fcn.14000fd40
mov rdx, qword [0x14011b4f8]
lea r8, [rsp + 0x60]
mov rcx, qword [0x14011b510]
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x50]
mov rcx, qword [0x14011b510]
add rdx, 0x90
mov r9d, recv
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x78]
mov rcx, qword [0x14011b510]
add rdx, 0x3d0
mov r9d, recv
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001090c
movss xmm1, dword [rsp + 0x54]
movd xmm0, dword [rdi + 0x10]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [rsp + 0x54], xmm1
mov ecx, 0x46
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140010934
movss xmm1, dword [rsp + 0x54]
movd xmm0, dword [rdi + 0x10]
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss dword [rsp + 0x54], xmm1
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14001095c
movss xmm1, dword [rsp + 0x58]
movd xmm0, dword [rdi + 0x10]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [rsp + 0x58], xmm1
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140010984
movss xmm1, dword [rsp + 0x58]
movd xmm0, dword [rdi + 0x10]
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss dword [rsp + 0x58], xmm1
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400109ac
movss xmm1, dword [rsp + 0x50]
movd xmm0, dword [rdi + 0x10]
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
movss dword [rsp + 0x50], xmm1
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400109d4
movss xmm1, dword [rsp + 0x50]
movd xmm0, dword [rdi + 0x10]
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss dword [rsp + 0x50], xmm1
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400109e8
mov byte [rdi + 3], r15b
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x60]
movsd xmm0, qword [rsp + 0x50]
add rdx, 0x90
mov eax, dword [rsp + 0x58]
mov r9d, recv
mov rcx, qword [0x14011b510]
movsd qword [rsp + 0x60], xmm0
mov dword [rsp + 0x68], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x60]
mov rcx, qword [0x14011b510]
add rdx, 0x30
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x60]
lea r8, [rsp + 0x40]
movsd xmm0, qword [rsp + 0x50]
mov r9d, recv
mov eax, dword [rsp + 0x58]
mov rcx, qword [0x14011b510]
lea rdx, [rbx + 0x30]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movsd xmm0, qword [rsp + 0x50]
lea rdx, [rbx + 0x50]
mov eax, dword [rsp + 0x58]
lea r8, [rsp + 0x40]
mov rcx, qword [0x14011b510]
mov r9d, recv
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 4], r15b
je 0x140010b5c
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x60]
mov rcx, qword [0x14011b510]
add rdx, 0x10c8
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movd xmm0, dword [rdi + 0x14]
lea r8, [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov r9d, 4
mov rcx, qword [0x14011b510]
cvtdq2ps xmm0, xmm0
mov qword [rsp + 0x20], r15
lea rdx, [rbx + 0xcf0]
movss dword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
movd xmm0, dword [rdi + 0x18]
lea rdx, [rbx + 0x170]
mov rcx, qword [0x14011b510]
lea r8, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
mov r9d, 4
mov qword [rsp + 0x20], r15
movss dword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x14011b4a8]
lea r8, [rsp + 0x60]
mov rcx, qword [0x14011b510]
add rdx, 0x10c8
mov r9d, 8
mov qword [rsp + 0x20], r15
cmp byte [rdi + 5], r15b
je 0x140010b97
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x40], 0x42c80000
jmp 0x140010ba5
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [rsp + 0x40], 0x3f800000
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x40]
mov rcx, qword [0x14011b510]
add rdx, 0xcf4
mov r9d, 4
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 7], r15b
je 0x140010bfd
mov rcx, qword [0x14011b510]
lea rdx, [r14 + 0x2f4]
mov r9d, 4
mov dword [rsp + 0x40], r15d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 8], r15b
je 0x140010c2c
mov rcx, qword [0x14011b510]
lea rdx, [r14 + 0x84]
mov r9d, 4
mov dword [rsp + 0x40], r15d
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r14 + 0x134]
mov rcx, qword [0x14011b510]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], r15
mov r9d, 4
mov dword [rsp + 0x40], 0x447a0000
cmp byte [rdi + 9], r15b
jne 0x140010c60
mov dword [rsp + 0x40], 0x3f800000
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 0xa], r15b
je 0x140010d28
mov rcx, qword [0x14011b510]
lea rdx, [r14 + 0x60]
mov r9d, 8
mov qword [rsp + 0x20], r15
lea r8, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rcx, qword [0x14011b510]
add rdx, 8
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x50]
lea r8, [rsp + 0x60]
mov rcx, qword [0x14011b510]
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rcx, qword [0x14011b510]
mov r9d, 8
mov qword [rsp + 0x20], r15
lea rdx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x14011b510]
lea r8, [rsp + 0x40]
mov r9d, 4
mov dword [rsp + 0x40], 0x41f00000
lea rdx, [rbx + 0x18]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rbx, qword [rsp + 0x1458]
cmp byte [rdi + 6], r15b
je 0x140010d68
movd xmm0, dword [rdi + 0x1c]
lea rdx, [r14 + 0xb0]
mov rcx, qword [0x14011b510]
lea r8, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
mov r9d, 4
mov qword [rsp + 0x20], r15
movss dword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rdx, [r14 + 0x28c]
mov r14, qword [rsp + 0x1468]
lea r8, [rsp + 0x40]
mov rcx, qword [0x14011b510]
mov r9d, 4
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x40], 0x461c4000
cmp byte [rdi + 0xb], r15b
jne 0x140010da4
mov dword [rsp + 0x40], 0x42f00000
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp byte [rdi + 0x20], r15b
je 0x140010e39
mov rdx, qword [0x14011b520]
lea r8, [rsp + 0x60]
add rdx, qword [0x14011b4f8]
mov r9d, 8
mov rcx, qword [0x14011b510]
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x60]
lea r8, [rsp + 0x50]
mov rcx, qword [0x14011b510]
add rdx, 0x10
mov r9d, 8
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
movd xmm0, dword [rdi + 0x24]
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov r9d, 4
mov rcx, qword [0x14011b510]
add rdx, 0x30
cvtdq2ps xmm0, xmm0
mov qword [rsp + 0x20], r15
movss dword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [rbp + 0x1320]
xor rcx, rsp
call fcn.1400cd8b0
add rsp, 0x1430
pop r15
pop rdi
pop rbp
ret