Function at 0x140036580
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x210
vmovaps xmmword [rax - 0x48], xmm6
vmovaps xmmword [rax - 0x58], xmm7
vmovaps xmmword [rax - 0x68], xmm8
vmovaps xmmword [rax - 0x78], xmm9
vmovaps xmmword [rax - 0x88], xmm10
vmovaps xmmword [rax - 0x98], xmm11
vmovaps xmmword [rax - 0xa8], xmm12
vmovaps xmmword [rax - 0xb8], xmm13
vmovaps xmmword [rax - 0xc8], xmm14
vmovaps xmmword [rax - 0xd8], xmm15
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
vmovss xmm15, dword [0x14011f078]
vmovsd xmm14, qword [0x14011f0d8]
vmovss xmm12, dword [0x14011ef30]
vmovss xmm13, dword [0x14011f024]
xor r12d, r12d
lea r14, [r15 + 0x160]
movabs r13, 0xb2f4fc0794908cf3
vxorps xmm11, xmm11, xmm11
movabs rsi, 0x431bde82d7b634db
nop
cmp qword [r15 + 0xc8], r12
je 0x140036640
mov rcx, r15
call fcn.140036200
cmp byte [0x1401320e8], r12b
mov rdi, rax
je 0x1400368ae
mov ecx, dword [0x1401d82e0]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x68], rax
xor r9d, r9d
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [0x1401d8280]
xor r8d, r8d
mov dword [rsp + 0x48], 0x10
xor edx, edx
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rcx
mov rcx, qword [r15 + 0xd8]
add rcx, 0x1898
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [0x1401d82e8]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x160], r12
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x70], 8
mov dword [rbp - 0x68], r12d
mov dword [rbp - 0x64], 4
call fcn.14008af10
cmp qword [rbp + 0x160], r12
je 0x1400368ae
cmp byte [0x1401d84f8], r12b
je 0x140036736
lea rcx, [rbp + 0x168]
call fcn.140031c80
mov byte [0x1401d84f8], r12b
mov rcx, qword [rax]
mov qword [0x1401d84e8], rcx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140036757
imul rcx, rcx, 0x64
jmp 0x1400367c3
cmp rbx, 0x16e3600
jne 0x1400367a2
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
jmp 0x1400367b9
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
mov qword [0x1401d84f0], rcx
mov rax, rsi
sub rcx, qword [0x1401d84e8]
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1401d8674], edx
test rdi, rdi
je 0x1400368ae
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, edx
vcomiss xmm0, dword [0x1401d8318]
jb 0x1400368ae
cmp byte [0x1401d83f0], r12b
jne 0x140036828
mov ecx, dword [0x1401d840c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400368ae
movzx esi, byte [0x1401320f5]
movzx ebx, byte [0x1401320fd]
test sil, sil
je 0x140036855
mov rcx, r14
call fcn.140033b50
cmp rax, 0xffffffffffffffff
je 0x140036855
call fcn.140002610
mov byte [0x1401d84f8], 1
test bl, bl
je 0x140036899
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140036866
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140036899
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x160], 0x3e8
call fcn.140033e50
call fcn.140002610
mov byte [0x1401d84f8], 1
test sil, sil
jne 0x1400368ae
test bl, bl
jne 0x1400368ae
call fcn.140002610
mov byte [0x1401d84f8], 1
cmp byte [0x1401320f4], r12b
je 0x140036d9a
test rdi, rdi
je 0x140036d9a
mov ecx, dword [0x1401d8408]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140036d9a
cmp byte [0x1401d83f8], r12b
mov rsi, qword [rdi]
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x18]
mov ecx, dword [0x1401d84e0]
je 0x14003690e
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, r12d
jmp 0x140036959
test ecx, ecx
je 0x140036953
sub ecx, 1
je 0x14003694b
sub ecx, 1
je 0x140036943
sub ecx, 1
je 0x14003693b
cmp ecx, 1
jne 0x140036936
mov eax, 0x25
nop dword [rax + rax]
sub rax, 1
jne 0x140036930
mov r9d, r12d
jmp 0x140036959
mov r9d, 2
jmp 0x140036959
mov r9d, 0x42
jmp 0x140036959
mov r9d, 0x43
jmp 0x140036959
mov r9d, 0x6e
mov r8, rdi
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140031f10
vmovsd xmm6, qword [rbp + 0x60]
vmovsd xmm7, qword [rbp + 0x50]
vmovsd xmm8, qword [rbp + 0x58]
mov rcx, rsi
vmovsd qword [rbp - 0x38], xmm6
call fcn.140034530
mov ecx, dword [0x1401d82e0]
add rax, 0x168
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov dword [rsp + 0x48], 0x10
lea rax, [rbp - 0x80]
mov qword [rsp + 0x68], rax
xor r8d, r8d
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [0x1401d8280]
xor edx, edx
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov dword [rsp + 0x38], 0x10
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
vxorpd xmm0, xmm0, xmm0
mov qword [rsp + 0x60], rcx
mov rcx, qword [0x1401d82e8]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
vmovsd qword [rbp - 0x70], xmm0
vmovupd xmmword [rbp - 0x80], xmm0
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x70], 0x18
mov dword [rbp - 0x58], r12d
mov dword [rbp - 0x54], 4
call fcn.14008af10
cmp byte [0x1401320fc], r12b
vsubsd xmm0, xmm7, qword [0x1401d7738]
vsubsd xmm1, xmm8, qword [0x1401d7740]
vsubsd xmm2, xmm6, qword [0x1401d7748]
vmulsd xmm3, xmm0, xmm0
vfmadd231sd xmm3, xmm1, xmm1
vfmadd231sd xmm3, xmm2, xmm2
vsqrtsd xmm0, xmm3, xmm3
vmulsd xmm10, xmm0, qword [0x14011f028]
je 0x140036bac
mov r9d, 0x6e
lea rdx, [rbp - 0x10]
mov r8, rdi
mov rcx, rbx
call fcn.140031f10
movzx ebx, byte [0x1401d8473]
vmovsd xmm9, qword [rbp + 0x60]
vmovsd xmm7, qword [rbp + 0x50]
vmovsd xmm8, qword [rbp + 0x58]
vmovsd qword [rbp - 0x38], xmm9
test bl, bl
je 0x140036aff
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140036aa2
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140036af7
cmp byte [0x1401d84f9], r12b
je 0x140036ac3
vmovss dword [0x140132390], xmm15
vmovss xmm1, dword [0x14011f224]
vandps xmm2, xmm1, xmmword [0x14011f580]
vcvtss2sd xmm0, xmm2, xmm2
vdivsd xmm1, xmm10, xmm0
vcvtsd2ss xmm4, xmm1, xmm1
vmovss xmm1, dword [0x14011f2a8]
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm7, xmm0, xmm14
jmp 0x140036b72
test bl, bl
jne 0x140036bac
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140033bf0
mov rcx, rax
call fcn.140034640
mov rdx, r14
lea rcx, [rsp + 0x50]
vmovaps xmm6, xmm0
call fcn.140033bf0
mov rcx, rax
call fcn.140035460
vucomiss xmm6, xmm11
vmovaps xmm5, xmm0
je 0x140036bac
vxorps xmm1, xmm1, xmm1
vmovss xmm2, xmm1, xmm6
vandps xmm3, xmm2, xmmword [0x14011f580]
vcvtss2sd xmm1, xmm3, xmm3
vdivsd xmm2, xmm10, xmm1
vmulss xmm1, xmm5, dword [0x14011f2a0]
vcvtsd2ss xmm4, xmm2, xmm2
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm7, xmm0, xmm14
vxorps xmm0, xmm0, xmm0
vmovss xmm1, xmm0, xmm1
vmulsd xmm2, xmm3, qword [rbp - 0x78]
vmulsd xmm0, xmm3, qword [rbp - 0x70]
vfmadd231sd xmm8, xmm2, xmm14
vandps xmm2, xmm1, xmmword [0x14011f580]
vmovaps xmm3, xmm9
vfmadd231sd xmm3, xmm0, xmm14
vmulss xmm0, xmm2, xmm4
vmulss xmm1, xmm0, dword [0x14011f130]
vcvtss2sd xmm2, xmm1, xmm1
vaddsd xmm3, xmm3, xmm2
vmovsd qword [rbp - 0x38], xmm3
vunpcklpd xmm0, xmm7, xmm8
vmovups xmmword [rsp + 0x50], xmm0
vmovsd xmm0, qword [rbp - 0x38]
lea r8, [rbp + 0x158]
lea rdx, [rsp + 0x50]
vmovsd qword [rsp + 0x60], xmm0
vmovss dword [rbp + 0x158], xmm11
vmovss dword [rbp + 0x15c], xmm11
call fcn.140037d70
test al, al
je 0x140036d9a
vmovss xmm0, dword [rbp + 0x158]
vucomiss xmm0, xmm11
vmovss xmm4, dword [0x140132390]
vmovss xmm1, dword [0x1401d84ac]
vmovss xmm2, dword [0x1401d84a8]
vmovaps xmm7, xmm11
vmovaps xmm6, xmm11
je 0x140036c3e
vsubss xmm0, xmm0, xmm1
vdivss xmm7, xmm0, xmm4
vaddss xmm3, xmm7, xmm1
vaddss xmm1, xmm1, xmm1
vcomiss xmm3, xmm1
ja 0x140036c39
vcomiss xmm3, xmm11
jae 0x140036c3e
vmovaps xmm7, xmm11
vmovss xmm0, dword [rbp + 0x15c]
vucomiss xmm0, xmm11
je 0x140036c6f
vsubss xmm1, xmm0, xmm2
vdivss xmm6, xmm1, xmm4
vaddss xmm3, xmm6, xmm2
vaddss xmm0, xmm2, xmm2
vcomiss xmm3, xmm0
ja 0x140036c6a
vcomiss xmm3, xmm11
jae 0x140036c6f
vmovaps xmm6, xmm11
cmp byte [0x1401d83e8], r12b
jne 0x140036d9a
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm7
vsubss xmm7, xmm0, xmm13
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
mov rax, qword [0x1401d8320]
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm6
vsubss xmm2, xmm0, xmm13
test rax, rax
jne 0x140036d83
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rbx, rdi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140036d64
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140036d64
mov r10d, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r10]
mov ecx, 0x811c9dc5
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140036d5f
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140036d40
cmp ecx, 0x20785c9b
je 0x140036db6
test r8d, r8d
jne 0x140036d20
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
je 0x140036d79
cmp qword [rax + 0x30], r12
jne 0x140036cf0
mov rax, r12
mov qword [0x1401d8320], rax
vcvttss2si r8d, xmm2
vcvttss2si edx, xmm7
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov ecx, 1
call rax
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x160], 1
call fcn.140033e50
jmp 0x140036634
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140036d7c