Function at 0x180029200
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
cmp byte [0x18023295f], 0
je 0x1800299e6
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800292b7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800292b7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x46cec7f5
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800292b2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180029290
cmp r8d, 0x66a7ba55
je 0x1800292bc
test r9d, r9d
jne 0x180029270
mov rax, qword [rax]
jmp 0x180029240
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
add rax, r10
call rax
test ax, ax
jns 0x1800299d6
mov eax, dword [0x180232968]
test eax, eax
jne 0x180029309
call fcn.180028e30
test rax, rax
je 0x1800299d6
mov rcx, rax
call fcn.180032940
jmp 0x1800299d6
mov qword [rsp + 0x1d8], r12
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm7
movaps xmmword [rsp + 0x190], xmm8
movaps xmmword [rsp + 0x180], xmm9
cmp eax, 0x3e7
jne 0x18002949b
call fcn.1800430d0
movss xmm9, dword [rax + 8]
movss xmm6, dword [rax + 0xc]
mulss xmm9, dword [0x18019dd18]
mulss xmm6, dword [0x18019dd18]
call fcn.180028e30
mov rbx, rax
test rax, rax
je 0x1800299ac
mov r8d, 0x796e
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.180028b70
mov ecx, dword [0x180232964]
dec ecx
cmp ecx, 5
ja case.default.0x1800293a4
lea r12, [0x180000000]
movsxd rcx, ecx
mov eax, dword [r12 + rcx*4 + 0x299f0]
add rax, r12
jmp rax
mov r8d, 7
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.180028b70
movsd xmm8, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x78]
jmp 0x1800293f7
mov r8d, 8
jmp 0x1800293ac
mov r8d, 1
jmp 0x1800293ac
mov r8d, 2
jmp 0x1800293ac
mov r8d, 5
jmp 0x1800293ac
mov r8d, 6
jmp 0x1800293ac
mov ebx, dword [rbp - 0x48]
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x60]
movsd qword [rbp - 0x60], xmm8
lea rcx, [rbp + 0xf0]
mov dword [rbp - 0x58], ebx
call fcn.1800313c0
movss xmm0, dword [rbp + 0xf4]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x18019dd50]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x18019dd50]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0xf0]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
ucomiss xmm1, xmm0
ja 0x18002946b
sqrtss xmm0, xmm0
jmp 0x180029470
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [reloc.WLDAP32.dll_Ordinal_30]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x1800299ac
lea rcx, [rbp - 0x70]
movsd qword [rbp - 0x70], xmm8
mov dword [rbp - 0x68], ebx
call fcn.180027e50
jmp 0x1800299ac
cmp eax, 1
jne 0x1800299ac
mov rax, qword [0x1802329a0]
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1d0], r13
mov qword [rsp + 0x1c8], r14
mov rdi, qword [rax]
mov qword [rsp + 0x1c0], r15
movaps xmmword [rsp + 0x130], xmm14
movaps xmmword [rsp + 0x120], xmm15
test rdi, rdi
je 0x1800294e9
mov rdi, qword [rdi + 8]
mov rax, qword [0x1802329a8]
mov rsi, qword [rax]
test rsi, rsi
je 0x1800294fc
mov rsi, qword [rsi + 0x18]
movss xmm14, dword [0x18019dd18]
lea r12, [0x180000000]
movsd xmm15, qword [0x18019dd50]
xor r14d, r14d
movaps xmmword [rsp + 0x170], xmm10
xor r15d, r15d
movaps xmmword [rsp + 0x160], xmm11
mov r13d, 0x8001
movaps xmmword [rsp + 0x150], xmm12
movaps xmmword [rsp + 0x140], xmm13
test rsi, rsi
jne 0x18002954e
xor ecx, ecx
jmp 0x180029555
mov rcx, qword [rsi + 0x108]
movsxd rax, r14d
cmp rax, rcx
jae 0x180029956
test rsi, rsi
je 0x18002994a
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x18002994a
mov rcx, qword [r15 + rax]
test rcx, rcx
je 0x18002994a
test rdi, rdi
jne 0x180029597
xorps xmm2, xmm2
xorps xmm4, xmm4
xorps xmm3, xmm3
jmp 0x1800295b1
movsd xmm3, qword [rdi + 0x90]
movss xmm4, dword [rdi + 0x98]
movaps xmm0, xmm3
shufps xmm0, xmm0, 0x55
movaps xmm2, xmm0
movsd xmm1, qword [rcx + 0x90]
subss xmm4, dword [rcx + 0x98]
movaps xmm0, xmm1
subss xmm3, xmm1
shufps xmm0, xmm0, 0x55
subss xmm2, xmm0
xorps xmm0, xmm0
mulss xmm4, xmm4
mulss xmm3, xmm3
mulss xmm2, xmm2
addss xmm2, xmm3
addss xmm2, xmm4
ucomiss xmm0, xmm2
ja 0x1800295f5
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1800295fd
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
movd xmm0, dword [0x18022f410]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
jb 0x18002994a
call fcn.1800430d0
movss xmm10, dword [rax + 8]
movss xmm6, dword [rax + 0xc]
mulss xmm10, xmm14
mulss xmm6, xmm14
call fcn.180028e30
mov rbx, rax
test rax, rax
je 0x180029956
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.180028b70
movsxd rax, dword [0x180232964]
cmp eax, 6
ja case.default.0x18002966f
mov edx, dword [r12 + rax*4 + 0x29a08]
add rdx, r12
jmp rdx
xor r8d, r8d
lea rcx, [rbp - 0x40]
mov rdx, rbx
call fcn.180028b70
movss xmm7, dword [rbp - 0x38]
movss xmm8, dword [rbp - 0x40]
movss xmm9, dword [rbp - 0x3c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800297b5
mov r8d, 7
lea rcx, [rbp - 0x34]
mov rdx, rbx
call fcn.180028b70
movss xmm7, dword [rbp - 0x2c]
movss xmm8, dword [rbp - 0x34]
movss xmm9, dword [rbp - 0x30]
movss dword [rbp - 0x78], xmm7
jmp 0x1800297b5
mov r8d, 8
lea rcx, [rbp - 0x28]
mov rdx, rbx
call fcn.180028b70
movss xmm7, dword [rbp - 0x20]
movss xmm8, dword [rbp - 0x28]
movss xmm9, dword [rbp - 0x24]
movss dword [rbp - 0x78], xmm7
jmp 0x1800297b5
mov r8d, 1
lea rcx, [rbp - 0x70]
mov rdx, rbx
call fcn.180028b70
movss xmm7, dword [rbp - 0x68]
movss xmm8, dword [rbp - 0x70]
movss xmm9, dword [rbp - 0x6c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800297b5
mov r8d, 2
lea rcx, [rbp - 0x60]
mov rdx, rbx
call fcn.180028b70
movss xmm7, dword [rbp - 0x58]
movss xmm8, dword [rbp - 0x60]
movss xmm9, dword [rbp - 0x5c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800297b5
mov r8d, 5
lea rcx, [rbp - 0x50]
mov rdx, rbx
call fcn.180028b70
movss xmm7, dword [rbp - 0x48]
movss xmm8, dword [rbp - 0x50]
movss xmm9, dword [rbp - 0x4c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800297b5
mov r8d, 6
lea rcx, [rsp + 0x70]
mov rdx, rbx
call fcn.180028b70
movss xmm7, dword [rsp + 0x78]
movss xmm8, dword [rsp + 0x70]
movss xmm9, dword [rsp + 0x74]
movss dword [rbp - 0x78], xmm7
jmp 0x1800297b5
movss xmm7, dword [rbp - 0x78]
movss xmm9, dword [rbp - 0x7c]
movss xmm8, dword [rbp - 0x80]
movaps xmm0, xmm8
movss dword [rbp - 8], xmm7
unpcklps xmm0, xmm9
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xf0]
movsd qword [rbp - 0x80], xmm0
movsd qword [rbp - 0x10], xmm0
call fcn.1800313c0
test rdi, rdi
jne 0x1800297ef
xorps xmm11, xmm11
xorps xmm12, xmm12
xorps xmm13, xmm13
jmp 0x180029816
movsd xmm1, qword [rdi + 0x90]
movss xmm13, dword [rdi + 0x98]
movaps xmm0, xmm1
shufps xmm0, xmm0, 0x55
movsd qword [rbp], xmm1
movaps xmm12, xmm0
movss xmm11, dword [rbp]
movss xmm0, dword [rbp + 0xf4]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movaps xmm1, xmm15
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movss xmm0, dword [rbp + 0xf0]
cvtps2pd xmm1, xmm10
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movaps xmm1, xmm15
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
ucomiss xmm1, xmm0
ja 0x180029869
sqrtss xmm0, xmm0
jmp 0x18002986e
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [reloc.WLDAP32.dll_Ordinal_30]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x18002994a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x18002994a
movd xmm6, dword [reloc.WS2_32.dll_sendto]
mov edx, 0xffffffff
movabs rcx, 0x43a66c31c68491c0
cvtdq2ps xmm6, xmm6
call fcn.18001d650
mov edx, 0xffffffff
movabs rcx, 0x43a66c31c68491c0
mov ebx, eax
call fcn.18001d650
mov edx, eax
movabs rcx, 0xa6db4965674d243
call fcn.18001d650
movss dword [rsp + 0x68], xmm6
movaps xmm2, xmm12
mov dword [rsp + 0x60], 1
movaps xmm1, xmm11
mov dword [rsp + 0x58], 1
movabs rcx, 0x867654cbc7606f2c
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov eax, dword [reloc.WS2_32.dll_getpeername]
mov dword [rsp + 0x40], eax
mov eax, dword [reloc.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x38], eax
cvtps2pd xmm0, xmm13
movss dword [rsp + 0x30], xmm7
addsd xmm0, qword [0x18019dd30]
movss dword [rsp + 0x28], xmm9
movss dword [rsp + 0x20], xmm8
cvtpd2ps xmm3, xmm0
call fcn.18001eb10
inc r14d
add r15, 0x10
jmp 0x180029545
movaps xmm11, xmmword [rsp + 0x160]
movaps xmm13, xmmword [rsp + 0x140]
movaps xmm12, xmmword [rsp + 0x150]
movaps xmm10, xmmword [rsp + 0x170]
movaps xmm14, xmmword [rsp + 0x130]
mov rsi, qword [rsp + 0x200]
mov r13, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x1c0]
movaps xmm15, xmmword [rsp + 0x120]
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1a0]
mov r12, qword [rsp + 0x1d8]
movaps xmm8, xmmword [rsp + 0x190]
movaps xmm9, xmmword [rsp + 0x180]
mov rbx, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x208]
add rsp, 0x1e0
pop rbp
ret