Function at 0x1400349f0
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
cmp byte [0x140064c42], 0
je 0x140034a02
call fcn.140033cb0
movsxd rax, dword [0x140064c94]
cmp eax, 0x10
ja case.default.0x140034a23
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x34ea4]
add rcx, rdx
jmp rcx
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x14004904a], 0
sete byte [0x14004904a]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x14006454c], 0
sete byte [0x14006454c]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x140064dc0], 0
sete byte [0x140064dc0]
add rsp, 0x48
ret
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140034aac
inc dword [0x140049044]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
dec dword [0x140049044]
add rsp, 0x48
ret
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140034adf
inc dword [0x140049064]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
dec dword [0x140049064]
add rsp, 0x48
ret
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140034b12
inc dword [0x140049050]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
dec dword [0x140049050]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x140042a13], 0
movsd xmm0, qword [str._QYSTL]
mov eax, dword [0x140042a10]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
je 0x140034cd1
xor r8d, r8d
cmp dword [0x140049018], 2
jl 0x140034c8c
movdqa xmm2, xmmword [0x140042c90]
mov eax, 4
movdqa xmm4, xmmword [0x140042df0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140042cb0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov r8d, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x30], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140042cd0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str._QYSTL]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140042d30]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140042d50]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140042cd0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x24]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140042d30]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140042d50]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x20]
add r9, rax
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x33
xor byte [r9 - 1], al
cmp r8d, 0xc
jl 0x140034ca0
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140034ce0
lea rdx, [rsp + 0x20]
call fcn.140038cf0
mov byte [0x140064c42], 1
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x140064d20], 0
sete byte [0x140064d20]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x140049048], 0
sete byte [0x140049048]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x140064d21], 0
sete byte [0x140064d21]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x14004905c], 0
sete byte [0x14004905c]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x140049054], 0
sete byte [0x140049054]
add rsp, 0x48
ret
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
cmp byte [0x140049049], 0
sete byte [0x140049049]
add rsp, 0x48
ret
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140034df9
inc dword [0x140049060]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
dec dword [0x140049060]
add rsp, 0x48
ret
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140034e2c
inc dword [0x140049058]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
dec dword [0x140049058]
add rsp, 0x48
ret
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140034e5b
inc dword [0x140064548]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
dec dword [0x140064548]
add rsp, 0x48
ret
mov ecx, 0x27
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140034e8a
inc dword [0x140064c90]
mov ecx, 0x25
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140034a23
dec dword [0x140064c90]
add rsp, 0x48
ret