Function at 0x1800080b4
Capabilities:
Encode data using xor
Log keystrokes via polling
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r15
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x180010010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rcx, qword [0x180011358]
xor edi, edi
movss xmm0, dword [0x18000dcd0]
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], edi
call qword [rax + 0x158]
mov rcx, qword [0x180011358]
mov rax, qword [rcx]
call qword [rax + 0x148]
xor edx, edx
mov cl, 0x55
call fcn.180002474
lea edx, [rdi + 1]
mov byte [rbp - 0x20], al
mov cl, 0x6e
call fcn.180002474
lea edx, [rdi + 2]
mov byte [rbp - 0x1f], al
mov cl, 0x72
call fcn.180002474
lea edx, [rdi + 3]
mov byte [rbp - 0x1e], al
mov cl, 0x65
call fcn.180002474
lea edx, [rdi + 4]
mov byte [rbp - 0x1d], al
mov cl, 0x61
call fcn.180002474
lea r15d, [rdi + 5]
mov byte [rbp - 0x1c], al
mov edx, r15d
mov cl, 0x6c
call fcn.180002474
lea edx, [rdi + 6]
mov byte [rbp - 0x1b], al
mov cl, 0x57
call fcn.180002474
lea edx, [rdi + 7]
mov byte [rbp - 0x1a], al
mov cl, 0x69
call fcn.180002474
lea edx, [rdi + 8]
mov byte [rbp - 0x19], al
mov cl, 0x6e
call fcn.180002474
lea edx, [rdi + 9]
mov byte [rbp - 0x18], al
mov cl, 0x64
call fcn.180002474
lea edx, [rdi + 0xa]
mov byte [rbp - 0x17], al
mov cl, 0x6f
call fcn.180002474
lea edx, [rdi + 0xb]
mov byte [rbp - 0x16], al
mov cl, 0x77
call fcn.180002474
mov byte [rbp - 0x15], al
mov edx, edi
xor eax, eax
mov byte [rbp - 0x14], al
movsxd rcx, edx
lea eax, [rdx + 0x51]
inc edx
xor byte [rbp + rcx - 0x20], al
cmp edx, 0xc
jb 0x1800081c0
xor edx, edx
mov byte [rbp - 0x14], dil
lea rcx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1800112f0], rax
test rax, rax
jne 0x1800081f6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp qword [0x1800112f0], rax
je 0x18000821d
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rbx, rax
jne 0x180008520
mov rcx, qword [0x180011358]
mov edx, 0x144
mov rax, qword [rcx]
call qword [rax + 0x2c8]
call fcn.180009cdc
call fcn.180005664
call fcn.180005088
mov rcx, qword [0x180012928]
add rcx, 0x948
call fcn.180009278
mov eax, dword [0x180011648]
test eax, eax
jne 0x18000826d
mov dword [0x18001035c], 0x41200000
jmp 0x18000830e
cmp eax, 1
jne 0x180008281
mov dword [0x18001035c], 0x41a00000
jmp 0x18000830e
cmp eax, 2
jne 0x180008290
movss xmm0, dword [0x18000dd4c]
jmp 0x180008306
cmp eax, 3
jne 0x18000829f
movss xmm0, dword [0x18000dd50]
jmp 0x180008306
cmp eax, 4
jne 0x1800082ae
movss xmm0, dword [0x18000dd58]
jmp 0x180008306
cmp eax, r15d
jne 0x1800082bd
movss xmm0, dword [0x18000dd60]
jmp 0x180008306
cmp eax, 6
jne 0x1800082cc
movss xmm0, dword [0x18000dd68]
jmp 0x180008306
cmp eax, 7
jne 0x1800082db
movss xmm0, dword [0x18000dd70]
jmp 0x180008306
cmp eax, 8
jne 0x1800082ea
movss xmm0, dword [0x18000dd80]
jmp 0x180008306
cmp eax, 9
jne 0x1800082f9
movss xmm0, dword [0x18000dd88]
jmp 0x180008306
cmp eax, 0xa
jne 0x18000830e
movss xmm0, dword [0x18000dd94]
movss dword [0x18001035c], xmm0
mov eax, dword [0x1800115e8]
test eax, eax
jne 0x18000831d
lea ecx, [rax + 0x14]
jmp 0x180008392
cmp eax, 1
jne 0x180008327
lea ecx, [rax + 0x11]
jmp 0x180008392
cmp eax, 2
jne 0x180008333
mov ecx, 0xa0
jmp 0x180008392
cmp eax, 3
jne 0x18000833d
lea ecx, [rax - 2]
jmp 0x180008392
cmp eax, 4
jne 0x180008347
lea ecx, [rax + 0x41]
jmp 0x180008392
cmp eax, r15d
jne 0x180008353
mov ecx, 0x46
jmp 0x180008392
cmp eax, 6
jne 0x18000835d
lea ecx, [rax + 0x4e]
jmp 0x180008392
cmp eax, 7
jne 0x180008367
lea ecx, [rax + 0x4f]
jmp 0x180008392
cmp eax, 8
jne 0x180008371
lea ecx, [rax + 0x3b]
jmp 0x180008392
cmp eax, 9
jne 0x18000837b
lea ecx, [rax + 0x4f]
jmp 0x180008392
cmp eax, 0xa
jne 0x180008385
lea ecx, [rax - 8]
jmp 0x180008392
mov ecx, dword [0x1800112ec]
cmp eax, 0xb
cmove ecx, r15d
mov eax, dword [0x1800116a8]
mov dword [0x1800112ec], ecx
test eax, eax
jne 0x1800083af
movss xmm0, dword [0x18000dccc]
jmp 0x180008500
cmp eax, 1
jne 0x1800083c3
mov dword [0x180010358], 0x3f800000
jmp 0x180008508
cmp eax, 2
jne 0x1800083d5
movss xmm0, dword [0x18000dcd4]
jmp 0x180008500
cmp eax, 3
jne 0x1800083e7
movss xmm0, dword [0x18000dcd8]
jmp 0x180008500
cmp eax, 4
jne 0x1800083f9
movss xmm0, dword [0x18000dcf4]
jmp 0x180008500
cmp eax, r15d
jne 0x18000840b
movss xmm0, dword [0x18000dd00]
jmp 0x180008500
cmp eax, 6
jne 0x18000841d
movss xmm0, dword [0x18000dd08]
jmp 0x180008500
cmp eax, 7
jne 0x18000842f
movss xmm0, dword [0x18000dd0c]
jmp 0x180008500
cmp eax, 8
jne 0x180008441
movss xmm0, dword [0x18000dd18]
jmp 0x180008500
cmp eax, 9
jne 0x180008455
mov dword [0x180010358], 0x41200000
jmp 0x180008508
cmp eax, 0xa
jne 0x180008467
movss xmm0, dword [0x18000dd20]
jmp 0x180008500
cmp eax, 0xb
jne 0x180008479
movss xmm0, dword [0x18000dd24]
jmp 0x180008500
cmp eax, 0xc
jne 0x180008488
movss xmm0, dword [0x18000dd28]
jmp 0x180008500
cmp eax, 0xd
jne 0x180008497
movss xmm0, dword [0x18000dd2c]
jmp 0x180008500
cmp eax, 0xe
jne 0x1800084a6
movss xmm0, dword [0x18000dd30]
jmp 0x180008500
cmp eax, 0xf
jne 0x1800084b5
movss xmm0, dword [0x18000dd34]
jmp 0x180008500
cmp eax, 0x10
jne 0x1800084c4
movss xmm0, dword [0x18000dd38]
jmp 0x180008500
cmp eax, 0x11
jne 0x1800084d3
movss xmm0, dword [0x18000dd3c]
jmp 0x180008500
cmp eax, 0x12
jne 0x1800084e4
mov dword [0x180010358], 0x41a00000
jmp 0x180008508
cmp eax, 0x13
jne 0x1800084f3
movss xmm0, dword [0x18000dd44]
jmp 0x180008500
cmp eax, 0x14
jne 0x180008508
movss xmm0, dword [0x18000dd48]
movss dword [0x180010358], xmm0
cmp dword [0x1800115b8], edi
je 0x180008520
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180008520
call fcn.1800049ac
mov rcx, qword [0x180011358]
mov rax, qword [rcx]
call qword [rax + 0x150]
mov rcx, qword [0x180011358]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18000adf0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r15, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret