Function at 0x18006d2fc
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
movaps xmmword [rax - 0x38], xmm6
xor r12d, r12d
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x18029cf28]
mov rbx, qword [rax]
test rbx, rbx
je 0x18006d9df
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x18006d9df
mov rax, qword [0x18029cf30]
mov rcx, qword [rax]
test rcx, rcx
je 0x18006d9df
cmp qword [rcx + 0x10], r12
je 0x18006d9df
movsd xmm0, qword [rbx + 0x90]
lea rdx, [rbp - 0x19]
mov eax, dword [rbx + 0x98]
lea rcx, [rbp + 0x67]
movsd qword [rbp - 0x19], xmm0
mov dword [rbp - 0x11], eax
call fcn.180049144
mov rsi, qword [rbx + 0xd30]
test rsi, rsi
je 0x18006d9df
cmp byte [0x18029e0b8], r12b
lea r13d, [r12 + 2]
je 0x18006d50e
call fcn.180059a18
mov ecx, eax
xor edx, edx
call fcn.180058720
mov rax, qword [0x18029e260]
lea edi, [r12 + 1]
test rax, rax
jne 0x18006d46d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18006d452
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x18006d452
mov r15d, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [r15 + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
add rcx, rdi
test al, al
je 0x18006d44e
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
add rcx, rdi
test al, al
jne 0x18006d42b
cmp r11d, 0x95466b05
je 0x18006d4f1
test edx, edx
jne 0x18006d40f
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x18006d463
cmp qword [rax + 0x30], r12
jne 0x18006d3eb
mov rax, r12
mov qword [0x18029e260], rax
mov ecx, dword [0x18029a8a0]
call rax
test ax, ax
jns 0x18006d52a
call fcn.180059a18
mov ecx, eax
xor edx, edx
call fcn.180058720
movd xmm0, dword [reloc.WS2_32.dll_accept]
mov ebx, eax
mov qword [rbp + 0x67], r12
mov dword [rbp + 0x67], eax
mov rcx, qword [rbp + 0x67]
cvtdq2ps xmm0, xmm0
mov qword [rbp + 0x67], r12
mov qword [0x18029a260], rcx
mov dword [0x18029a198], r12d
mov qword [0x18029e028], 0x1a963e58
mov dword [0x18029a188], r13d
movss dword [rbp + 0x67], xmm0
mov rcx, qword [rbp + 0x67]
mov qword [0x18029a268], rcx
call fcn.180067368
movd xmm1, dword [reloc.WS2_32.dll_accept]
mov ecx, ebx
cvtdq2ps xmm1, xmm1
call fcn.180060f70
jmp 0x18006d52a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18006d466
call fcn.180059a18
mov ecx, eax
xor edx, edx
call fcn.180058720
mov edi, 1
mov ecx, eax
mov edx, edi
call fcn.180060fc4
cmp byte [0x18029e0b9], r12b
je 0x18006d544
mov dword [rsi + 0x908], 0x447a0000
mov byte [0x18029e0b9], r12b
cmp byte [0x18029e0bc], r12b
je 0x18006d56a
call fcn.180059a18
mov ecx, eax
xor edx, edx
call fcn.180058720
movss xmm1, dword [0x18013fa5c]
mov ecx, eax
call fcn.180060a24
cmp byte [0x18029e0bd], r12b
je 0x18006d6d2
call fcn.180059a18
mov ecx, eax
call fcn.180058780
call fcn.180059a18
mov ecx, eax
mov edx, edi
call fcn.180058720
mov ebx, eax
mov qword [rbp + 0x67], r12
mov dword [rbp + 0x67], ebx
movabs rax, 0x3882114bde571ad4
mov rcx, qword [rbp + 0x67]
mov qword [rbp + 0x67], r12
mov qword [0x18029a260], rcx
mov dword [rbp + 0x67], edi
mov rcx, qword [rbp + 0x67]
mov qword [0x18029a268], rcx
mov dword [0x18029a198], r12d
mov qword [0x18029e028], rax
mov dword [0x18029a188], r13d
call fcn.180067368
mov dword [rsp + 0x40], edi
mov r9d, edi
mov dword [rsp + 0x38], edi
mov r8d, edi
mov dword [rsp + 0x30], edi
mov edx, edi
mov dword [rsp + 0x28], edi
mov ecx, ebx
mov dword [rsp + 0x20], edi
call fcn.180060a78
xor edx, edx
mov ecx, ebx
call fcn.180061018
movabs rax, 0x29b18b4fd460ca8f
mov qword [rbp + 0x67], r12
mov qword [0x18029e028], rax
mov dword [rbp + 0x67], ebx
mov rax, qword [rbp + 0x67]
mov qword [0x18029a260], rax
mov dword [0x18029a198], r12d
mov qword [0x18029a268], r12
mov dword [0x18029a188], r13d
call fcn.180067368
movabs rax, 0x4c7028f78ffd3681
mov qword [rbp + 0x67], r12
mov qword [0x18029e028], rax
mov dword [rbp + 0x67], ebx
mov rax, qword [rbp + 0x67]
mov qword [0x18029a260], rax
mov dword [0x18029a198], r12d
mov qword [0x18029a268], r12
mov dword [0x18029a188], r13d
call fcn.180067368
xor edx, edx
mov ecx, ebx
call fcn.180061018
mov qword [rbp + 0x67], r12
movabs rax, 0x92f0cf722bc4202f
mov qword [0x18029e028], rax
mov dword [rbp + 0x67], ebx
mov rax, qword [rbp + 0x67]
mov qword [rbp + 0x67], r12
mov qword [0x18029a260], rax
mov dword [rbp + 0x67], edi
mov rax, qword [rbp + 0x67]
mov qword [0x18029a268], rax
mov dword [0x18029a198], r12d
mov dword [0x18029a188], r13d
call fcn.180067368
cmp byte [0x18029e0c0], r12b
je 0x18006d740
call fcn.180059a18
mov ecx, eax
call fcn.180058780
call fcn.180059a18
mov ecx, eax
mov edx, edi
call fcn.180058720
mov qword [rbp + 0x67], r12
movabs rcx, 0x95a88f0b409cda47
mov dword [rbp + 0x67], eax
mov rax, qword [rbp + 0x67]
mov qword [0x18029a260], rax
lea rax, [0x18029e0b0]
mov qword [0x18029a268], rax
mov dword [0x18029a198], r12d
mov qword [0x18029e028], rcx
mov dword [0x18029a188], r13d
call fcn.180067368
mov byte [0x18029e0c0], r12b
cmp byte [0x18029e0bb], r12b
je 0x18006d8ef
call fcn.180059a48
call fcn.180059a18
mov ecx, eax
call fcn.1800587c8
mov ebx, eax
mov qword [rbp + 0x67], r12
movabs rax, 0x9f47b058362c84b5
mov dword [rbp + 0x67], ebx
mov rcx, qword [rbp + 0x67]
mov qword [0x18029a260], rcx
mov dword [0x18029a198], r12d
mov qword [0x18029e028], rax
mov dword [0x18029a188], edi
call fcn.180067368
call fcn.180059a18
mov qword [rbp + 0x67], r12
movabs rcx, 0x997abd671d25ca0b
mov dword [rbp + 0x67], eax
mov rax, qword [rbp + 0x67]
mov qword [0x18029a260], rax
mov dword [0x18029a198], r12d
mov qword [0x18029e028], rcx
mov qword [0x18029a268], r12
mov dword [0x18029a188], r13d
call fcn.180067368
cmp dword [rax], r12d
je 0x18006d8ef
mov eax, dword [0x18029dc70]
mov edx, ebx
mov r9d, dword [0x18029dc6c]
movabs rcx, 0x7141766f91d15bea
mov r8d, dword [0x180199294]
mov dword [rsp + 0x20], eax
call fcn.18005339c
mov eax, dword [0x18029dc70]
mov edx, ebx
mov r9d, dword [0x18029dc6c]
movabs rcx, 0x36ced73bfed89754
mov r8d, dword [0x180199294]
mov dword [rsp + 0x20], eax
call fcn.18005339c
xor edx, edx
mov ecx, ebx
call fcn.180061e78
mov esi, 3
test eax, eax
je 0x18006d86c
mov edx, edi
mov ecx, ebx
call fcn.180061e78
test eax, eax
je 0x18006d86c
mov edx, r13d
mov ecx, ebx
call fcn.180061e78
test eax, eax
je 0x18006d86c
mov edx, esi
mov ecx, ebx
call fcn.180061e78
test eax, eax
jne 0x18006d89d
mov r8d, edi
xor edx, edx
mov ecx, ebx
call fcn.180061ed8
mov r8d, edi
mov edx, edi
mov ecx, ebx
call fcn.180061ed8
mov r8d, edi
mov edx, r13d
mov ecx, ebx
call fcn.180061ed8
mov r8d, edi
mov edx, esi
mov ecx, ebx
call fcn.180061ed8
mov eax, dword [0x18029dc70]
mov edx, ebx
mov r9d, dword [0x18029dc6c]
movabs rcx, 0x8e0a582209a62695
mov r8d, dword [0x180199294]
mov dword [rsp + 0x20], eax
call fcn.18005339c
mov eax, dword [0x18029dc70]
mov edx, ebx
mov r9d, dword [0x18029dc6c]
movabs rcx, 0xb5ba80f839791c0f
mov r8d, dword [0x180199294]
mov dword [rsp + 0x20], eax
call fcn.18005339c
cmp byte [0x18029e0be], r12b
je 0x18006d9df
call fcn.1800588fc
mov rdi, rax
test rax, rax
je 0x18006d9df
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x18006d9df
mov rax, qword [0x18029cf40]
test rax, rax
je 0x18006d933
mov rcx, qword [rax]
jmp 0x18006d937
mov rcx, qword [rbp + 0x67]
movsd xmm0, qword [rcx + 0x3d0]
movss xmm8, dword [rcx + 0x3d8]
mov rax, qword [0x18029cfa0]
mov rbx, qword [0x18029cf18]
movsd qword [rbp - 0x19], xmm0
movsd xmm0, qword [rcx + 0x60]
movss xmm6, dword [rbp - 0x19]
movss xmm7, dword [rbp - 0x15]
movsd qword [rbp - 9], xmm0
movss xmm0, dword [0x1800b8f94]
mulss xmm8, xmm0
mulss xmm6, xmm0
addss xmm8, dword [rcx + 0x68]
mulss xmm7, xmm0
mov rcx, rdi
addss xmm6, dword [rbp - 9]
addss xmm7, dword [rbp - 5]
call rax
mov ecx, eax
call rbx
mov rax, qword [rdi + 0x30]
xorps xmm0, xmm0
test rax, rax
je 0x18006d9ae
movdqu xmmword [rax + 0x30], xmm0
mov rax, qword [rdi + 0x30]
movaps xmm0, xmm6
unpcklps xmm0, xmm7
movsd qword [rdi + 0x90], xmm0
movss dword [rdi + 0x98], xmm8
test rax, rax
je 0x18006d9df
movsd qword [rax + 0x90], xmm0
movss dword [rax + 0x98], xmm8
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret