Function at 0x180028d20
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
cmp byte [0x180233967], 0
je 0x180029506
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180028dd7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180028dd7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x16712e9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180028dd2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180028db0
cmp r8d, 0x3dc5b1bd
je 0x180028ddc
test r9d, r9d
jne 0x180028d90
mov rax, qword [rax]
jmp 0x180028d60
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
add rax, r10
call rax
test ax, ax
jns 0x1800294f6
mov eax, dword [0x180233970]
test eax, eax
jne 0x180028e29
call fcn.180028950
test rax, rax
je 0x1800294f6
mov rcx, rax
call fcn.1800326b0
jmp 0x1800294f6
mov qword [rsp + 0x1d8], r12
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm7
movaps xmmword [rsp + 0x190], xmm8
movaps xmmword [rsp + 0x180], xmm9
cmp eax, 0x3e7
jne 0x180028fbb
call fcn.180044aa0
movss xmm9, dword [rax + 8]
movss xmm6, dword [rax + 0xc]
mulss xmm9, dword [0x18019ec18]
mulss xmm6, dword [0x18019ec18]
call fcn.180028950
mov rbx, rax
test rax, rax
je 0x1800294cc
mov r8d, 0x796e
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.180028660
mov ecx, dword [0x18023396c]
dec ecx
cmp ecx, 5
ja case.default.0x180028ec4
lea r12, [0x180000000]
movsxd rcx, ecx
mov eax, dword [r12 + rcx*4 + 0x29510]
add rax, r12
jmp rax
mov r8d, 7
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.180028660
movsd xmm8, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x78]
jmp 0x180028f17
mov r8d, 8
jmp 0x180028ecc
mov r8d, 1
jmp 0x180028ecc
mov r8d, 2
jmp 0x180028ecc
mov r8d, 5
jmp 0x180028ecc
mov r8d, 6
jmp 0x180028ecc
mov ebx, dword [rbp - 0x48]
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x60]
movsd qword [rbp - 0x60], xmm8
lea rcx, [rbp + 0xf0]
mov dword [rbp - 0x58], ebx
call fcn.180031150
movss xmm0, dword [rbp + 0xf4]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x18019ec50]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x18019ec50]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0xf0]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
ucomiss xmm1, xmm0
ja 0x180028f8b
sqrtss xmm0, xmm0
jmp 0x180028f90
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [reloc.WLDAP32.dll_Ordinal_30]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x1800294cc
lea rcx, [rbp - 0x70]
movsd qword [rbp - 0x70], xmm8
mov dword [rbp - 0x68], ebx
call fcn.180027880
jmp 0x1800294cc
cmp eax, 1
jne 0x1800294cc
mov rax, qword [0x1802339a8]
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1d0], r13
mov qword [rsp + 0x1c8], r14
mov rdi, qword [rax]
mov qword [rsp + 0x1c0], r15
movaps xmmword [rsp + 0x130], xmm14
movaps xmmword [rsp + 0x120], xmm15
test rdi, rdi
je 0x180029009
mov rdi, qword [rdi + 8]
mov rax, qword [0x1802339b0]
mov rsi, qword [rax]
test rsi, rsi
je 0x18002901c
mov rsi, qword [rsi + 0x18]
movss xmm14, dword [0x18019ec18]
lea r12, [0x180000000]
movsd xmm15, qword [0x18019ec50]
xor r14d, r14d
movaps xmmword [rsp + 0x170], xmm10
xor r15d, r15d
movaps xmmword [rsp + 0x160], xmm11
mov r13d, 0x8001
movaps xmmword [rsp + 0x150], xmm12
movaps xmmword [rsp + 0x140], xmm13
test rsi, rsi
jne 0x18002906e
xor ecx, ecx
jmp 0x180029075
mov rcx, qword [rsi + 0x108]
movsxd rax, r14d
cmp rax, rcx
jae 0x180029476
test rsi, rsi
je 0x18002946a
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x18002946a
mov rcx, qword [r15 + rax]
test rcx, rcx
je 0x18002946a
test rdi, rdi
jne 0x1800290b7
xorps xmm2, xmm2
xorps xmm4, xmm4
xorps xmm3, xmm3
jmp 0x1800290d1
movsd xmm3, qword [rdi + 0x90]
movss xmm4, dword [rdi + 0x98]
movaps xmm0, xmm3
shufps xmm0, xmm0, 0x55
movaps xmm2, xmm0
movsd xmm1, qword [rcx + 0x90]
subss xmm4, dword [rcx + 0x98]
movaps xmm0, xmm1
subss xmm3, xmm1
shufps xmm0, xmm0, 0x55
subss xmm2, xmm0
xorps xmm0, xmm0
mulss xmm4, xmm4
mulss xmm3, xmm3
mulss xmm2, xmm2
addss xmm2, xmm3
addss xmm2, xmm4
ucomiss xmm0, xmm2
ja 0x180029115
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x18002911d
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
movd xmm0, dword [0x180230410]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
jb 0x18002946a
call fcn.180044aa0
movss xmm10, dword [rax + 8]
movss xmm6, dword [rax + 0xc]
mulss xmm10, xmm14
mulss xmm6, xmm14
call fcn.180028950
mov rbx, rax
test rax, rax
je 0x180029476
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.180028660
movsxd rax, dword [0x18023396c]
cmp eax, 6
ja case.default.0x18002918f
mov edx, dword [r12 + rax*4 + 0x29528]
add rdx, r12
jmp rdx
xor r8d, r8d
lea rcx, [rbp - 0x40]
mov rdx, rbx
call fcn.180028660
movss xmm7, dword [rbp - 0x38]
movss xmm8, dword [rbp - 0x40]
movss xmm9, dword [rbp - 0x3c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800292d5
mov r8d, 7
lea rcx, [rbp - 0x34]
mov rdx, rbx
call fcn.180028660
movss xmm7, dword [rbp - 0x2c]
movss xmm8, dword [rbp - 0x34]
movss xmm9, dword [rbp - 0x30]
movss dword [rbp - 0x78], xmm7
jmp 0x1800292d5
mov r8d, 8
lea rcx, [rbp - 0x28]
mov rdx, rbx
call fcn.180028660
movss xmm7, dword [rbp - 0x20]
movss xmm8, dword [rbp - 0x28]
movss xmm9, dword [rbp - 0x24]
movss dword [rbp - 0x78], xmm7
jmp 0x1800292d5
mov r8d, 1
lea rcx, [rbp - 0x70]
mov rdx, rbx
call fcn.180028660
movss xmm7, dword [rbp - 0x68]
movss xmm8, dword [rbp - 0x70]
movss xmm9, dword [rbp - 0x6c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800292d5
mov r8d, 2
lea rcx, [rbp - 0x60]
mov rdx, rbx
call fcn.180028660
movss xmm7, dword [rbp - 0x58]
movss xmm8, dword [rbp - 0x60]
movss xmm9, dword [rbp - 0x5c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800292d5
mov r8d, 5
lea rcx, [rbp - 0x50]
mov rdx, rbx
call fcn.180028660
movss xmm7, dword [rbp - 0x48]
movss xmm8, dword [rbp - 0x50]
movss xmm9, dword [rbp - 0x4c]
movss dword [rbp - 0x78], xmm7
jmp 0x1800292d5
mov r8d, 6
lea rcx, [rsp + 0x70]
mov rdx, rbx
call fcn.180028660
movss xmm7, dword [rsp + 0x78]
movss xmm8, dword [rsp + 0x70]
movss xmm9, dword [rsp + 0x74]
movss dword [rbp - 0x78], xmm7
jmp 0x1800292d5
movss xmm7, dword [rbp - 0x78]
movss xmm9, dword [rbp - 0x7c]
movss xmm8, dword [rbp - 0x80]
movaps xmm0, xmm8
movss dword [rbp - 8], xmm7
unpcklps xmm0, xmm9
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xf0]
movsd qword [rbp - 0x80], xmm0
movsd qword [rbp - 0x10], xmm0
call fcn.180031150
test rdi, rdi
jne 0x18002930f
xorps xmm11, xmm11
xorps xmm12, xmm12
xorps xmm13, xmm13
jmp 0x180029336
movsd xmm1, qword [rdi + 0x90]
movss xmm13, dword [rdi + 0x98]
movaps xmm0, xmm1
shufps xmm0, xmm0, 0x55
movsd qword [rbp], xmm1
movaps xmm12, xmm0
movss xmm11, dword [rbp]
movss xmm0, dword [rbp + 0xf4]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movaps xmm1, xmm15
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movss xmm0, dword [rbp + 0xf0]
cvtps2pd xmm1, xmm10
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movaps xmm1, xmm15
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
ucomiss xmm1, xmm0
ja 0x180029389
sqrtss xmm0, xmm0
jmp 0x18002938e
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [reloc.WLDAP32.dll_Ordinal_30]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x18002946a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x18002946a
movd xmm6, dword [reloc.WS2_32.dll_sendto]
mov edx, 0xffffffff
movabs rcx, 0x43a66c31c68491c0
cvtdq2ps xmm6, xmm6
call fcn.18001d680
mov edx, 0xffffffff
movabs rcx, 0x43a66c31c68491c0
mov ebx, eax
call fcn.18001d680
mov edx, eax
movabs rcx, 0xa6db4965674d243
call fcn.18001d680
movss dword [rsp + 0x68], xmm6
movaps xmm2, xmm12
mov dword [rsp + 0x60], 1
movaps xmm1, xmm11
mov dword [rsp + 0x58], 1
movabs rcx, 0x867654cbc7606f2c
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov eax, dword [reloc.WS2_32.dll_getpeername]
mov dword [rsp + 0x40], eax
mov eax, dword [reloc.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x38], eax
cvtps2pd xmm0, xmm13
movss dword [rsp + 0x30], xmm7
addsd xmm0, qword [0x18019ec30]
movss dword [rsp + 0x28], xmm9
movss dword [rsp + 0x20], xmm8
cvtpd2ps xmm3, xmm0
call fcn.18001eb40
inc r14d
add r15, 0x10
jmp 0x180029065
movaps xmm11, xmmword [rsp + 0x160]
movaps xmm13, xmmword [rsp + 0x140]
movaps xmm12, xmmword [rsp + 0x150]
movaps xmm10, xmmword [rsp + 0x170]
movaps xmm14, xmmword [rsp + 0x130]
mov rsi, qword [rsp + 0x200]
mov r13, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x1c0]
movaps xmm15, xmmword [rsp + 0x120]
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1a0]
mov r12, qword [rsp + 0x1d8]
movaps xmm8, xmmword [rsp + 0x190]
movaps xmm9, xmmword [rsp + 0x180]
mov rbx, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x208]
add rsp, 0x1e0
pop rbp
ret