Function at 0x140036d20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1c0
vmovaps xmmword [rax - 0x48], xmm6
vmovaps xmmword [rax - 0x58], xmm7
vmovaps xmmword [rax - 0x68], xmm8
vmovaps xmmword [rax - 0x78], xmm9
vmovaps xmmword [rax - 0x88], xmm10
vmovaps xmmword [rax - 0x98], xmm11
vmovaps xmmword [rax - 0xa8], xmm12
vmovaps xmmword [rax - 0xb8], xmm13
vmovaps xmmword [rax - 0xc8], xmm14
vmovaps xmmword [rax - 0xd8], xmm15
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
vmovss xmm15, dword [0x14011aa68]
vmovsd xmm14, qword [0x14011aac8]
vmovss xmm12, dword [0x14011a91c]
vmovss xmm13, dword [0x14011aa14]
xor r12d, r12d
lea r14, [r15 + 0x160]
movabs r13, 0xb2f4fc0794908cf3
vxorps xmm11, xmm11, xmm11
movabs rsi, 0x431bde82d7b634db
nop
cmp qword [r15 + 0xc8], r12
je 0x140036de0
mov rcx, r15
call fcn.1400369d0
cmp byte [0x14012d0e8], r12b
mov rdi, rax
je 0x140037027
mov rcx, qword [0x1401c0890]
lea rax, [rbp + 0x110]
mov qword [rsp + 0x40], rcx
lea r8, [rsp + 0x40]
mov rcx, qword [r15 + 0xd8]
mov r9d, 0x28
add rcx, 0x1898
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], rcx
mov edx, 0x2201d4
mov ecx, dword [0x1401c0888]
mov dword [rsp + 0x50], ecx
mov rcx, qword [0x1401c0880]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rbp + 0x110], r12
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 8
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp qword [rbp + 0x110], r12
je 0x140037027
cmp byte [0x1401c0910], r12b
je 0x140036eaf
lea rcx, [rbp + 0x118]
call fcn.140031e40
mov byte [0x1401c0910], r12b
mov rcx, qword [rax]
mov qword [0x1401c0900], rcx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140036ed0
imul rcx, rcx, 0x64
jmp 0x140036f3c
cmp rbx, 0x16e3600
jne 0x140036f1b
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
jmp 0x140036f32
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
mov qword [0x1401c0908], rcx
mov rax, rsi
sub rcx, qword [0x1401c0900]
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1401c0a78], edx
test rdi, rdi
je 0x140037027
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, edx
vcomiss xmm0, dword [0x1401c0710]
jb 0x140037027
cmp byte [0x1401c07e8], r12b
jne 0x140036fa1
mov ecx, dword [0x1401c0804]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140037027
movzx esi, byte [0x14012d0f5]
movzx ebx, byte [0x14012d0fd]
test sil, sil
je 0x140036fce
mov rcx, r14
call fcn.140034120
cmp rax, 0xffffffffffffffff
je 0x140036fce
call fcn.140002090
mov byte [0x1401c0910], 1
test bl, bl
je 0x140037012
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140036fdf
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140037012
lea rcx, [rbp + 0x110]
mov qword [rbp + 0x110], 0x3e8
call fcn.140034450
call fcn.140002090
mov byte [0x1401c0910], 1
test sil, sil
jne 0x140037027
test bl, bl
jne 0x140037027
call fcn.140002090
mov byte [0x1401c0910], 1
cmp byte [0x14012d0f4], r12b
je 0x1400374ea
test rdi, rdi
je 0x1400374ea
mov ecx, dword [0x1401c0800]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400374ea
cmp byte [0x1401c07f0], r12b
mov rsi, qword [rdi]
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x18]
mov ecx, dword [0x1401c08f8]
je 0x140037087
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, r12d
jmp 0x1400370cd
test ecx, ecx
je 0x1400370c7
sub ecx, 1
je 0x1400370bf
sub ecx, 1
je 0x1400370b7
sub ecx, 1
je 0x1400370af
cmp ecx, 1
jne 0x1400370aa
mov eax, 0x25
sub rax, 1
jne 0x1400370a4
mov r9d, r12d
jmp 0x1400370cd
mov r9d, 2
jmp 0x1400370cd
mov r9d, 0x42
jmp 0x1400370cd
mov r9d, 0x43
jmp 0x1400370cd
mov r9d, 0x6e
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.1400320d0
vmovsd xmm6, qword [rbp + 0x10]
vmovsd xmm7, qword [rbp]
vmovsd xmm8, qword [rbp + 8]
mov rcx, rsi
vmovsd qword [rbp - 0x68], xmm6
call fcn.140034d30
mov rcx, qword [0x1401c0890]
lea r8, [rsp + 0x40]
add rax, 0x168
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], rax
mov r9d, 0x28
mov eax, dword [0x1401c0888]
mov edx, 0x2201d4
vxorpd xmm0, xmm0, xmm0
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov rcx, qword [0x1401c0880]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x58], rax
vmovsd qword [rbp - 0x80], xmm0
vmovupd xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x60], 0x18
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp byte [0x14012d0fc], r12b
vsubsd xmm0, xmm7, qword [0x1401bfb58]
vsubsd xmm1, xmm8, qword [0x1401bfb60]
vsubsd xmm2, xmm6, qword [0x1401bfb68]
vmulsd xmm3, xmm0, xmm0
vfmadd231sd xmm3, xmm1, xmm1
vfmadd231sd xmm3, xmm2, xmm2
vsqrtsd xmm0, xmm3, xmm3
vmulsd xmm10, xmm0, qword [0x14011aa18]
je 0x1400372fe
mov r9d, 0x6e
lea rdx, [rbp - 0x60]
mov r8, rdi
mov rcx, rbx
call fcn.1400320d0
movzx ebx, byte [0x1401c086b]
vmovsd xmm9, qword [rbp + 0x10]
vmovsd xmm7, qword [rbp]
vmovsd xmm8, qword [rbp + 8]
vmovsd qword [rbp - 0x68], xmm9
test bl, bl
je 0x14003724f
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x1400371f1
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140037247
cmp byte [0x1401c0911], r12b
je 0x140037212
vmovss dword [0x14012d390], xmm15
vmovss xmm1, dword [0x14011ac00]
vandps xmm2, xmm1, xmmword [0x14011af40]
vcvtss2sd xmm0, xmm2, xmm2
vdivsd xmm1, xmm10, xmm0
vcvtsd2ss xmm4, xmm1, xmm1
vmovss xmm1, dword [0x14011ac7c]
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rsp + 0x70]
vfmadd231sd xmm7, xmm0, xmm14
jmp 0x1400372c3
test bl, bl
jne 0x1400372fe
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400341c0
mov rcx, rax
call fcn.140034e10
mov rdx, r14
lea rcx, [rsp + 0x40]
vmovaps xmm6, xmm0
call fcn.1400341c0
mov rcx, rax
call fcn.140035c30
vucomiss xmm6, xmm11
vmovaps xmm5, xmm0
je 0x1400372fe
vxorps xmm1, xmm1, xmm1
vmovss xmm2, xmm1, xmm6
vandps xmm3, xmm2, xmmword [0x14011af40]
vcvtss2sd xmm1, xmm3, xmm3
vdivsd xmm2, xmm10, xmm1
vmulss xmm1, xmm5, dword [0x14011ac78]
vcvtsd2ss xmm4, xmm2, xmm2
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rsp + 0x70]
vfmadd231sd xmm7, xmm0, xmm14
vxorps xmm0, xmm0, xmm0
vmovss xmm1, xmm0, xmm1
vmulsd xmm2, xmm3, qword [rsp + 0x78]
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm8, xmm2, xmm14
vandps xmm2, xmm1, xmmword [0x14011af40]
vmovaps xmm3, xmm9
vfmadd231sd xmm3, xmm0, xmm14
vmulss xmm0, xmm2, xmm4
vmulss xmm1, xmm0, dword [0x14011ab20]
vcvtss2sd xmm2, xmm1, xmm1
vaddsd xmm3, xmm3, xmm2
vmovsd qword [rbp - 0x68], xmm3
vunpcklpd xmm0, xmm7, xmm8
vmovups xmmword [rsp + 0x40], xmm0
vmovsd xmm0, qword [rbp - 0x68]
lea r8, [rbp + 0x108]
lea rdx, [rsp + 0x40]
vmovsd qword [rsp + 0x50], xmm0
vmovss dword [rbp + 0x108], xmm11
vmovss dword [rbp + 0x10c], xmm11
call fcn.1400384c0
test al, al
je 0x1400374ea
vmovss xmm0, dword [rbp + 0x108]
vucomiss xmm0, xmm11
vmovss xmm4, dword [0x14012d390]
vmovss xmm1, dword [0x1401c08cc]
vmovss xmm2, dword [0x1401c08c8]
vmovaps xmm7, xmm11
vmovaps xmm6, xmm11
je 0x140037390
vsubss xmm0, xmm0, xmm1
vdivss xmm7, xmm0, xmm4
vaddss xmm3, xmm7, xmm1
vaddss xmm1, xmm1, xmm1
vcomiss xmm3, xmm1
ja 0x14003738b
vcomiss xmm3, xmm11
jae 0x140037390
vmovaps xmm7, xmm11
vmovss xmm0, dword [rbp + 0x10c]
vucomiss xmm0, xmm11
je 0x1400373c1
vsubss xmm1, xmm0, xmm2
vdivss xmm6, xmm1, xmm4
vaddss xmm3, xmm6, xmm2
vaddss xmm0, xmm2, xmm2
vcomiss xmm3, xmm0
ja 0x1400373bc
vcomiss xmm3, xmm11
jae 0x1400373c1
vmovaps xmm6, xmm11
cmp byte [0x1401c07e0], r12b
jne 0x1400374ea
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm7
vsubss xmm7, xmm0, xmm13
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
mov rax, qword [0x1401c0718]
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm6
vsubss xmm2, xmm0, xmm13
test rax, rax
jne 0x1400374d3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rbx, rdi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400374b4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400374b4
mov r10d, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r10 + r8*4]
mov edx, dword [rcx + r9]
mov ecx, 0x811c9dc5
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x1400374af
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140037490
cmp ecx, 0x20785c9b
je 0x140037506
test r8d, r8d
jne 0x140037470
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
je 0x1400374c9
cmp qword [rax + 0x30], r12
jne 0x140037440
mov rax, r12
mov qword [0x1401c0718], rax
vcvttss2si r8d, xmm2
vcvttss2si edx, xmm7
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov ecx, 1
call rax
lea rcx, [rbp + 0x110]
mov qword [rbp + 0x110], 1
call fcn.140034450
jmp 0x140036dd4
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400374cc