Function at 0x140018b00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xf0
mov rax, qword [0x140379f00]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp byte [0x1403e3694], 0
jne 0x140019008
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
xor esi, esi
mov qword [r11 + 0x18], rdi
movaps xmmword [r11 - 0x18], xmm6
nop dword [rax]
mov eax, dword [0x1403e36a4]
inc eax
movsxd rcx, eax
mov qword [rbp - 0x69], rcx
lea rcx, [rbp - 0x69]
call fcn.140017850
cmp byte [0x1403e3544], sil
je 0x140018fdb
cmp qword [0x1403e5640], rsi
je 0x140018fdb
mov ecx, dword [0x1403e3548]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140018c59
cmp byte [0x1403e5239], sil
je 0x140018fdb
mov dword [rbp - 0x31], esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x2d], xmm0
mov dword [rbp - 0x1d], 4
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140018c37
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140018c37
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xe56e87e2
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140018c32
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140018c10
cmp r8d, 0x3e3de394
je 0x140018c3c
test r9d, r9d
jne 0x140018bf0
mov rax, qword [rax]
jmp 0x140018bc0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x31]
jmp 0x140018fc4
mov rcx, qword [0x1403e4de8]
test rcx, rcx
je 0x140018c90
cmp dword [0x1403e4de0], esi
je 0x140018c90
mov rdx, qword [0x1403e5430]
lea r8, [rbp + 7]
mov r9d, 8
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x1403e4de8]
mov rdi, qword [rbp + 7]
mov qword [rbp - 0x41], rdi
test rdi, rdi
je 0x140018ef0
movaps xmm0, xmmword [0x1403e5640]
movaps xmm1, xmmword [0x1403e5650]
movaps xmm6, xmmword [0x1403e5660]
movups xmmword [rbp - 0x31], xmm0
movsd xmm0, qword [0x1403e5670]
movsd qword [rbp - 1], xmm0
movups xmmword [rbp - 0x21], xmm1
test rcx, rcx
je 0x140018cf8
cmp dword [0x1403e4de0], esi
je 0x140018cf8
lea rdx, [rdi + 0x90]
mov qword [rsp + 0x20], rsi
mov r9d, listen
lea r8, [rbp - 0x61]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdi, qword [rbp - 0x41]
movss xmm0, dword [rbp + 3]
subss xmm0, dword [rbp - 0x59]
movss xmm1, dword [rbp - 1]
subss xmm1, dword [rbp - 0x5d]
shufps xmm6, xmm6, 0xff
subss xmm6, dword [rbp - 0x61]
mulss xmm0, xmm0
mulss xmm1, xmm1
mulss xmm6, xmm6
addss xmm1, xmm6
addss xmm1, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x140018d3a
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x140018d42
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [0x1403e3550]
mov rcx, rdi
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
setbe bl
call fcn.140018a70
test al, al
je 0x140018d6c
cmp byte [0x1403e354c], sil
movzx ebx, bl
cmove ebx, esi
cmp byte [0x1403e3529], sil
je 0x140018d86
mov rcx, qword [rbp - 0x41]
call fcn.1400189e0
test al, al
movzx ebx, bl
cmove ebx, esi
mov rcx, qword [0x1403e4de8]
test rcx, rcx
je 0x140018db6
cmp dword [0x1403e4de0], esi
je 0x140018db6
mov rdx, qword [0x1403e5428]
lea r8, [rbp - 0x39]
mov r9d, 1
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp - 0x39], sil
lea r8, [rbp - 0x41]
lea rdx, [rbp - 0x51]
lea rcx, [0x1403e5380]
cmove ebx, esi
call fcn.140019020
mov edx, esi
mov rcx, qword [rax]
movzx eax, bl
cmp byte [rcx + 0x58], dl
cmove edx, eax
test dl, dl
je 0x140018ef0
cmp byte [0x1403e5239], sil
jne 0x140018fdb
movsxd rax, dword [0x1403e3554]
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x69], rax
call fcn.140017850
mov dword [rbp - 0x31], esi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x2d], xmm0
mov dword [rbp - 0x1d], 2
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140018eb7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140018eb7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x9a06a6b2
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140018eb2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140018e90
cmp r8d, 0x1d7e5984
je 0x140018ebc
test r9d, r9d
jne 0x140018e70
mov rax, qword [rax]
jmp 0x140018e40
mov ecx, dword [rbx + 0x24]
mov r8d, 0x28
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x31]
add rax, r10
mov ecx, 1
call rax
mov byte [0x1403e5239], 1
jmp 0x140018fdb
cmp byte [0x1403e5239], sil
je 0x140018fdb
mov dword [rbp + 0xf], esi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x13], xmm0
mov dword [rbp + 0x23], 4
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x27], xmm1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140018fa7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140018fa7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8c412b83
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140018fa2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140018f80
cmp r8d, 0x8a58f80b
je 0x140018fac
test r9d, r9d
jne 0x140018f60
mov rax, qword [rax]
jmp 0x140018f30
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp + 0xf]
mov r8d, 0x28
mov ecx, 1
add rax, r10
call rax
mov byte [0x1403e5239], sil
cmp byte [0x1403e3694], sil
je 0x140018b40
movaps xmm6, xmmword [rsp + 0xe0]
mov rdi, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x108]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1401425d0
add rsp, 0xf0
pop rbp
ret