Function at 0x1400e5bc0
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401e56c8]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r14, rcx
xor edi, edi
mov dword [rbp - 0x59], edi
mov dword [rbp - 1], edi
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], rax
mov byte [rbp - 0x51], al
call fcn.140011d40
mov qword [rbp - 9], rax
lea r9, [rbp - 0x51]
lea r8, [rbp - 1]
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call fcn.140017bc0
nop
mov rcx, qword [rbp + 0xf]
mov rbx, qword [rbp + 7]
sub rcx, rbx
movabs r15, 0x6bca1af286bca1b
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 0x29
jne 0x1400e5d3f
add rbx, 0x1818
mov eax, dword [0x1401c4654]
mov dword [rbp - 0x59], eax
movzx ecx, word [0x1401c4658]
mov word [rbp - 0x55], cx
movzx eax, byte [reloc.WLDAP32.dll_Ordinal_60]
mov byte [rbp - 0x59], reloc.WS2_32.dll_WSAStartup
xor byte [rbp - 0x58], 0x37
xor byte [rbp - 0x57], 0x38
xor byte [rbp - 0x56], 0x39
xor cl, 0x3a
mov byte [rbp - 0x55], cl
xor byte [rbp - 0x54], 0x3b
xor al, 0x3c
mov byte [rbp - 0x53], al
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
lea rax, [rbp - 0x59]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400e5cc0
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x49]
call fcn.140010900
lea r9, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r9, qword [rbp - 0x49]
mov rdx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400e5cf3
mov rbx, qword [rbx]
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.14001e080
mov rbx, rax
lea rcx, [rbp - 0x49]
call fcn.140010730
xorps xmm6, xmm6
cmp rbx, rsi
je 0x1400e5d7f
mov byte [r14], 1
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400e5d7f
mov rdx, qword [0x1401ec898]
movss xmm0, dword [rdx + 0x28]
ucomiss xmm0, xmm6
jp 0x1400e5d86
jne 0x1400e5d86
xor bl, bl
lea rcx, [rbp + 7]
call fcn.14001db60
movzx eax, bl
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14015bde0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, qword [0x1401ec898]
mov r14b, 1
mov r8d, dword [rbp - 1]
cmp r8d, 8
ja 0x1400e5da9
lea eax, [r8 + 0x11]
movss xmm0, dword [rdx + rax*4]
ucomiss xmm0, xmm6
jp 0x1400e5da3
je 0x1400e5da9
movzx r12d, r14b
jmp 0x1400e5dac
xor r12b, r12b
movss xmm0, dword [rdx + 0x30]
ucomiss xmm0, xmm6
jp 0x1400e5dbc
je 0x1400e61fb
mov rcx, qword [rbp + 0xf]
mov r9, qword [rbp + 7]
sub rcx, r9
mov rax, r15
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
cmp rdx, r8
jbe 0x1400e61fb
imul r14, rax, 0x98
add r14, 0x58
add r14, r9
mov eax, dword [0x1401c4630]
mov dword [rbp - 0x59], eax
movzx eax, word [0x1401c4634]
mov word [rbp - 0x55], ax
mov byte [rbp - 0x59], reloc.WS2_32.dll_WSAStartup
xor byte [rbp - 0x58], 0x37
xor byte [rbp - 0x57], 0x38
xor byte [rbp - 0x56], 0x39
xor al, 0x3a
mov byte [rbp - 0x55], al
xor byte [rbp - 0x54], 0x3b
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea rax, [rbp - 0x59]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400e5e40
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x29]
call fcn.140010900
nop
mov ebx, 5
mov dword [rbp - 0x59], ebx
lea r9, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae r9, qword [rbp - 0x29]
mov rdx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
jb 0x1400e5e7c
mov r14, qword [r14]
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov rcx, r14
call fcn.14001e080
mov edx, Ordinal_35
lea r13d, [rdx - 0x1b]
mov r15d, dword [reloc.WS2_32.dll_accept]
cmp rax, 0xffffffffffffffff
jne 0x1400e6009
mov eax, dword [rbp - 1]
imul r14, rax, 0x98
add r14, 0x58
add r14, qword [rbp + 7]
mov eax, dword [str.WO_9PJ4A_P_TNR8BEFQ6]
mov dword [rbp - 0x4d], eax
cmp byte [reloc.WS2_32.dll_gethostname], 0
je 0x1400e5f9f
cmp r15d, 2
jl 0x1400e5f5d
movdqa xmm3, xmmword [0x1401c4b30]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401c4e30]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401c4e30]
shufps xmm2, xmm0, 0xdd
movd xmm0, r13d
psrad xmm2, xmm0
movd xmm0, edx
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401c4b90]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4db0]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rbp - 0x4d], xmm2
jmp 0x1400e5f9f
lea r9, [rbp - 0x4d]
mov r8d, edi
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x51eb851f
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, r13d
jl 0x1400e5f70
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x39], xmm1
lea rax, [rbp - 0x4d]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400e5fb5
lea rdx, [rbp - 0x4d]
lea rcx, [rbp - 0x49]
call fcn.140010900
mov ebx, 7
lea r9, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae r9, qword [rbp - 0x49]
mov rdx, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0x10
jb 0x1400e5fed
mov r14, qword [r14]
mov rax, qword [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov rcx, r14
call fcn.14001e080
cmp rax, 0xffffffffffffffff
jne 0x1400e6009
xor r14b, r14b
jmp 0x1400e600c
mov r14b, 1
test bl, 2
je 0x1400e601e
and ebx, 0xfffffffd
lea rcx, [rbp - 0x49]
call fcn.140010730
nop
test bl, 1
je 0x1400e602c
lea rcx, [rbp - 0x29]
call fcn.140010730
mov eax, dword [rbp - 1]
imul rbx, rax, 0x98
add rbx, 0x58
add rbx, qword [rbp + 7]
mov rax, qword [str.F_R_CYE_WK_]
mov qword [rbp - 0x59], rax
cmp byte [0x1401c462f], 0
je 0x1400e618d
cmp r15d, 2
jl 0x1400e615c
movdqa xmm4, xmmword [0x1401c4e30]
movd xmm6, r13d
mov eax, Ordinal_35
movd xmm5, eax
movdqa xmm2, xmmword [0x1401c4b30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401c4b90]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4db0]
movd xmm0, dword [rbp - 0x59]
xorps xmm2, xmm0
movd dword [rbp - 0x59], xmm2
movdqa xmm3, xmmword [0x1401c4b40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401c4b90]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4db0]
movd xmm0, dword [rbp - 0x55]
xorps xmm2, xmm0
movd dword [rbp - 0x55], xmm2
jmp 0x1400e618d
lea r8, [rbp - 0x59]
mov eax, 0x51eb851f
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, dil
sub al, cl
add al, 0x36
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 8
jl 0x1400e6160
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x19], xmm1
lea rax, [rbp - 0x59]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400e61a0
mov r8, rsi
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x29]
call fcn.140010900
lea r9, [rbp - 0x29]
cmp qword [rbp - 0x11], 0x10
cmovae r9, qword [rbp - 0x29]
mov rdx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400e61d5
mov rbx, qword [rbx]
mov rax, qword [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov rcx, rbx
call fcn.14001e080
mov rbx, rax
lea rcx, [rbp - 0x29]
call fcn.140010730
cmp rbx, 0xffffffffffffffff
je 0x1400e61fb
xor r14b, r14b
test r12b, r12b
je 0x1400e5d3f
test r14b, r14b
je 0x1400e5d3f
mov bl, 1
jmp 0x1400e5d41