Function at 0x18001b7e0
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x78]
sub rsp, 0x170
mov rax, qword [0x180211600]
xor rax, rsp
mov qword [rbp - 0x40], rax
vmovdqu xmm0, xmmword [0x1801e4e50]
mov qword [r11 + 8], rbx
lea rdx, [rbp - 0x70]
vmovaps xmmword [r11 - 0x28], xmm7
vmovaps xmmword [r11 - 0x38], xmm8
vmovaps xmmword [r11 - 0x48], xmm9
mov dword [rbp - 0x60], 0x70696c
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x5c], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001b851
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.180032df0
vmovdqu xmm0, xmmword [0x1801e4cf0]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x60], 0x6f6d6d
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x5c], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001b8bc
call fcn.180035790
mov ecx, eax
call fcn.180032db0
mov ebx, eax
call fcn.180035790
mov edx, ebx
mov ecx, eax
call fcn.180033350
call fcn.180035790
mov ecx, eax
call fcn.180032db0
mov ebx, eax
call fcn.180035790
mov r8d, ebx
mov edx, 1
mov ecx, eax
call fcn.180032d40
vmovdqu xmm0, xmmword [0x1801e5890]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x60], 0
vmovdqu xmmword [rbp - 0x70], xmm0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001b8f9
call fcn.180035790
mov ecx, eax
call fcn.180032ce0
mov ecx, eax
xor edx, edx
call fcn.180033cb0
vmovdqu xmm0, xmmword [0x1801e4ce0]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x60], 0x6f6d6d
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x5c], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
vxorps xmm7, xmm7, xmm7
test al, al
je 0x18001b970
vmovss dword [rbp - 0x70], xmm7
vmovss dword [rbp - 0x68], xmm7
vmovss dword [rbp - 0x60], xmm7
call fcn.180035790
mov ecx, eax
lea rdx, [rbp - 0x70]
call fcn.180032c80
test eax, eax
je 0x18001b970
call fcn.180035790
vmovss xmm3, dword [rbp - 0x60]
vmovss xmm2, dword [rbp - 0x68]
vmovss xmm1, dword [rbp - 0x70]
mov ecx, eax
mov dword [rsp + 0x38], 1
call fcn.180035990
vmovdqu xmm0, xmmword [0x1801e5880]
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x188], rdi
vmovdqu xmmword [rbp - 0x70], xmm0
mov word [rbp - 0x5d], 0x6f
mov word [rbp - 0x60], 0x6d41
mov byte [rbp - 0x5e], 0x6d
mov byte [rbp - 0x5b], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
xor ebx, ebx
test al, al
je 0x18001ba57
lea rcx, [rbp - 0x70]
mov word [rbp - 0x67], 0x47
vmovss dword [rbp - 0x58], xmm7
vmovss dword [rbp - 0x50], xmm7
vmovss dword [rbp - 0x48], xmm7
mov dword [rbp - 0x70], 0x50414557
mov dword [rbp - 0x6c], 0x525f4e4f
mov byte [rbp - 0x68], 0x50
mov byte [rbp - 0x65], bl
call fcn.180035590
mov ecx, eax
mov edi, eax
call fcn.180032c10
call fcn.180035790
mov ecx, eax
lea rdx, [rbp - 0x58]
call fcn.180032c80
test eax, eax
je 0x18001ba57
call fcn.180035790
vmovss xmm1, dword [rbp - 0x48]
vmovss xmm0, dword [0x1801e47ec]
vaddss xmm2, xmm1, dword [0x1801e47dc]
vmovss dword [rsp + 0x60], xmm0
vmovss xmm0, dword [rbp - 0x58]
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x30], 0x64
vmovss dword [rsp + 0x28], xmm1
vmovss xmm1, dword [rbp - 0x50]
vmovaps xmm3, xmm0
vmovss dword [rsp + 0x20], xmm1
call fcn.180032a70
vmovdqu xmm0, xmmword [0x1801e5d80]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x60], bx
vmovdqu xmmword [rbp - 0x70], xmm0
vmovaps xmmword [rsp + 0x160], xmm6
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
vmovss xmm9, dword [0x1801e61c0]
vmovss xmm8, dword [0x1801e46d8]
test al, al
je 0x18001bc31
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.1800331d0
test eax, eax
jne 0x18001bc31
vmovaps xmmword [rsp + 0x120], xmm10
vmovaps xmmword [rsp + 0x110], xmm11
vmovaps xmmword [rsp + 0x100], xmm12
vmovaps xmmword [rsp + 0xf0], xmm13
vmovaps xmmword [rsp + 0xe0], xmm14
lea rcx, [rbp - 0x58]
vmovaps xmmword [rsp + 0xd0], xmm15
call fcn.180032a20
lea rcx, [rsp + 0x78]
call fcn.1800342e0
vmovss xmm2, dword [rbp - 0x78]
vmovss xmm0, dword [rsp + 0x78]
vmulss xmm0, xmm0, xmm8
vmulss xmm1, xmm2, xmm8
call fcn.18016e033
vshufps xmm2, xmm0, xmm0, 0xe
vmovups xmm6, xmm0
vaddss xmm15, xmm6, dword [rbp - 0x48]
vpermilps xmm3, xmm0, 1
vmovss xmm0, dword [0x1801e47cc]
vandps xmm3, xmm3, xmm9
vmulss xmm1, xmm2, xmm3
vxorps xmm4, xmm1, xmmword [0x1801e61e0]
vaddss xmm13, xmm4, dword [rbp - 0x58]
vpermilps xmm2, xmm2, 1
vmulss xmm5, xmm2, xmm3
vaddss xmm14, xmm5, dword [rbp - 0x50]
vmovaps xmm11, xmm14
vmovaps xmm10, xmm13
vmovaps xmm12, xmm15
vfmadd231ss xmm11, xmm5, xmm0
vfmadd231ss xmm10, xmm4, xmm0
vfmadd231ss xmm12, xmm6, xmm0
call fcn.180035790
mov ecx, eax
lea rdx, [rbp - 0x70]
call fcn.1800329a0
mov edx, 0xd0
mov ecx, 2
call fcn.180032940
test eax, eax
jne 0x18001bba8
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18001bbfb
call fcn.180035790
vmovss xmm4, dword [0x1801e47fc]
vmovss dword [rsp + 0x60], xmm4
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x30], 0x32
vmovss dword [rsp + 0x28], xmm12
vmovaps xmm3, xmm10
vmovaps xmm2, xmm15
vmovaps xmm1, xmm14
vmovaps xmm0, xmm13
vmovss dword [rsp + 0x20], xmm11
call fcn.180032a70
vmovaps xmm14, xmmword [rsp + 0xe0]
vmovaps xmm13, xmmword [rsp + 0xf0]
vmovaps xmm12, xmmword [rsp + 0x100]
vmovaps xmm11, xmmword [rsp + 0x110]
vmovaps xmm10, xmmword [rsp + 0x120]
vmovaps xmm15, xmmword [rsp + 0xd0]
vmovdqu xmm0, xmmword [0x1801e5f10]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x60], bx
vmovdqu xmmword [rbp - 0x70], xmm0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001bc8e
vmovss dword [rbp - 0x58], xmm7
vmovss dword [rbp - 0x50], xmm7
vmovss dword [rbp - 0x48], xmm7
call fcn.180035790
mov ecx, eax
lea rdx, [rbp - 0x58]
call fcn.180032c80
test eax, eax
je 0x18001bc8e
vmovss xmm2, dword [rbp - 0x48]
vmovss xmm1, dword [rbp - 0x50]
vmovss xmm0, dword [rbp - 0x58]
call fcn.180033150
vmovdqu xmm0, xmmword [0x1801e4ca0]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x5f], 0x6d
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x60], 0x69
mov byte [rbp - 0x5d], bl
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001bd14
call fcn.1800354a0
mov ecx, eax
lea rdx, [rbp - 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001bd14
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001bd14
mov ecx, dword [rbp - 0x70]
mov dword [rsp + 0x70], ecx
call fcn.180035ab0
lea rcx, [rsp + 0x70]
call fcn.180035a80
mov ecx, dword [rsp + 0x70]
vxorps xmm3, xmm3, xmm3
vxorps xmm2, xmm2, xmm2
vxorps xmm1, xmm1, xmm1
mov dword [rsp + 0x38], 1
call fcn.180035990
vmovdqu xmm0, xmmword [0x1801e4cc0]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x5f], 0x6d
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x60], 0x69
mov byte [rbp - 0x5d], bl
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001bd6f
call fcn.1800354a0
mov ecx, eax
lea rdx, [rbp - 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001bd6f
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001bd6f
mov ecx, dword [rbp - 0x70]
call fcn.180033100
vmovdqu xmm0, xmmword [0x1801e4cd0]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x5f], 0x6d
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x60], 0x69
mov byte [rbp - 0x5d], bl
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001bdd5
call fcn.1800354a0
mov ecx, eax
lea rdx, [rbp - 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001bdd5
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001bdd5
mov ecx, dword [rbp - 0x70]
mov edx, 0xdf
mov r8d, 1
call fcn.180034ec0
vmovdqu xmm0, xmmword [0x1801e5c10]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x60], bx
vmovdqu xmmword [rbp - 0x70], xmm0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001bec0
lea rcx, [rsp + 0x78]
call fcn.1800342e0
vmovss xmm2, dword [rbp - 0x78]
vmovss xmm0, dword [rsp + 0x78]
vmulss xmm0, xmm0, xmm8
vmulss xmm1, xmm2, xmm8
call fcn.18016e033
vshufps xmm1, xmm0, xmm0, 0xe
vpermilps xmm2, xmm0, 1
vandps xmm2, xmm2, xmm9
vmulss xmm8, xmm1, xmm2
vpermilps xmm1, xmm1, 1
vmulss xmm9, xmm1, xmm2
vmovups xmm6, xmm0
call fcn.1800354a0
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001bec0
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001bec0
mov ecx, dword [rsp + 0x70]
call fcn.180017ec0
vmulss xmm1, xmm6, dword [0x1801e47f4]
vmulss xmm3, xmm9, dword [0x1801e47f4]
vmulss xmm2, xmm8, dword [0x1801e4828]
mov ecx, dword [rsp + 0x70]
mov dword [rsp + 0x68], 1
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
vmovss dword [rsp + 0x38], xmm7
vmovss dword [rsp + 0x30], xmm7
vmovss dword [rsp + 0x28], xmm7
vmovss dword [rsp + 0x20], xmm1
call fcn.1800347d0
vmovdqu xmm0, xmmword [0x1801e4cb0]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x5f], 0x6d
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x60], 0x69
mov byte [rbp - 0x5d], bl
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
vmovaps xmm9, xmmword [rsp + 0x130]
vmovaps xmm8, xmmword [rsp + 0x140]
vmovaps xmm6, xmmword [rsp + 0x160]
test al, al
je 0x18001bf78
call fcn.1800354a0
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001bf78
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001bf78
mov ecx, dword [rsp + 0x70]
call fcn.180032840
test eax, eax
je 0x18001bf78
mov ecx, dword [rsp + 0x70]
call fcn.1800327e0
test eax, eax
je 0x18001bf78
mov ecx, dword [rsp + 0x70]
call fcn.1800327b0
mov ecx, dword [rsp + 0x70]
call fcn.180032780
mov ecx, dword [rsp + 0x70]
call fcn.180035410
mov ecx, dword [rsp + 0x70]
mov edx, eax
call fcn.180035450
mov ecx, dword [rsp + 0x70]
call fcn.180034680
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x64], 0x736579
mov dword [rbp - 0x70], 0x70616557
mov dword [rbp - 0x6c], 0x445f6e6f
mov dword [rbp - 0x68], 0x45646165
mov byte [rbp - 0x60], bl
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001c02a
call fcn.180035790
mov ecx, eax
call fcn.180032740
test eax, eax
je 0x18001c02a
mov edx, 0x19
xor ecx, ecx
call fcn.180032940
test eax, eax
je 0x18001bffc
vmovss xmm0, dword [0x1801e46f0]
call fcn.180033ac0
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x68], 0x657461
mov dword [rbp - 0x70], 0x73696548
mov dword [rbp - 0x6c], 0x636f4c74
mov byte [rbp - 0x64], bl
call fcn.180033a50
jmp 0x18001c02a
vmovss xmm0, dword [0x1801e46f8]
call fcn.180033ac0
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x68], 0x657461
mov dword [rbp - 0x70], 0x73696548
mov dword [rbp - 0x6c], 0x636f4c74
mov byte [rbp - 0x64], bl
call fcn.180033a20
vmovdqu xmm0, xmmword [0x1801e59e0]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x60], bx
vmovdqu xmmword [rbp - 0x70], xmm0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001c09d
call fcn.1800354a0
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001c09d
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001c09d
mov ecx, dword [rsp + 0x70]
call fcn.180032700
test eax, eax
je 0x18001c09d
mov ecx, dword [rsp + 0x70]
call fcn.180017ec0
mov ecx, dword [rsp + 0x70]
call fcn.1800326d0
mov ecx, dword [rsp + 0x70]
call fcn.1800326a0
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x66], 0x686556
mov dword [rbp - 0x70], 0x70616557
mov dword [rbp - 0x6c], 0x4d5f6e6f
mov word [rbp - 0x68], 0x7861
mov byte [rbp - 0x62], bl
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001c135
call fcn.1800354a0
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001c135
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001c135
mov ecx, dword [rsp + 0x70]
call fcn.180032700
test eax, eax
je 0x18001c135
mov ecx, dword [rsp + 0x70]
call fcn.180017ec0
mov ecx, dword [rsp + 0x70]
call fcn.180033020
mov ecx, dword [rsp + 0x70]
mov edx, ebx
call fcn.180032e90
mov ecx, dword [rsp + 0x70]
mov edx, ebx
lea r8d, [rax - 1]
call fcn.180032fa0
inc ebx
cmp ebx, 0x32
jl 0x18001c114
vmovdqu xmm0, xmmword [0x1801e5820]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x60], 0x68
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x5e], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001c1c0
call fcn.1800354a0
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001c1c0
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001c1c0
mov ecx, dword [rsp + 0x70]
call fcn.180032700
test eax, eax
je 0x18001c1c0
mov ecx, dword [rsp + 0x70]
call fcn.180017ec0
mov ecx, dword [rsp + 0x70]
call fcn.180032610
mov ecx, dword [rsp + 0x70]
call fcn.180032580
mov ecx, dword [rsp + 0x70]
call fcn.1800324f0
mov ecx, dword [rsp + 0x70]
call fcn.180032460
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x64], 0x686556
mov dword [rbp - 0x70], 0x70616557
mov dword [rbp - 0x6c], 0x535f6e6f
mov dword [rbp - 0x68], 0x6c616574
mov byte [rbp - 0x60], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001c28d
mov ecx, dword [rsp + 0x70]
call fcn.1800323e0
mov ebx, eax
call fcn.1800354a0
mov ecx, eax
lea rdx, [rsp + 0x70]
call fcn.1800328e0
test eax, eax
je 0x18001c28d
call fcn.180035790
mov ecx, eax
call fcn.180032880
test eax, eax
je 0x18001c28d
mov ecx, dword [rsp + 0x70]
call fcn.180032700
test eax, eax
je 0x18001c28d
mov ecx, dword [rsp + 0x70]
call fcn.180017ec0
mov ecx, ebx
mov dword [rbp - 0x70], ebx
call fcn.180035ab0
lea rcx, [rbp - 0x70]
call fcn.180035a80
mov ecx, dword [rbp - 0x70]
vmovaps xmm3, xmm7
vmovaps xmm2, xmm7
vmovaps xmm1, xmm7
mov dword [rsp + 0x38], 1
call fcn.180035990
mov ecx, ebx
call fcn.180034680
mov ebx, dword [rsp + 0x70]
call fcn.180035790
mov r8d, 0xffffffff
mov edx, ebx
mov ecx, eax
call fcn.180035520
vmovdqu xmm0, xmmword [0x1801e5d90]
lea rdx, [rbp - 0x70]
mov word [rbp - 0x60], 0
vmovdqu xmmword [rbp - 0x70], xmm0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001c2ec
vmovss dword [rbp - 0x58], xmm7
vmovss dword [rbp - 0x50], xmm7
vmovss dword [rbp - 0x48], xmm7
call fcn.180035790
mov ecx, eax
lea rdx, [rbp - 0x58]
call fcn.180032c80
test eax, eax
je 0x18001c2ec
vmovss xmm3, dword [rbp - 0x48]
vmovss xmm2, dword [rbp - 0x50]
vmovss xmm1, dword [rbp - 0x58]
call fcn.1800322b0
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x64], 0x646550
mov dword [rbp - 0x70], 0x70616557
mov dword [rbp - 0x6c], 0x4d5f6e6f
mov dword [rbp - 0x68], 0x79656e6f
mov byte [rbp - 0x60], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
test al, al
je 0x18001c3a5
vmovss dword [rbp - 0x58], xmm7
vmovss dword [rbp - 0x50], xmm7
vmovss dword [rbp - 0x48], xmm7
call fcn.180035790
mov ecx, eax
lea rdx, [rbp - 0x58]
call fcn.180032c80
test eax, eax
je 0x18001c3a5
vmovss xmm2, dword [rbp - 0x48]
vmovss xmm1, dword [rbp - 0x50]
vmovss xmm0, dword [rbp - 0x58]
call fcn.180033150
mov ecx, eax
mov edi, eax
call fcn.180032260
mov rcx, qword gs:[0x20]
mov rbx, qword [rcx]
lea rcx, [rbp - 0x70]
call fcn.180027590
mov rdx, qword [rax]
add rdx, 0x1dcd6500
cmp byte [rbx + 0x20], 0
jne 0x18001c38e
mov byte [rbx + 0x20], 1
mov qword [rbx + 0x18], rdx
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor edx, edx
mov ecx, edi
call fcn.180035450
vmovdqu xmm0, xmmword [0x1801e4f20]
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x60], 0x657269
vmovdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x5c], 0
call fcn.180021410
mov rcx, rax
call fcn.1800341b0
mov rdi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
vmovaps xmm7, xmmword [rsp + 0x150]
test al, al
je 0x18001c3fc
call fcn.180035790
mov ecx, eax
mov edx, 1
call fcn.180035650
mov rcx, qword [rbp - 0x40]
xor rcx, rsp
call fcn.18016cc50
add rsp, 0x170
pop rbp
ret
add rcx, 8
jmp 0x18001b7e0