Function at 0x140018d90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov esi, dword [0x140024010]
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x14001fec0]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x14001ff50]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x14001ff30]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [str.5555]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x14001ff40]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [0x14001ff00]
movaps xmmword [rax - 0x78], xmm12
movdqa xmm12, xmmword [0x14001fef0]
movaps xmmword [rsp + 0x60], xmm13
movdqa xmm13, xmmword [0x14001fee0]
movaps xmmword [rsp + 0x50], xmm14
movdqa xmm14, xmmword [0x14001fed0]
movaps xmmword [rsp + 0x40], xmm15
movdqa xmm15, xmmword [0x14001ff10]
nop dword [rax]
mov eax, dword [0x14001f034]
mov dword [rbp + 0x67], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140018ed7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140018ed7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140018ed2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140018eb0
cmp r8d, 0x491e0a9c
je 0x140018edc
test r9d, r9d
jne 0x140018e90
mov rax, qword [rax]
jmp 0x140018e60
mov ecx, dword [rdi + 0x24]
xor r8d, r8d
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov r11d, dword [rcx + rdx*4]
add r11, r10
cmp esi, 2
jl 0x140018f5a
movdqa xmm1, xmm6
movdqa xmm0, xmm6
punpckldq xmm1, xmm6
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm6
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, dword [rbp + 0x67]
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movd dword [rbp + 0x67], xmm1
jmp 0x140018f93
lea r9, [rbp + 0x67]
nop
mov eax, 0x3521cfb3
lea r9, [r9 + 1]
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 4
jl 0x140018f60
lea rcx, [rbp + 0x67]
call r11
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._______________________________________________________________________________________________________________________________n_n_n_______________________________________________.......___n___________________.____________._______________________.__n_________________._______..________________________________.___n______.._______.____.._________________________________.__n_______.___:____.____________________________________.__n_________._______________...________________..____________n___________________.._____________________________._______n_______.___._______________________________________________n_______._______.________________________________________.__n__________________.________________________________________._n_____________________________________________________________._n_____________n_______________________________________________n
call fcn.1400039a0
mov rcx, rax
call fcn.14001aca0
movups xmm2, xmmword [0x14001f520]
movzx eax, byte [0x14001f534]
xor r8d, r8d
mov ecx, dword [str.1___E]
mov dword [rbp - 0x59], ecx
mov byte [rbp - 0x55], al
movups xmmword [rbp - 0x69], xmm2
cmp esi, 2
jl 0x1400191c7
movdqa xmm1, xmm6
movd eax, xmm2
punpckldq xmm1, xmm6
movdqa xmm0, xmm6
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm6
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm6
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, eax
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movdqa xmm0, xmm14
movd dword [rbp - 0x69], xmm1
movdqa xmm1, xmm14
punpckldq xmm1, xmm14
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm14
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm14
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, dword [rbp - 0x65]
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movdqa xmm0, xmm13
movd dword [rbp - 0x65], xmm1
movdqa xmm1, xmm13
punpckldq xmm1, xmm13
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm13
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm13
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, dword [rbp - 0x61]
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movdqa xmm0, xmm12
movd dword [rbp - 0x61], xmm1
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm7
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm12
pmulld xmm0, xmm9
psubd xmm1, xmm0
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd xmm0, dword [rbp - 0x5d]
paddb xmm1, xmm10
xorps xmm1, xmm0
mov r8d, 0x14
movd dword [rbp - 0x5d], xmm1
movdqa xmm0, xmm11
punpckhdq xmm0, xmm11
movdqa xmm1, xmm11
punpckldq xmm1, xmm11
pmuldq xmm1, xmm7
pmuldq xmm0, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm11
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm10
xorps xmm1, xmm0
movd dword [rbp - 0x59], xmm1
mov eax, r8d
lea r9, [rbp - 0x69]
add r9, rax
mov eax, 0x4d4873ed
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x15
jl 0x1400191d1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x69]
call fcn.1400039a0
cmp byte [0x14001f277], 0
movups xmm2, xmmword [0x14001f260]
movsd xmm0, qword [0x14001f270]
movups xmmword [rbp - 0x69], xmm2
movsd qword [rbp - 0x59], xmm0
je 0x1400194e3
xor r8d, r8d
cmp esi, 2
jl 0x1400194a0
movd eax, xmm2
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
movdqa xmm2, xmm14
pmuldq xmm0, xmm7
pmuldq xmm1, xmm7
movd ecx, xmm10
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm6
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmm14
punpckhdq xmm0, xmm14
pmuldq xmm0, xmm7
movd dword [rbp - 0x69], xmm1
movdqa xmm1, xmm14
punpckldq xmm1, xmm14
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x65]
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm13
xorps xmm2, xmm1
punpckhdq xmm0, xmm13
pmuldq xmm0, xmm7
movdqa xmm1, xmm13
punpckldq xmm1, xmm13
pmuldq xmm1, xmm7
movd dword [rbp - 0x65], xmm2
movdqa xmm2, xmm13
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x61]
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm12
xorps xmm2, xmm1
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm7
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm7
movd dword [rbp - 0x61], xmm2
movdqa xmm2, xmm12
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm1, dword [rbp - 0x5d]
andps xmm2, xmm8
movd xmm0, ecx
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm11
xorps xmm2, xmm1
punpckhdq xmm0, xmm11
pmuldq xmm0, xmm7
movdqa xmm1, xmm11
movd dword [rbp - 0x5d], xmm2
movdqa xmm2, xmm11
punpckldq xmm1, xmm11
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x59]
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm15
xorps xmm2, xmm1
punpckhdq xmm0, xmm15
movd dword [rbp - 0x59], xmm2
movdqa xmm1, xmm15
pmuldq xmm0, xmm7
movdqa xmm2, xmm15
punpckldq xmm1, xmm15
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x55]
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rbp - 0x55], xmm2
jmp 0x1400194e3
lea r9, [rbp - 0x69]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x3521cfb3
lea r9, [r9 + 1]
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x18
jl 0x1400194b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x69]
call fcn.1400039a0
cmp byte [0x14001f7c3], 0
movups xmm2, xmmword [0x14001f7b0]
mov edx, dword [0x14001f7c0]
mov dword [rbp - 0x59], edx
movups xmmword [rbp - 0x69], xmm2
je 0x140019753
xor r8d, r8d
cmp esi, 2
jl 0x140019718
movd eax, xmm2
movdqa xmm1, xmm6
punpckldq xmm1, xmm6
movdqa xmm0, xmm6
punpckhdq xmm0, xmm6
movdqa xmm2, xmm14
pmuldq xmm0, xmm7
pmuldq xmm1, xmm7
movd ecx, xmm10
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm6
pmulld xmm0, xmm9
psubd xmm1, xmm0
movd xmm0, ecx
andps xmm1, xmm8
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm0
movd xmm0, eax
xorps xmm1, xmm0
movdqa xmm0, xmm14
punpckhdq xmm0, xmm14
pmuldq xmm0, xmm7
movd dword [rbp - 0x69], xmm1
movdqa xmm1, xmm14
punpckldq xmm1, xmm14
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x65]
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm13
xorps xmm2, xmm1
punpckhdq xmm0, xmm13
pmuldq xmm0, xmm7
movdqa xmm1, xmm13
punpckldq xmm1, xmm13
pmuldq xmm1, xmm7
movd dword [rbp - 0x65], xmm2
movdqa xmm2, xmm13
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, dword [rbp - 0x61]
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm12
xorps xmm2, xmm1
punpckhdq xmm0, xmm12
pmuldq xmm0, xmm7
movdqa xmm1, xmm12
punpckldq xmm1, xmm12
pmuldq xmm1, xmm7
movd dword [rbp - 0x61], xmm2
movdqa xmm2, xmm12
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm9
movd xmm1, dword [rbp - 0x5d]
psubd xmm2, xmm0
andps xmm2, xmm8
movd xmm0, ecx
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movdqa xmm0, xmm11
xorps xmm2, xmm1
punpckhdq xmm0, xmm11
movd dword [rbp - 0x5d], xmm2
movdqa xmm1, xmm11
pmuldq xmm0, xmm7
movdqa xmm2, xmm11
punpckldq xmm1, xmm11
pmuldq xmm1, xmm7
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movd xmm1, edx
pmulld xmm0, xmm9
psubd xmm2, xmm0
movd xmm0, ecx
andps xmm2, xmm8
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rbp - 0x59], xmm2
jmp 0x140019753
lea r9, [rbp - 0x69]
nop dword [rax]
mov eax, 0x3521cfb3
lea r9, [r9 + 1]
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x31
xor byte [r9 - 1], al
cmp r8d, 0x14
jl 0x140019720
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rbp - 0x69]
call fcn.1400039a0
mov ecx, 0x70
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1400197bd
mov ecx, 0x71
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
jne 0x1400197a6
mov ecx, 0x72
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140019763
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.1400162a0
jmp 0x140018e40
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
call fcn.140015600
int3