Function at 0x1400de3a0
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401e56c8]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r13d, r13d
mov dword [rsp + 0x34], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
mov qword [rbp + 0x18], r13
lea edx, [r13 + 1]
call fcn.1400105e0
mov qword [rbp + 8], rax
lea rdx, [rax + 4]
mov qword [rbp + 0x18], rdx
xor ecx, ecx
mov dword [rax], ecx
mov qword [rbp + 0x10], rdx
mov rax, rdx
mov rcx, qword [rbp + 8]
sub rax, rcx
sar rax, 2
cmp rax, 1
jbe 0x1400de42f
lea rax, [rcx + 4]
cmp rax, rdx
je 0x1400de42f
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x20], 9
and dword [rcx], 0x1ff
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r13
mov rax, qword [0x1401ec6e8]
lea r8, [rax + 0x4c]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rbx, [r8 + 0x24]
xorps xmm6, xmm6
cmp r8, rbx
je 0x1400de4e6
mov rcx, r13
mov rax, r13
mov r10, r13
mov r9, r13
mov r11, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
movss xmm0, dword [r8]
ucomiss xmm0, xmm6
jp 0x1400de49f
jne 0x1400de49f
mov rcx, rax
mov eax, 1
shl eax, cl
not eax
and dword [rdx], eax
jmp 0x1400de4ab
mov eax, 1
shl eax, cl
or dword [rdx], eax
mov r9, r10
cmp r9, 0x1f
jae 0x1400de4c3
lea rcx, [r11 + 1]
mov r11, rcx
mov rax, rcx
mov r10, rcx
mov r9, rcx
jmp 0x1400de4d6
mov r11, r13
add rdx, 4
mov rcx, r13
mov rax, r13
mov r10, r13
mov r9, r13
add r8, 4
cmp r8, rbx
jne 0x1400de483
mov rax, qword [0x1401ec6e8]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rcx
movss xmm0, dword [rax + 0x28]
ucomiss xmm0, xmm6
jp 0x1400de6a4
jne 0x1400de6a4
mov eax, dword [str.WYA9_RA]
mov dword [rsp + 0x20], eax
lea r15d, [rcx + 4]
lea r12d, [rcx + 0x1f]
mov r14d, dword [reloc.WS2_32.dll_accept]
cmp byte [reloc.WS2_32.dll_gethostname], cl
je 0x1400de601
cmp r14d, 2
jl 0x1400de5bc
movdqa xmm3, xmmword [0x1401c4b30]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401c4e00]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401c4e00]
shufps xmm2, xmm0, 0xdd
movd xmm0, r15d
psrad xmm2, xmm0
movd xmm0, r12d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401c4bd0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4db0]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
jmp 0x1400de601
lea r9, [rsp + 0x20]
mov r8d, r13d
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x36
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, r15d
jl 0x1400de5d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rsp + 0x20]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400de621
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140010900
nop
mov dword [rsp + 0x34], Ordinal_50
mov edx, 1
call fcn.140014000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rbx, [rax + 0x20]
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rcx, [rsp + 0x50]
mov qword [rbp], rcx
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140013bf0
nop
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x50]
mov edi, reloc.WS2_32.dll_WSASetLastError
jmp 0x1400de8d4
mov eax, dword [0x1401c4630]
mov dword [rsp + 0x20], eax
movzx eax, word [0x1401c4634]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x20], reloc.WS2_32.dll_WSAStartup
xor byte [rsp + 0x21], 0x37
xor byte [rsp + 0x22], 0x38
xor byte [rsp + 0x23], 0x39
xor al, 0x3a
mov byte [rsp + 0x24], al
xor byte [rsp + 0x25], 0x3b
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
lea rax, [rsp + 0x20]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], cl
jne 0x1400de6f7
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140010900
nop
mov dword [rsp + 0x34], 1
mov eax, dword [str.WO_9PJ4A_P_TNR8BEFQ6]
mov dword [rsp + 0x20], eax
mov r15d, 4
lea r12d, [r15 + 0x1b]
mov r14d, dword [reloc.WS2_32.dll_accept]
cmp byte [reloc.WS2_32.dll_gethostname], 0
je 0x1400de811
cmp r14d, 2
jl 0x1400de7cf
movdqa xmm3, xmmword [0x1401c4b30]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401c4e00]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401c4e00]
shufps xmm2, xmm0, 0xdd
movd xmm0, r15d
psrad xmm2, xmm0
movd xmm0, r12d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401c4bd0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4db0]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
jmp 0x1400de811
lea r9, [rsp + 0x20]
mov r8d, r13d
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x36
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, r15d
jl 0x1400de7e0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rsp + 0x20]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400de830
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.140010900
nop
mov dword [rsp + 0x34], 7
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov edx, 2
call fcn.140014000
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rax + 0x40]
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdi, [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
lea rax, [rsp + 0x38]
mov qword [rbp], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140013bf0
add rbx, 0x20
mov qword [rbp - 8], rbx
add rdi, 0x20
lea rax, [rbp - 0x10]
cmp rdi, rax
jne 0x1400de8a5
mov qword [rsp + 0x40], rbx
lea r8, [rsp + 0x38]
mov edi, reloc.WS2_32.dll_ntohs
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r13
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r13
mov rax, qword [r8]
mov qword [r8], r13
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
test dil, 0x40
je 0x1400de90a
and edi, 0xffffffbf
lea rcx, [rsp + 0x50]
call fcn.140013d10
nop
test dil, 0x20
je 0x1400de932
and edi, 0xffffffdf
mov dword [rsp + 0x34], edi
lea r9, [fcn.140010650]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x68]
call fcn.14015c0c8
nop
test dil, 8
je 0x1400de946
and edi, 0xfffffff7
lea rcx, [rsp + 0x38]
call fcn.140013d10
nop
test dil, 4
je 0x1400de968
and edi, 0xfffffffb
lea r9, [fcn.140010650]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1e]
lea rcx, [rbp - 0x50]
call fcn.14015c0c8
call fcn.1400cf170
test al, al
je 0x1400dec19
mov rax, qword [0x1401ec6e8]
movss xmm0, dword [rax + 0x24]
ucomiss xmm0, xmm6
jp 0x1400de988
je 0x1400de9a3
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400dec19
mov rax, qword [0x1401ec6e8]
movss xmm0, dword [rax + 0x20]
ucomiss xmm0, xmm6
jp 0x1400de9af
je 0x1400de9e9
mov ecx, dword [0x1401e5754]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400dec19
call fcn.140011d40
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14001c6f0
test al, al
je 0x1400dec19
mov rax, qword [0x1401ec6e8]
movss xmm0, dword [rax + 0x30]
ucomiss xmm0, xmm6
jp 0x1400de9f5
je 0x1400dea02
call fcn.140021530
test al, al
jne 0x1400dec19
mov byte [rsp + 0x30], 0
mov rax, qword [str.F_R_CYE_WK_]
mov qword [rsp + 0x20], rax
cmp byte [0x1401c462f], 0
je 0x1400deb62
cmp r14d, 2
jl 0x1400deb26
movdqa xmm4, xmmword [0x1401c4e00]
movd xmm6, r15d
movd xmm5, r12d
movdqa xmm2, xmmword [0x1401c4b30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401c4bd0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4db0]
movd xmm0, dword [rsp + 0x20]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm3, xmmword [0x1401c4b40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401c4bd0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4db0]
movd xmm0, dword [rsp + 0x24]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
jmp 0x1400deb62
lea r9, [rsp + 0x20]
mov r8d, r13d
nop
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x36
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x1400deb30
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rsp + 0x20]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400deb76
mov r8, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x78]
call fcn.140010900
bts edi, 7
bts edi, 8
mov dword [rsp + 0x34], edi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov edx, 1
call fcn.140014000
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rbx, [rax + 0x20]
mov qword [rbp], rbx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
lea rcx, [rbp - 0x10]
mov qword [rbp + 0x50], rcx
lea rdx, [rbp - 0x78]
mov rcx, rax
call fcn.140013bf0
nop
mov qword [rbp - 8], rbx
bts edi, 9
mov dword [rsp + 0x34], edi
lea r9, [rsp + 0x30]
lea r8, [rbp + 8]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x28]
call fcn.1400238f0
test al, al
je 0x1400dec19
mov bl, 1
jmp 0x1400dec1b
xor bl, bl
bt edi, 9
jae 0x1400dec2f
btr edi, 9
lea rcx, [rbp - 0x10]
call fcn.140013d10
nop
bt edi, 8
jae 0x1400dec4f
lea r9, [fcn.140010650]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1f]
lea rcx, [rbp - 0x78]
call fcn.14015c0c8
nop
lea rcx, [rbp + 0x28]
call fcn.140013d10
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400dec9a
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400dec95
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400dec95
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015c094
movzx eax, bl
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.14015bde0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret