Function at 0x180001320
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
lea r13, [rsp + 0x148]
movabs r12, 0xff00ff00ff00ff00
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x30], r13
mov rsi, qword [r13]
xor rsi, r12
mov qword [rsp + 0x20], rsi
mov qword [r13], 0
lea rdi, [rsp + 0x148]
mov rbp, qword [rdi]
lea rcx, str.win32u
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov ebx, 0x10
lea r15, [0x1801de540]
test rax, rax
jne 0x18000142c
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtUserInjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
jne 0x18000142c
lea rcx, str.user32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.InjectMouseInput
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
test rax, rax
je 0x18000147e
movups xmm1, xmmword [rcx]
movdqu xmmword [0x1801de540], xmm1
movsd xmm0, qword [rcx + 0x10]
movsd qword [0x1801de550], xmm0
mov eax, dword [rcx + 0x18]
mov dword [0x1801de558], eax
movzx eax, word [rcx + 0x1c]
mov word [0x1801de55c], ax
movdqa xmm0, xmmword [0x1800e3220]
xorps xmm0, xmm1
movdqu xmmword [0x1801de540], xmm0
mov rax, rbx
nop
xor byte [rax + r15], 0xfa
inc rax
cmp rax, 0x1e
jb 0x180001470
mov qword [rdi], rbp
mov eax, dword [0x1801dd420]
cdq
sub eax, edx
sar eax, 1
mov edi, eax
mov eax, dword [0x1801dd424]
cdq
sub eax, edx
sar eax, 1
mov r14d, eax
movss xmm9, dword [0x1801dd748]
mulss xmm9, dword [0x1800e2eb0]
xorps xmm7, xmm7
xorps xmm8, xmm8
xorps xmm6, xmm6
mov ecx, dword [0x1801dd780]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x1800014dd
cmp dword [0x1801dd550], 0
jne 0x1800014dd
cmp byte [0x1801dd6a0], 0
jne 0x18000150e
mov ecx, dword [0x1801dd780]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
test al, 1
je 0x18000186e
cmp dword [0x1801dd550], 2
jne 0x18000186e
cmp byte [0x1801dd6a0], 0
je 0x18000186e
movss xmm0, dword [0x1800f0040]
ucomiss xmm0, dword [0x1800e2fac]
jp 0x180001525
je 0x180001875
movss xmm12, dword [0x1800e3210]
movss xmm3, dword [0x1801de520]
ucomiss xmm3, xmm7
jp 0x18000153d
je 0x180001597
movd xmm2, edi
cvtdq2ps xmm2, xmm2
comiss xmm3, xmm2
jbe 0x180001576
movaps xmm8, xmm2
subss xmm8, xmm3
xorps xmm8, xmm12
divss xmm8, xmm9
movaps xmm1, xmm2
addss xmm1, xmm8
lea eax, [rdi + rdi]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm1, xmm0
jbe 0x180001576
xorps xmm8, xmm8
comiss xmm2, xmm3
jbe 0x180001597
movaps xmm8, xmm3
subss xmm8, xmm2
divss xmm8, xmm9
addss xmm2, xmm8
comiss xmm7, xmm2
jbe 0x180001597
xorps xmm8, xmm8
movss xmm3, dword [0x1801de524]
ucomiss xmm3, xmm7
jp 0x1800015a6
je 0x1800015fa
movd xmm2, r14d
cvtdq2ps xmm2, xmm2
comiss xmm3, xmm2
jbe 0x1800015dd
movaps xmm6, xmm2
subss xmm6, xmm3
xorps xmm6, xmm12
divss xmm6, xmm9
movaps xmm1, xmm2
addss xmm1, xmm6
lea eax, [r14 + r14]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm1, xmm0
jbe 0x1800015dd
xorps xmm6, xmm6
comiss xmm2, xmm3
jbe 0x1800015fa
movaps xmm6, xmm3
subss xmm6, xmm2
divss xmm6, xmm9
addss xmm2, xmm6
comiss xmm7, xmm2
jbe 0x1800015fa
xorps xmm6, xmm6
movss xmm14, dword [0x1801dd860]
movss xmm0, dword [0x1801dd828]
movss dword [rsp + 0x150], xmm0
xorps xmm10, xmm10
xorps xmm9, xmm9
xorps xmm11, xmm11
andps xmm11, xmmword [0x1800e3200]
movss xmm13, dword [0x1800e2dcc]
comiss xmm13, xmm11
jbe 0x1800016d3
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movaps xmm0, xmm14
mulss xmm0, dword [0x1800e2efc]
cvttss2si ecx, xmm0
cdq
idiv ecx
inc edx
movd xmm10, edx
cvtdq2ps xmm10, xmm10
divss xmm10, dword [0x1800e2f90]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000001
jge 0x18000167c
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x180001685
xorps xmm10, xmm12
comiss xmm13, xmm11
jbe 0x1800016d3
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mulss xmm14, dword [0x1800e2efc]
cvttss2si ecx, xmm14
cdq
idiv ecx
inc edx
movd xmm9, edx
cvtdq2ps xmm9, xmm9
divss xmm9, dword [0x1800e2f90]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x80000001
jge 0x1800016ca
dec eax
or eax, 0xfffffffe
inc eax
cmp eax, 1
jne 0x1800016d3
xorps xmm9, xmm12
cvttss2si eax, dword [rsp + 0x150]
imul ecx, eax, 0xf
mov eax, 0x136
sub eax, ecx
xorps xmm0, xmm0
cvtsi2ss xmm0, eax
subss xmm10, xmm7
divss xmm10, xmm0
addss xmm10, xmm7
subss xmm9, xmm7
divss xmm9, xmm0
addss xmm9, xmm7
addss xmm10, xmm8
addss xmm9, xmm6
ucomiss xmm8, xmm7
jp 0x180001721
je 0x180001875
ucomiss xmm6, xmm7
jp 0x18000172c
je 0x180001875
cvttss2si edx, xmm9
cvttss2si ecx, xmm10
lea r8, [rsp + 0x148]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r8
mov rax, qword [r8]
xor rax, r12
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [r8], r9
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], r9
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x6c], edx
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], rcx
mov rax, qword [rcx]
xor rax, r12
mov qword [rsp + 0x50], rax
mov qword [rcx], r9
mov edx, 0x1000
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x18000186c
movdqa xmm2, xmmword [0x1800e3220]
movdqa xmm1, xmm2
movdqu xmm0, xmmword [0x1801de540]
xorps xmm1, xmm0
movdqu xmmword [0x1801de540], xmm1
mov rax, rbx
nop dword [rax]
nop dword [rax + rax]
xor byte [rax + r15], 0xfa
inc rax
cmp rax, 0x1e
jb 0x1800017e0
movups xmm0, xmmword [0x1801de540]
movups xmmword [rdi], xmm0
movsd xmm1, qword [0x1801de550]
movsd qword [rdi + 0x10], xmm1
mov eax, dword [0x1801de558]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1801de55c]
mov word [rdi + 0x1c], ax
movdqu xmm0, xmmword [0x1801de540]
xorps xmm2, xmm0
movdqu xmmword [0x1801de540], xmm2
nop dword [rax]
xor byte [rbx + r15], 0xfa
inc rbx
cmp rbx, 0x1e
jb 0x180001830
mov edx, 1
lea rcx, [rsp + 0x68]
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
jmp 0x180001875
mov byte [0x1801dd898], 0
xor rsi, r12
mov qword [r13], rsi
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret