Function at 0x140025f80
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x140363f00]
xor rax, rsp
mov qword [rbp + 0x40], rax
cmp byte [0x1403864f8], 0
jne 0x140026301
movabs rsi, 0x7fffffffffffffff
mov r14d, 1
xor r15d, r15d
nop
mov eax, dword [0x140386508]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x38]
call fcn.140002760
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x140026025
js 0x140026025
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x140026020
mov ecx, 0xff
cmovge ecx, r14d
test cl, cl
jns 0x140026020
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x140026025
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.1400056d0
cmp byte [0x140386324], 0
je 0x1400262f4
cmp qword [0x1403884d0], 0
je 0x1400262f4
lea rcx, [rbp - 0x60]
call fcn.140024f80
mov qword [rbp + 0x38], 0
movd xmm1, dword [0x140386330]
cvtdq2ps xmm1, xmm1
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
movzx r9d, byte [0x14038632c]
mov r8d, dword [0x140386338]
call fcn.140033640
test al, al
je 0x140026200
cmp byte [rbp - 0x20], 0
jne 0x1400262eb
cmp byte [rbp + 0x34], 0
je 0x1400262eb
mov ecx, dword [0x140386328]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140026200
cmp byte [0x140388149], 0
jne 0x1400262eb
movsxd rbx, dword [0x14038633c]
lea rcx, [rsp + 0x40]
call fcn.140002760
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x140026112
js 0x140026112
imul r8, rbx, 0xf4240
mov rdx, rsi
sub rdx, r8
cmp rax, rdx
je 0x14002610d
mov ecx, 0xff
cmovge ecx, r14d
test cl, cl
jns 0x14002610d
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x140026112
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.1400056d0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x4c], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x5c], 2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400261c6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400261c6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xcef619b3
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400261c1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400261a0
cmp r8d, 0xc6b13adb
je 0x1400261cb
test r9d, r9d
jne 0x140026180
mov rax, qword [rax]
jmp 0x140026150
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, 0x28
lea rdx, [rsp + 0x48]
mov ecx, r14d
call r9
mov byte [0x140388149], 1
jmp 0x1400262eb
cmp byte [0x140388149], 0
je 0x1400262eb
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x74], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x78], xmm1
mov dword [rsp + 0x70], r15d
mov dword [rbp - 0x7c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400262b6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400262b6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x59df9b35
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400262b1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140026290
cmp r8d, 0x25473acd
je 0x1400262bb
test r9d, r9d
jne 0x140026270
mov rax, qword [rax]
jmp 0x140026240
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, 0x28
lea rdx, [rsp + 0x70]
mov ecx, r14d
call r9
mov byte [0x140388149], 0
lea rcx, [rbp - 0x60]
call fcn.140005ef0
cmp byte [0x1403864f8], 0
je 0x140025fd0
mov rcx, qword [rbp + 0x40]
xor rcx, rsp
call fcn.14012df70
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret