Function at 0x1400e4b90
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm9
mov rax, qword [0x1401e56c8]
xor rax, rsp
mov qword [rbp + 0x58], rax
xor r13d, r13d
mov dword [rsp + 0x34], r13d
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
mov qword [rbp + 0x18], r13
lea edx, [r13 + 1]
call fcn.1400105e0
mov qword [rbp + 8], rax
lea rdx, [rax + 4]
mov qword [rbp + 0x18], rdx
xor ecx, ecx
mov dword [rax], ecx
mov qword [rbp + 0x10], rdx
mov rax, rdx
mov rcx, qword [rbp + 8]
sub rax, rcx
sar rax, 2
cmp rax, 1
jbe 0x1400e4c24
lea rax, [rcx + 4]
cmp rax, rdx
je 0x1400e4c24
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x20], 9
and dword [rcx], 0x1ff
mov rax, qword [rbp + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], r13
mov rax, qword [0x1401ec7d8]
lea r8, [rax + 0x28]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
lea rbx, [r8 + 0x24]
xorps xmm9, xmm9
cmp r8, rbx
je 0x1400e4ce4
mov rcx, r13
mov rax, r13
mov r10, r13
mov r9, r13
mov r11, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x20]
nop dword [rax]
movss xmm0, dword [r8]
ucomiss xmm0, xmm9
jp 0x1400e4c9d
jne 0x1400e4c9d
mov rcx, rax
mov eax, 1
shl eax, cl
not eax
and dword [rdx], eax
jmp 0x1400e4ca9
mov eax, 1
shl eax, cl
or dword [rdx], eax
mov r9, r10
cmp r9, 0x1f
jae 0x1400e4cc1
lea rcx, [r11 + 1]
mov r11, rcx
mov rax, rcx
mov r10, rcx
mov r9, rcx
jmp 0x1400e4cd4
mov r11, r13
add rdx, 4
mov rcx, r13
mov rax, r13
mov r10, r13
mov r9, r13
add r8, 4
cmp r8, rbx
jne 0x1400e4c80
mov rax, qword [0x1401ec7d8]
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rcx
movss xmm0, dword [rax + 0x24]
ucomiss xmm0, xmm9
jp 0x1400e4ea6
jne 0x1400e4ea6
mov eax, dword [0x1401c463c]
mov dword [rsp + 0x20], eax
lea r15d, [rcx + 5]
lea r12d, [rcx + 0x1f]
mov r14d, dword [reloc.WS2_32.dll_accept]
cmp byte [0x1401c463f], cl
je 0x1400e4e03
cmp r14d, 2
jl 0x1400e4dbf
movdqa xmm3, xmmword [0x1401c4b30]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401c4ed0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401c4ed0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, r15d
psrad xmm2, xmm0
movd xmm0, r12d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401c4ba0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4d70]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
jmp 0x1400e4e03
lea r9, [rsp + 0x20]
mov r8d, r13d
nop word [rax + rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400e4dd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rsp + 0x20]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400e4e23
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x68]
call fcn.140010900
nop
mov dword [rsp + 0x34], Ordinal_50
mov edx, 1
call fcn.140014000
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
lea rbx, [rax + 0x20]
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rcx, [rsp + 0x50]
mov qword [rbp], rcx
lea rdx, [rsp + 0x68]
mov rcx, rax
call fcn.140013bf0
nop
mov qword [rsp + 0x58], rbx
lea r8, [rsp + 0x50]
mov edi, reloc.WS2_32.dll_WSASetLastError
jmp 0x1400e50e4
mov eax, dword [0x1401c4648]
mov dword [rsp + 0x20], eax
movzx eax, word [0x1401c464c]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x20], reloc.WS2_32.dll_WSAStartup
xor byte [rsp + 0x21], 0x32
xor byte [rsp + 0x22], 0x33
xor byte [rsp + 0x23], 0x34
xor al, 0x35
mov byte [rsp + 0x24], al
xor byte [rsp + 0x25], 0x36
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
lea rax, [rsp + 0x20]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], cl
jne 0x1400e4f00
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x50]
call fcn.140010900
nop
mov dword [rsp + 0x34], 1
mov eax, dword [str.PJV4E_QV__]
mov dword [rsp + 0x20], eax
mov r15d, 5
lea r12d, [r15 + 0x1a]
mov r14d, dword [reloc.WS2_32.dll_accept]
cmp byte [0x1401c4653], 0
je 0x1400e5023
cmp r14d, 2
jl 0x1400e4fdc
movdqa xmm3, xmmword [0x1401c4b30]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401c4ed0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401c4ed0]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
movd xmm0, r15d
psrad xmm2, xmm0
movd xmm0, r12d
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1401c4ba0]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4d70]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
jmp 0x1400e5023
lea r9, [rsp + 0x20]
mov r8d, r13d
nop dword [rax]
nop dword [rax + rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400e4ff0
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rsp + 0x20]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400e5040
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.140010900
nop
mov dword [rsp + 0x34], 7
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r13
mov edx, 2
call fcn.140014000
mov rbx, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rcx, [rax + 0x40]
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea rdi, [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x10], rbx
mov qword [rbp - 8], rbx
lea rax, [rsp + 0x38]
mov qword [rbp], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140013bf0
add rbx, 0x20
mov qword [rbp - 8], rbx
add rdi, 0x20
lea rax, [rbp - 0x10]
cmp rdi, rax
jne 0x1400e50b5
mov qword [rsp + 0x40], rbx
lea r8, [rsp + 0x38]
mov edi, reloc.WS2_32.dll_ntohs
mov rdx, qword [r8 + 0x10]
mov qword [r8 + 0x10], r13
mov rcx, qword [r8 + 8]
mov qword [r8 + 8], r13
mov rax, qword [r8]
mov qword [r8], r13
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rdx
test dil, 0x40
je 0x1400e511a
and edi, 0xffffffbf
lea rcx, [rsp + 0x50]
call fcn.140013d10
nop
test dil, 0x20
je 0x1400e5142
and edi, 0xffffffdf
mov dword [rsp + 0x34], edi
lea r9, [fcn.140010650]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x68]
call fcn.14015c0c8
nop
test dil, 8
je 0x1400e5156
and edi, 0xfffffff7
lea rcx, [rsp + 0x38]
call fcn.140013d10
nop
test dil, 4
je 0x1400e5178
and edi, 0xfffffffb
lea r9, [fcn.140010650]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1e]
lea rcx, [rbp - 0x50]
call fcn.14015c0c8
mov rax, qword [0x1401ec7d8]
movss xmm6, dword [rax + 0x18]
cvtps2pd xmm6, xmm6
xorps xmm0, xmm0
comisd xmm0, xmm6
jae 0x1400e5445
movsd xmm1, qword [0x1401c4948]
comisd xmm6, xmm1
jae 0x1400e51b1
call fcn.1400ce120
comisd xmm6, xmm0
jb 0x1400e5445
mov byte [rsp + 0x30], 0
mov rax, qword [0x1401c4640]
mov qword [rsp + 0x20], rax
cmp byte [0x1401c4647], 0
je 0x1400e5323
cmp r14d, 2
jl 0x1400e52dd
movdqa xmm4, xmmword [0x1401c4ed0]
movd xmm6, r15d
movd xmm5, r12d
movdqa xmm2, xmmword [0x1401c4b30]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401c4ba0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4d70]
movd xmm0, dword [rsp + 0x20]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm3, xmmword [0x1401c4b40]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401c4ba0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401c4d00]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401c4d70]
movd xmm0, dword [rsp + 0x24]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
jmp 0x1400e5323
lea r9, [rsp + 0x20]
mov r8d, r13d
nop word [rax + rax]
mov eax, 0xa0a0a0a1
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x33
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x1400e52f0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
lea rax, [rsp + 0x20]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400e5337
mov r8, rsi
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x78]
call fcn.140010900
bts edi, 7
bts edi, 8
mov dword [rsp + 0x34], edi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
mov edx, 1
call fcn.140014000
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
lea rbx, [rax + 0x20]
mov qword [rbp], rbx
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
lea rcx, [rbp - 0x10]
mov qword [rbp + 0x50], rcx
lea rdx, [rbp - 0x78]
mov rcx, rax
call fcn.140013bf0
nop
mov qword [rbp - 8], rbx
bts edi, 9
mov dword [rsp + 0x34], edi
lea r9, [rsp + 0x30]
lea r8, [rbp + 8]
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x28]
call fcn.1400238f0
test al, al
je 0x1400e5445
mov rax, qword [0x1401ec7d8]
movss xmm0, dword [rax + 0x1c]
ucomiss xmm0, xmm9
jp 0x1400e53ea
je 0x1400e5441
mov ecx, dword [0x1401e5754]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400e5445
call fcn.140011d40
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14001c6f0
test al, al
je 0x1400e5445
mov rax, qword [0x1401ec7d8]
movss xmm0, dword [rax + 0x20]
ucomiss xmm0, xmm9
jp 0x1400e5429
je 0x1400e5441
call fcn.140011d40
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call fcn.14001bbb0
test al, al
je 0x1400e5445
mov bl, 1
jmp 0x1400e5447
xor bl, bl
bt edi, 9
jae 0x1400e545b
btr edi, 9
lea rcx, [rbp - 0x10]
call fcn.140013d10
nop
bt edi, 8
jae 0x1400e547b
lea r9, [fcn.140010650]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x1f]
lea rcx, [rbp - 0x78]
call fcn.14015c0c8
nop
lea rcx, [rbp + 0x28]
call fcn.140013d10
nop
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400e54c6
mov rdx, qword [rbp + 0x18]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e54c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e54c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14015c094
movzx eax, bl
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.14015bde0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm9, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret