Function at 0x18000e500
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
movaps xmmword [r11 - 0x18], xmm6
mov rax, qword [0x1800a4040]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rcx, qword [0x1800a5748]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rdi
movaps xmmword [r11 - 0x28], xmm7
mov rax, qword [rcx + 0x3ed0]
cmp qword [rax + 0x1a8], 0
movss xmm1, dword [rax + 0x254]
subss xmm1, dword [rax + 0x104]
movss xmm0, dword [rax + 0x250]
jne 0x18000e569
cmp qword [rcx + 0x4b30], 0
je 0x18000e571
movss xmm0, dword [rax + 0x220]
subss xmm0, dword [rax + 0x100]
movss xmm7, dword [0x180093784]
lea rdx, [rbp + 0x17]
xor r8d, r8d
movss dword [rbp + 0x1b], xmm1
lea rcx, [rbp - 0x19]
mov word [rbp - 0x10], 0x31
mov dword [rbp - 0x19], 0x69612323
mulss xmm0, xmm7
mov dword [rbp - 0x15], 0x746f626d
mov byte [rbp - 0x11], 0x5f
mov byte [rbp - 0xe], 0
movss dword [rbp + 0x17], xmm0
call fcn.18002aff0
lea rdx, [0x180a483f8]
mov word [rbp + 0x1c], 0x65
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 0x62616e45
mov byte [rbp + 0x1b], 0x6c
mov byte [rbp + 0x1e], 0
call fcn.180053f60
movss xmm6, dword [0x180093948]
xorps xmm0, xmm0
movaps xmm1, xmm6
call fcn.1800336f0
mov rdi, qword [0x1800be058]
movss xmm4, dword [0x180093888]
movss xmm0, dword [0x1800938a4]
unpcklps xmm0, xmm4
cmp byte [rdi + 0x24], 0
movsd qword [rbp + 0x27], xmm0
jne 0x18000e640
cmp qword [rdi + 0x18], 0xf
mov rcx, rdi
jbe 0x18000e625
mov rcx, qword [rdi]
lea rdx, [rbp + 0x27]
call fcn.1800528f0
test al, al
je 0x18000e636
mov byte [rdi + 0x24], 1
cmp byte [rdi + 0x24], 0
je 0x18000e748
mov rax, qword [0x1800a5748]
lea rcx, [rbp - 0x19]
movups xmm0, xmmword [rax + 0x3a1c]
movups xmmword [rbp - 0x19], xmm0
shufps xmm0, xmm0, 0xff
mulss xmm0, dword [rax + 0x37d0]
movss dword [rbp - 0xd], xmm0
call fcn.180022d70
mov edx, eax
mov ecx, socket
call fcn.1800237f0
lea rdx, [rbp + 0x27]
mov dword [rbp + 0x17], 0x2e2e2e
lea rcx, [rbp + 0x17]
mov byte [rbp + 0x1b], 0
call fcn.1800528f0
mov r8, qword [0x1800a5748]
movsxd rax, dword [r8 + 0x4818]
cmp eax, 1
jl 0x18000e6cb
mov rcx, qword [r8 + 0x4820]
lea rdx, [rax + rax*4]
movsxd rax, dword [rcx + rdx*4 - 0x14]
movups xmm0, xmmword [rcx + rdx*4 - 0x10]
add rax, rax
movups xmmword [r8 + rax*8 + 0x38ac], xmm0
dec dword [r8 + 0x4818]
mov rax, qword [0x1800be5b0]
mov rax, qword [rax]
mov qword [rbp + 0x17], rax
cmp byte [rax + 0x19], 0
jne 0x18000e748
mov qword [rsp + 0xc8], rsi
nop word [rax + rax]
lea rbx, [rax + 0x20]
mov ecx, dword [rbx + 0x20]
lea rsi, [rbx + 0x20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18000e72d
cmp rdi, rbx
je 0x18000e724
cmp qword [rbx + 0x18], 0xf
mov r8, qword [rbx + 0x10]
jbe 0x18000e719
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rdi
call fcn.180019490
mov eax, dword [rsi]
mov dword [rdi + 0x20], eax
mov byte [rdi + 0x24], 0
lea rcx, [rbp + 0x17]
call fcn.18001fbc0
mov rax, qword [rbp + 0x17]
cmp byte [rax + 0x19], 0
je 0x18000e6f0
mov rsi, qword [rsp + 0xc8]
lea rdx, [0x180a48400]
mov dword [rbp - 0x11], 0x736465
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x67726154
mov dword [rbp - 0x15], 0x50207465
mov byte [rbp - 0xd], 0
call fcn.180053f60
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1800336f0
movdqa xmm0, xmmword [0x180094050]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
mov word [rbp + 0x27], 0x3f
movups xmmword [rbp - 0x19], xmm0
mov byte [rbp + 0x29], 0
call fcn.180051f30
mov rcx, qword [0x1800a5748]
cmp byte [rcx + 0x48ef], 0
mov r8, qword [rcx + 0x3ed0]
je 0x18000e7eb
cmp byte [rcx + 0x48ee], 0
jne 0x18000e7eb
test byte [rcx + 0x4770], 4
jne 0x18000e8e0
mov eax, dword [rcx + 0x48b8]
cmp eax, dword [rcx + 0x476c]
jne 0x18000e8e0
test eax, eax
jne 0x18000e8b3
jmp 0x18000e8e0
mov eax, dword [rcx + 0x4774]
test al, 1
je 0x18000e8e0
cmp qword [rcx + 0x3ed8], r8
je 0x18000e80a
test al, al
jns 0x18000e8e0
mov eax, dword [rcx + 0x3f30]
test eax, eax
je 0x18000e82f
cmp eax, dword [rcx + 0x476c]
je 0x18000e82f
cmp byte [rcx + 0x3f3d], 0
jne 0x18000e82f
cmp eax, dword [r8 + 0x7c]
jne 0x18000e8e0
mov rdx, qword [rcx + 0x48b0]
test rdx, rdx
je 0x18000e894
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x18000e894
cmp byte [rdx + 0xb7], 0
je 0x18000e894
mov rax, qword [r8 + 0x378]
cmp rdx, rax
je 0x18000e894
mov r9d, dword [rdx + 0x14]
bt r9d, 0x1b
jb 0x18000e86e
bt r9d, 0x1a
jae 0x18000e894
cmp qword [rax + 0x378], rdx
je 0x18000e894
cmp rax, rdx
je 0x18000e894
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x18000e877
test dword [rcx + 0x4770], 0x100
je 0x18000e8e0
test byte [rcx + 0x4770], 4
jne 0x18000e8e0
mov eax, dword [r8 + 0x7c]
cmp dword [rcx + 0x476c], eax
jne 0x18000e8b3
cmp byte [r8 + 0xb8], 0
jne 0x18000e8e0
movdqa xmm0, xmmword [0x180093c20]
lea rcx, [rbp - 0x19]
movdqa xmm1, xmmword [0x180094690]
movdqu xmmword [rbp - 0x19], xmm0
mov word [rbp + 7], 0x2e
movdqu xmmword [rbp - 9], xmm1
mov byte [rbp + 9], 0
call fcn.180034710
lea rdx, [0x180a483f9]
mov dword [rbp - 0x11], 0x646165
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x67726154
mov dword [rbp - 0x15], 0x44207465
mov byte [rbp - 0xd], 0
call fcn.180053f60
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1800336f0
movdqa xmm0, xmmword [0x180094050]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
mov word [rbp + 0x27], 0x3f
movups xmmword [rbp - 0x19], xmm0
mov byte [rbp + 0x29], 0
call fcn.180051f30
mov rcx, qword [0x1800a5748]
cmp byte [rcx + 0x48ef], 0
mov r8, qword [rcx + 0x3ed0]
je 0x18000e983
cmp byte [rcx + 0x48ee], 0
jne 0x18000e983
test byte [rcx + 0x4770], 4
jne 0x18000ea7a
mov eax, dword [rcx + 0x48b8]
cmp eax, dword [rcx + 0x476c]
jne 0x18000ea7a
test eax, eax
jne 0x18000ea4c
jmp 0x18000ea7a
mov eax, dword [rcx + 0x4774]
test al, 1
je 0x18000ea7a
cmp qword [rcx + 0x3ed8], r8
je 0x18000e9a2
test al, al
jns 0x18000ea7a
mov eax, dword [rcx + 0x3f30]
test eax, eax
je 0x18000e9c7
cmp eax, dword [rcx + 0x476c]
je 0x18000e9c7
cmp byte [rcx + 0x3f3d], 0
jne 0x18000e9c7
cmp eax, dword [r8 + 0x7c]
jne 0x18000ea7a
mov rdx, qword [rcx + 0x48b0]
test rdx, rdx
je 0x18000ea2d
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x18000ea2d
cmp byte [rdx + 0xb7], 0
je 0x18000ea2d
mov rax, qword [r8 + 0x378]
cmp rdx, rax
je 0x18000ea2d
mov r9d, dword [rdx + 0x14]
bt r9d, 0x1b
jb 0x18000ea06
bt r9d, 0x1a
jae 0x18000ea2d
cmp qword [rax + 0x378], rdx
je 0x18000ea2d
nop
cmp rax, rdx
je 0x18000ea2d
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x18000ea10
test dword [rcx + 0x4770], 0x100
je 0x18000ea7a
test byte [rcx + 0x4770], 4
jne 0x18000ea7a
mov eax, dword [r8 + 0x7c]
cmp dword [rcx + 0x476c], eax
jne 0x18000ea4c
cmp byte [r8 + 0xb8], 0
jne 0x18000ea7a
movdqa xmm0, xmmword [0x180093c20]
lea rcx, [rbp - 0x19]
movdqa xmm1, xmmword [0x1800943c0]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp + 7], 0x2e73b4
movdqu xmmword [rbp - 9], xmm1
mov byte [rbp + 0xb], 0
call fcn.180034710
movdqa xmm0, xmmword [0x1800944e0]
lea rdx, [0x180a48401]
lea rcx, [rbp - 0x19]
mov word [rbp - 8], 0x77
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 9], 0x65
mov byte [rbp - 6], 0
call fcn.180053f60
cmp byte [0x180a48401], 0
je 0x18000eade
lea rdx, [0x1800a5712]
mov dword [rbp - 0xd], 0x564f46
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x77617244
mov dword [rbp - 0x15], 0x6c694620
mov dword [rbp - 0x11], 0x2064656c
mov byte [rbp - 9], 0
call fcn.180053f60
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1800336f0
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x13], 0x726961
lea rdx, [0x180a48402]
mov dword [rbp - 0x19], 0x736f7243
mov word [rbp - 0x15], 0x6873
mov byte [rbp - 0xf], 0
call fcn.180053f60
lea rdx, [0x1800a5711]
mov dword [rbp + 0x1b], 0x656e69
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x17], 0x4c6d6941
mov byte [rbp + 0x1f], 0
call fcn.180053f60
call fcn.18002b0a0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1800336f0
mov rdx, qword [0x1800a5748]
mov rax, qword [rdx + 0x3ed0]
cmp qword [rax + 0x1a8], 0
movss xmm1, dword [rax + 0x254]
subss xmm1, dword [rax + 0x104]
movss xmm0, dword [rax + 0x250]
jne 0x18000eb7d
cmp qword [rdx + 0x4b30], 0
je 0x18000eb85
movss xmm0, dword [rax + 0x220]
subss xmm0, dword [rax + 0x100]
xor r8d, r8d
movss dword [rbp + 0x1b], xmm1
lea rdx, [rbp + 0x17]
mov word [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x5f612323
mov dword [rbp - 0x15], 0x74746573
movss dword [rbp + 0x17], xmm0
mov word [rbp - 0x11], 0x6e69
mov byte [rbp - 0xf], 0x67
mov byte [rbp - 0xc], 0
call fcn.18002aff0
mov rax, qword [0x1800a5748]
mov rdx, qword [rax + 0x3ed0]
cmp qword [rdx + 0x1a8], 0
movss xmm0, dword [rdx + 0x250]
jne 0x18000ebf3
cmp qword [rax + 0x4b30], 0
je 0x18000ebfb
movss xmm0, dword [rdx + 0x220]
subss xmm0, dword [rdx + 0x100]
mulss xmm0, xmm7
call fcn.1800337a0
lea rax, [rbp + 0x27]
mov dword [rbp - 0x13], 0x676e69
lea rdi, [0x180088f0c]
mov dword [rbp - 0x19], 0x6f6f6d53
xor ebx, ebx
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x17]
mov qword [rsp + 0x20], rax
lea r8, [0x180a483fc]
mov word [rbp - 0x15], 0x6874
lea rcx, [rbp - 0x19]
mov byte [rbp - 0xf], 0
mov dword [rbp + 0x27], 0x64
mov dword [rbp + 0x17], ebx
call fcn.1800572a0
mov r9, qword [0x1800a5748]
mov rax, qword [r9 + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [r9 + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
mov rcx, qword [r9 + 0x3ed0]
movss xmm0, dword [rcx + 0x250]
cmp qword [rcx + 0x1a8], rbx
jne 0x18000ecb9
cmp qword [r9 + 0x4b30], rbx
je 0x18000ecc1
movss xmm0, dword [rcx + 0x220]
subss xmm0, dword [rcx + 0x100]
mulss xmm0, xmm7
call fcn.1800337a0
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea r8, [0x1800a5714]
mov dword [rbp - 0xf], 0x776569
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x6c656946
mov dword [rbp - 0x15], 0x664f2064
mov word [rbp - 0x11], 0x5620
mov byte [rbp - 0xb], bl
mov dword [rbp + 0x17], 0x64
mov dword [rbp + 0x27], ebx
call fcn.1800572a0
mov r9, qword [0x1800a5748]
mov rax, qword [r9 + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [r9 + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
mov rcx, qword [r9 + 0x3ed0]
movss xmm0, dword [rcx + 0x250]
cmp qword [rcx + 0x1a8], rbx
jne 0x18000ed7c
cmp qword [r9 + 0x4b30], rbx
je 0x18000ed84
movss xmm0, dword [rcx + 0x220]
subss xmm0, dword [rcx + 0x100]
mulss xmm0, xmm7
call fcn.1800337a0
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rdi
lea r9, [rbp + 0x27]
mov qword [rsp + 0x20], rax
lea r8, [0x1800a40a8]
mov word [rbp - 0x12], 0x65
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x19], 0x74736944
mov word [rbp - 0x15], 0x6e61
mov byte [rbp - 0x13], 0x63
mov byte [rbp - 0x10], bl
mov dword [rbp + 0x17], 0x9c4
mov dword [rbp + 0x27], ebx
call fcn.1800572a0
mov r9, qword [0x1800a5748]
mov rdi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
mov rax, qword [r9 + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [r9 + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
mov rcx, qword [r9 + 0x3ed0]
cmp qword [rcx + 0x1a8], 0
movss xmm0, dword [rcx + 0x250]
jne 0x18000ee4d
cmp qword [r9 + 0x4b30], 0
je 0x18000ee55
movss xmm0, dword [rcx + 0x220]
subss xmm0, dword [rcx + 0x100]
mulss xmm0, xmm7
call fcn.1800337a0
lea rcx, [rbp - 0x19]
mov word [rbp - 0x12], 0x65
mov dword [rbp - 0x19], 0x206d6941
mov word [rbp - 0x15], 0x6f42
mov byte [rbp - 0x13], 0x6e
mov byte [rbp - 0x10], 0
call fcn.180056170
mov rcx, qword [0x1800a5748]
movaps xmm1, xmm6
xorps xmm0, xmm0
mov rax, qword [rcx + 0x3ed0]
mov byte [rax + 0xb8], 1
mov r8, qword [rcx + 0x3ed0]
movsxd rdx, dword [r8 + 0x1c8]
mov rax, qword [r8 + 0x1d0]
mov ecx, dword [rax + rdx*4 - 4]
lea eax, [rdx - 1]
mov dword [r8 + 0x1c8], eax
mov dword [r8 + 0x1bc], ecx
call fcn.1800336f0
movdqa xmm0, xmmword [0x180094050]
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x19]
mov word [rbp + 0x27], 0x3f
movups xmmword [rbp - 0x19], xmm0
mov byte [rbp + 0x29], 0
call fcn.180051f30
mov rcx, qword [0x1800a5748]
movaps xmm7, xmmword [rsp + 0x90]
cmp byte [rcx + 0x48ef], 0
mov r8, qword [rcx + 0x3ed0]
je 0x18000ef4b
cmp byte [rcx + 0x48ee], 0
jne 0x18000ef4b
test byte [rcx + 0x4770], 4
jne 0x18000f05d
mov eax, dword [rcx + 0x48b8]
cmp eax, dword [rcx + 0x476c]
jne 0x18000f05d
test eax, eax
jne 0x18000f013
jmp 0x18000f05d
mov eax, dword [rcx + 0x4774]
test al, 1
je 0x18000f05d
cmp qword [rcx + 0x3ed8], r8
je 0x18000ef6a
test al, al
jns 0x18000f05d
mov eax, dword [rcx + 0x3f30]
test eax, eax
je 0x18000ef8f
cmp eax, dword [rcx + 0x476c]
je 0x18000ef8f
cmp byte [rcx + 0x3f3d], 0
jne 0x18000ef8f
cmp eax, dword [r8 + 0x7c]
jne 0x18000f05d
mov rdx, qword [rcx + 0x48b0]
test rdx, rdx
je 0x18000eff4
mov rdx, qword [rdx + 0x378]
test rdx, rdx
je 0x18000eff4
cmp byte [rdx + 0xb7], 0
je 0x18000eff4
mov rax, qword [r8 + 0x378]
cmp rdx, rax
je 0x18000eff4
mov r9d, dword [rdx + 0x14]
bt r9d, 0x1b
jb 0x18000efce
bt r9d, 0x1a
jae 0x18000eff4
cmp qword [rax + 0x378], rdx
je 0x18000eff4
cmp rax, rdx
je 0x18000eff4
mov rax, qword [rax + 0x370]
test rax, rax
jne 0x18000efd7
test dword [rcx + 0x4770], 0x100
je 0x18000f05d
test byte [rcx + 0x4770], 4
jne 0x18000f05d
mov eax, dword [r8 + 0x7c]
cmp dword [rcx + 0x476c], eax
jne 0x18000f013
cmp byte [r8 + 0xb8], 0
jne 0x18000f05d
movdqa xmm0, xmmword [0x1800947c0]
lea rcx, [rbp - 0x19]
movdqa xmm1, xmmword [0x180094910]
movdqu xmmword [rbp - 0x19], xmm0
mov dword [rbp + 7], 0xd1d0d2cd
movdqu xmmword [rbp - 9], xmm1
mov dword [rbp + 0xb], 0xa2afd39e
mov dword [rbp + 0xf], 0xababe3a9
mov word [rbp + 0x13], 0xe8
mov byte [rbp + 0x15], 1
call fcn.18000f170
mov rcx, rax
call fcn.180034710
lea rcx, [rbp - 0x19]
mov dword [rbp - 0xf], 0x726f6c
mov dword [rbp - 0x19], 0x4c6d6941
mov dword [rbp - 0x15], 0x20656e69
mov word [rbp - 0x11], 0x6f43
mov byte [rbp - 0xb], 0
call fcn.180051df0
movaps xmm1, xmm6
xorps xmm0, xmm0
call fcn.1800336f0
lea rcx, [rbp - 0x19]
mov dword [rbp - 0x13], 0x656e69
mov r8d, 0x10020
mov dword [rbp - 0x19], 0x69412323
lea rdx, [0x1800a4098]
mov word [rbp - 0x15], 0x6c6d
mov byte [rbp - 0xf], 0
call fcn.18005db60
movups xmm0, xmmword [0x1800a4098]
movups xmmword [0x1800a4280], xmm0
call fcn.18002b0a0
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1800804d0
movaps xmm6, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbp
ret