Function at 0x1800044a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x180015008]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, ebx
xor esi, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r14d, eax
cmp bl, 1
jne 0x1800045ad
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x18000452b
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x180004555
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180004574
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800049e8
mov rcx, rax
call fcn.18000fbec
test rax, rax
je 0x180004983
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180004581
test rcx, rcx
je 0x180004581
call fcn.18000fbec
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x11
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Left_Mouse_Button]
movups xmmword [rsi], xmm0
movzx ecx, byte [0x1800123a0]
mov byte [rsi + 0x10], cl
mov byte [rsi + 0x11], 0
jmp 0x1800049b7
cmp bl, 2
jne 0x18000467a
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x1800045f7
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x180004621
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180004640
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800049e8
mov rcx, rax
call fcn.18000fbec
test rax, rax
je 0x180004983
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18000464d
test rcx, rcx
je 0x18000464d
call fcn.18000fbec
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x12
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Right_Mouse_Button]
movups xmmword [rsi], xmm0
movzx eax, word [0x1800123b8]
mov word [rsi + 0x10], ax
mov byte [rsi + 0x12], 0
jmp 0x1800049b7
cmp bl, 4
jne 0x180004751
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x1800046c4
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800046ee
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000470d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800049e8
mov rcx, rax
call fcn.18000fbec
test rax, rax
je 0x180004983
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18000471a
test rcx, rcx
je 0x18000471a
call fcn.18000fbec
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x13
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Middle_Mouse_Button]
movups xmmword [rsi], xmm0
movzx eax, word [0x1800123d0]
mov word [rsi + 0x10], ax
movzx eax, byte [0x1800123d2]
mov byte [rsi + 0x12], al
mov byte [rsi + 0x13], 0
jmp 0x1800049b7
cmp bl, 5
jne 0x180004794
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_1]
movsd qword [rdi], xmm0
mov eax, dword [0x1800123e0]
mov dword [rdi + 8], eax
movzx eax, byte [0x1800123e4]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], sil
jmp 0x1800049b7
cmp bl, 6
jne 0x1800047d7
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_2]
movsd qword [rdi], xmm0
mov eax, dword [0x1800123f0]
mov dword [rdi + 8], eax
movzx eax, byte [0x1800123f4]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], sil
jmp 0x1800049b7
lea eax, [rbx - 0x21]
cmp eax, 0x84
ja case.0x1800047fc.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x49f8]
mov ecx, dword [rdx + rax*4 + 0x49f0]
add rcx, rdx
jmp rcx
bts r14d, 8
mov rax, qword gs:[0x60]
shl r14d, 0x10
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebp, dword [rcx + r10 + 0x88]
add rbp, r10
cmp rbp, r10
je 0x180004897
mov r9d, dword [rbp + 0x18]
test r9d, r9d
je 0x180004897
mov ebx, dword [rbp + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xcb324ca7
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180004892
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180004870
cmp r8d, 0xf9ecf37
je 0x18000489c
test r9d, r9d
jne 0x180004850
mov rax, qword [rax]
jmp 0x180004820
mov ecx, dword [rbp + 0x24]
mov r8d, 0x80
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbp + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x30]
add rax, r10
mov ecx, r14d
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r14, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop dword [rax]
inc r14
cmp byte [rax + r14], sil
jne 0x1800048e0
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x1800049e2
mov qword [rdi + 0x18], 0xf
cmp r14, 0x10
jae 0x180004927
mov r8, r14
mov qword [rdi + 0x10], r14
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], sil
jmp 0x1800049b7
mov rax, r14
or rax, 0xf
cmp rax, rbx
jbe 0x18000495c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000fbec
test rax, rax
je 0x180004983
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180004997
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000498a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1800049e8
jmp 0x180004941
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x180004997
call fcn.18000fbec
mov rsi, rax
mov r8, r14
mov qword [rdi], rsi
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x10], r14
mov rcx, rsi
mov qword [rdi + 0x18], rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000f930
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1800016a0
int3
call fcn.180001600
int3