Function at 0x14001c330
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x14038c080]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor esi, esi
cmp byte [0x1403a55a8], sil
jne 0x14001c969
movabs r14, 0x7fffffffffffffff
mov r15d, 0xff
nop dword [rax]
nop word [rax + rax]
mov eax, dword [reloc.WS2_32.dll_accept]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x48]
call fcn.140001fb0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
test rbx, rbx
je 0x14001c3e5
js 0x14001c3e5
imul r8, rbx, 0xf4240
mov rax, r14
sub rax, r8
cmp rcx, rax
je 0x14001c3e0
mov edx, 1
cmovl edx, r15d
test dl, dl
jns 0x14001c3e0
lea rax, [r8 + rcx]
mov qword [rsp + 0x30], rax
jmp 0x14001c3e5
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.140004cd0
cmp byte [0x1403a5490], 0
je 0x14001c95c
cmp qword [0x1403a7298], 0
je 0x14001c95c
mov ecx, dword [0x1403a5494]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14001c50f
cmp byte [0x1403a6b11], al
je 0x14001c95c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001c4d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001c4d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xa12ee9f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001c4d1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001c4b0
cmp r8d, 0xfb7abb7f
je 0x14001c4db
test r9d, r9d
jne 0x14001c490
mov rax, qword [rax]
jmp 0x14001c460
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r8d, Ordinal_41
lea rdx, [rbp + 8]
mov ecx, 1
call rax
mov byte [0x1403a6b11], 0
jmp 0x14001c95c
mov rcx, qword [0x1403a6c50]
test rcx, rcx
je 0x14001c540
cmp dword [0x1403a6bb4], 0
je 0x14001c540
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x30]
mov rdx, qword [0x1403a7090]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14001c577
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [0x1403a6fe0]
call fcn.14002e090
mov rdx, qword [rax]
add rdx, 0x18
lea rcx, [rsp + 0x70]
call fcn.14001b310
jmp 0x14001c5ac
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rsp + 0x70]
call fcn.14001b210
nop
cmp dword [rsp + 0x78], 0
jle 0x14001c831
movups xmm0, xmmword [0x1403a7298]
movups xmmword [rbp + 8], xmm0
movups xmm6, xmmword [0x1403a72a8]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [0x1403a6c50]
test rdx, rdx
jne 0x14001c5e8
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x40], edx
xorps xmm1, xmm1
jmp 0x14001c623
test rbx, rbx
je 0x14001c61d
cmp dword [0x1403a6bb4], 0
je 0x14001c61d
add rdx, 0x90
mov qword [rsp + 0x20], rsi
mov r9d, listen
lea r8, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [0x1403a6c50]
movss xmm1, dword [rsp + 0x38]
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
subss xmm0, xmm1
movaps xmm1, xmm6
shufps xmm1, xmm6, 0xaa
subss xmm1, dword [rsp + 0x3c]
shufps xmm6, xmm6, 0xff
subss xmm6, dword [rsp + 0x40]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
mulss xmm6, xmm6
addss xmm1, xmm6
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x14001c66a
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x14001c672
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [0x1403a549c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
setbe al
cmp byte [rbp - 0x7f], 0
je 0x14001c696
movzx eax, al
cmp byte [0x1403a5498], 0
cmove eax, esi
movzx edi, al
cmp byte [rbp - 0x50], 0
cmovne edi, esi
test rbx, rbx
je 0x14001c6cd
cmp dword [0x1403a6bb4], 0
je 0x14001c6cd
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp]
mov rdx, qword [0x1403a7088]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp], 0
je 0x14001c831
test dil, dil
je 0x14001c831
cmp byte [0x1403a6b11], 0
jne 0x14001c91c
movsxd rbx, dword [0x1403a54a0]
lea rcx, [rsp + 0x50]
call fcn.140001fb0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x14001c73e
js 0x14001c73e
imul r8, rbx, 0xf4240
mov rcx, r14
sub rcx, r8
cmp rax, rcx
je 0x14001c739
mov edx, 1
cmovl edx, r15d
test dl, dl
jns 0x14001c739
lea rcx, [rax + r8]
mov qword [rsp + 0x30], rcx
jmp 0x14001c73e
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.140004cd0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001c7f6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001c7f6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x753f4d31
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001c7f1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001c7d0
cmp r8d, 0xc4ae0961
je 0x14001c7fb
test r9d, r9d
jne 0x14001c7b0
mov rax, qword [rax]
jmp 0x14001c780
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_41
lea rdx, [rbp + 8]
mov ecx, 1
call r9
mov byte [0x1403a6b11], 1
jmp 0x14001c91c
cmp byte [0x1403a6b11], 0
je 0x14001c91c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3c], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov dword [rbp + 0x38], esi
mov dword [rbp + 0x4c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001c8e6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001c8e6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x5ecf0d08
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001c8e1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001c8c0
cmp r8d, 0x7a6fc8fa
je 0x14001c8eb
test r9d, r9d
jne 0x14001c8a0
mov rax, qword [rax]
jmp 0x14001c870
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_41
lea rdx, [rbp + 0x38]
mov ecx, 1
call r9
mov byte [0x1403a6b11], 0
lea rcx, [rbp - 0x48]
call fcn.140005310
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14001c95c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c957
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c997
call fcn.14014a134
cmp byte [0x1403a55a8], 0
je 0x14001c390
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140149e90
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3