Function at 0x180004530
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [0x180015040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, ebx
xor esi, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r14d, eax
cmp bl, 1
jne 0x18000463d
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x1800045bb
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800045e5
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180004604
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a78
mov rcx, rax
call fcn.18000f4ac
test rax, rax
je 0x180004a13
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180004611
test rcx, rcx
je 0x180004611
call fcn.18000f4ac
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x11
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Left_Mouse_Button]
movups xmmword [rsi], xmm0
movzx ecx, byte [0x180012380]
mov byte [rsi + 0x10], cl
mov byte [rsi + 0x11], 0
jmp 0x180004a47
cmp bl, 2
jne 0x18000470a
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x180004687
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800046b1
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800046d0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a78
mov rcx, rax
call fcn.18000f4ac
test rax, rax
je 0x180004a13
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800046dd
test rcx, rcx
je 0x1800046dd
call fcn.18000f4ac
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x12
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Right_Mouse_Button]
movups xmmword [rsi], xmm0
movzx eax, word [0x180012398]
mov word [rsi + 0x10], ax
mov byte [rsi + 0x12], 0
jmp 0x180004a47
cmp bl, 4
jne 0x1800047e1
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x180004754
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x18000477e
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000479d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a78
mov rcx, rax
call fcn.18000f4ac
test rax, rax
je 0x180004a13
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800047aa
test rcx, rcx
je 0x1800047aa
call fcn.18000f4ac
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x13
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Middle_Mouse_Button]
movups xmmword [rsi], xmm0
movzx eax, word [0x1800123b0]
mov word [rsi + 0x10], ax
movzx eax, byte [0x1800123b2]
mov byte [rsi + 0x12], al
mov byte [rsi + 0x13], 0
jmp 0x180004a47
cmp bl, 5
jne 0x180004824
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_1]
movsd qword [rdi], xmm0
mov eax, dword [0x1800123c0]
mov dword [rdi + 8], eax
movzx eax, byte [0x1800123c4]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], sil
jmp 0x180004a47
cmp bl, 6
jne 0x180004867
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_2]
movsd qword [rdi], xmm0
mov eax, dword [0x1800123d0]
mov dword [rdi + 8], eax
movzx eax, byte [0x1800123d4]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], sil
jmp 0x180004a47
lea eax, [rbx - 0x21]
cmp eax, 0x84
ja case.0x18000488c.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x4a88]
mov ecx, dword [rdx + rax*4 + 0x4a80]
add rcx, rdx
jmp rcx
bts r14d, 8
mov rax, qword gs:[0x60]
shl r14d, 0x10
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebp, dword [rcx + r10 + 0x88]
add rbp, r10
cmp rbp, r10
je 0x180004927
mov r9d, dword [rbp + 0x18]
test r9d, r9d
je 0x180004927
mov ebx, dword [rbp + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x72ff099b
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180004922
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180004900
cmp r8d, 0x1d135f83
je 0x18000492c
test r9d, r9d
jne 0x1800048e0
mov rax, qword [rax]
jmp 0x1800048b0
mov ecx, dword [rbp + 0x24]
mov r8d, 0x80
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbp + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x30]
add rax, r10
mov ecx, r14d
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r14, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop dword [rax]
inc r14
cmp byte [rax + r14], sil
jne 0x180004970
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x180004a72
mov qword [rdi + 0x18], 0xf
cmp r14, 0xf
ja 0x1800049b7
mov r8, r14
mov qword [rdi + 0x10], r14
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], sil
jmp 0x180004a47
mov rax, r14
or rax, 0xf
cmp rax, rbx
jbe 0x1800049ec
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000f4ac
test rax, rax
je 0x180004a13
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180004a27
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180004a1a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a78
jmp 0x1800049d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x180004a27
call fcn.18000f4ac
mov rsi, rax
mov r8, r14
mov qword [rdi], rsi
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x10], r14
mov rcx, rsi
mov qword [rdi + 0x18], rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000f1f0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1800016b0
int3
call fcn.180001610
int3