Function at 0x1800277f0
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0xe8]
sub rsp, 0x1e0
cmp byte [0x18022c727], 0
je 0x180027fd6
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1800278a7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1800278a7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaaa6144
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1800278a2
nop dword [rax]
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180027880
cmp r8d, 0xa6a01834
je 0x1800278ac
test r9d, r9d
jne 0x180027860
mov rax, qword [rax]
jmp 0x180027830
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
add rax, r10
call rax
test ax, ax
jns 0x180027fc6
mov eax, dword [0x18022c730]
test eax, eax
jne 0x1800278f9
call fcn.180027420
test rax, rax
je 0x180027fc6
mov rcx, rax
call fcn.18002fa60
jmp 0x180027fc6
mov qword [rsp + 0x1d8], r12
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1a0], xmm7
movaps xmmword [rsp + 0x190], xmm8
movaps xmmword [rsp + 0x180], xmm9
cmp eax, 0x3e7
jne 0x180027a8b
call fcn.18003f370
movss xmm9, dword [rax + 8]
movss xmm6, dword [rax + 0xc]
mulss xmm9, dword [0x180198998]
mulss xmm6, dword [0x180198998]
call fcn.180027420
mov rbx, rax
test rax, rax
je 0x180027f9c
mov r8d, 0x796e
lea rcx, [rbp - 0x50]
mov rdx, rax
call fcn.180027260
mov ecx, dword [0x18022c72c]
dec ecx
cmp ecx, 5
ja case.default.0x180027994
lea r12, [0x180000000]
movsxd rcx, ecx
mov eax, dword [r12 + rcx*4 + 0x27fe0]
add rax, r12
jmp rax
mov r8d, 7
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.180027260
movsd xmm8, qword [rsp + 0x70]
mov ebx, dword [rsp + 0x78]
jmp 0x1800279e7
mov r8d, 8
jmp 0x18002799c
mov r8d, 1
jmp 0x18002799c
mov r8d, 2
jmp 0x18002799c
mov r8d, 5
jmp 0x18002799c
mov r8d, 6
jmp 0x18002799c
mov ebx, dword [rbp - 0x48]
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x60]
movsd qword [rbp - 0x60], xmm8
lea rcx, [rbp + 0xf0]
mov dword [rbp - 0x58], ebx
call fcn.18002e4e0
movss xmm0, dword [rbp + 0xf4]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x1801989d0]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x1801989d0]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0xf0]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
ucomiss xmm1, xmm0
ja 0x180027a5b
sqrtss xmm0, xmm0
jmp 0x180027a60
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [reloc.WLDAP32.dll_Ordinal_30]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x180027f9c
lea rcx, [rbp - 0x70]
movsd qword [rbp - 0x70], xmm8
mov dword [rbp - 0x68], ebx
call fcn.180026540
jmp 0x180027f9c
cmp eax, 1
jne 0x180027f9c
mov rax, qword [0x18022c768]
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x1d0], r13
mov qword [rsp + 0x1c8], r14
mov rdi, qword [rax]
mov qword [rsp + 0x1c0], r15
movaps xmmword [rsp + 0x130], xmm14
movaps xmmword [rsp + 0x120], xmm15
test rdi, rdi
je 0x180027ad9
mov rdi, qword [rdi + 8]
mov rax, qword [0x18022c770]
mov rsi, qword [rax]
test rsi, rsi
je 0x180027aec
mov rsi, qword [rsi + 0x18]
movss xmm14, dword [0x180198998]
lea r12, [0x180000000]
movsd xmm15, qword [0x1801989d0]
xor r14d, r14d
movaps xmmword [rsp + 0x170], xmm10
xor r15d, r15d
movaps xmmword [rsp + 0x160], xmm11
mov r13d, 0x8001
movaps xmmword [rsp + 0x150], xmm12
movaps xmmword [rsp + 0x140], xmm13
test rsi, rsi
jne 0x180027b3e
xor ecx, ecx
jmp 0x180027b45
mov rcx, qword [rsi + 0x108]
movsxd rax, r14d
cmp rax, rcx
jae 0x180027f46
test rsi, rsi
je 0x180027f3a
mov rax, qword [rsi + 0x100]
test rax, rax
je 0x180027f3a
mov rcx, qword [r15 + rax]
test rcx, rcx
je 0x180027f3a
test rdi, rdi
jne 0x180027b87
xorps xmm2, xmm2
xorps xmm4, xmm4
xorps xmm3, xmm3
jmp 0x180027ba1
movsd xmm3, qword [rdi + 0x90]
movss xmm4, dword [rdi + 0x98]
movaps xmm0, xmm3
shufps xmm0, xmm0, 0x55
movaps xmm2, xmm0
movsd xmm1, qword [rcx + 0x90]
subss xmm4, dword [rcx + 0x98]
movaps xmm0, xmm1
subss xmm3, xmm1
shufps xmm0, xmm0, 0x55
subss xmm2, xmm0
xorps xmm0, xmm0
mulss xmm4, xmm4
mulss xmm3, xmm3
mulss xmm2, xmm2
addss xmm2, xmm3
addss xmm2, xmm4
ucomiss xmm0, xmm2
ja 0x180027be5
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x180027bed
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
xorps xmm1, xmm1
cvtss2sd xmm1, xmm0
movd xmm0, dword [0x180229410]
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
jb 0x180027f3a
call fcn.18003f370
movss xmm10, dword [rax + 8]
movss xmm6, dword [rax + 0xc]
mulss xmm10, xmm14
mulss xmm6, xmm14
call fcn.180027420
mov rbx, rax
test rax, rax
je 0x180027f46
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov rdx, rax
call fcn.180027260
movsxd rax, dword [0x18022c72c]
cmp eax, 6
ja case.default.0x180027c5f
mov edx, dword [r12 + rax*4 + 0x27ff8]
add rdx, r12
jmp rdx
xor r8d, r8d
lea rcx, [rbp - 0x40]
mov rdx, rbx
call fcn.180027260
movss xmm7, dword [rbp - 0x38]
movss xmm8, dword [rbp - 0x40]
movss xmm9, dword [rbp - 0x3c]
movss dword [rbp - 0x78], xmm7
jmp 0x180027da5
mov r8d, 7
lea rcx, [rbp - 0x34]
mov rdx, rbx
call fcn.180027260
movss xmm7, dword [rbp - 0x2c]
movss xmm8, dword [rbp - 0x34]
movss xmm9, dword [rbp - 0x30]
movss dword [rbp - 0x78], xmm7
jmp 0x180027da5
mov r8d, 8
lea rcx, [rbp - 0x28]
mov rdx, rbx
call fcn.180027260
movss xmm7, dword [rbp - 0x20]
movss xmm8, dword [rbp - 0x28]
movss xmm9, dword [rbp - 0x24]
movss dword [rbp - 0x78], xmm7
jmp 0x180027da5
mov r8d, 1
lea rcx, [rbp - 0x70]
mov rdx, rbx
call fcn.180027260
movss xmm7, dword [rbp - 0x68]
movss xmm8, dword [rbp - 0x70]
movss xmm9, dword [rbp - 0x6c]
movss dword [rbp - 0x78], xmm7
jmp 0x180027da5
mov r8d, 2
lea rcx, [rbp - 0x60]
mov rdx, rbx
call fcn.180027260
movss xmm7, dword [rbp - 0x58]
movss xmm8, dword [rbp - 0x60]
movss xmm9, dword [rbp - 0x5c]
movss dword [rbp - 0x78], xmm7
jmp 0x180027da5
mov r8d, 5
lea rcx, [rbp - 0x50]
mov rdx, rbx
call fcn.180027260
movss xmm7, dword [rbp - 0x48]
movss xmm8, dword [rbp - 0x50]
movss xmm9, dword [rbp - 0x4c]
movss dword [rbp - 0x78], xmm7
jmp 0x180027da5
mov r8d, 6
lea rcx, [rsp + 0x70]
mov rdx, rbx
call fcn.180027260
movss xmm7, dword [rsp + 0x78]
movss xmm8, dword [rsp + 0x70]
movss xmm9, dword [rsp + 0x74]
movss dword [rbp - 0x78], xmm7
jmp 0x180027da5
movss xmm7, dword [rbp - 0x78]
movss xmm9, dword [rbp - 0x7c]
movss xmm8, dword [rbp - 0x80]
movaps xmm0, xmm8
movss dword [rbp - 8], xmm7
unpcklps xmm0, xmm9
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xf0]
movsd qword [rbp - 0x80], xmm0
movsd qword [rbp - 0x10], xmm0
call fcn.18002e4e0
test rdi, rdi
jne 0x180027ddf
xorps xmm11, xmm11
xorps xmm12, xmm12
xorps xmm13, xmm13
jmp 0x180027e06
movsd xmm1, qword [rdi + 0x90]
movss xmm13, dword [rdi + 0x98]
movaps xmm0, xmm1
shufps xmm0, xmm0, 0x55
movsd qword [rbp], xmm1
movaps xmm12, xmm0
movss xmm11, dword [rbp]
movss xmm0, dword [rbp + 0xf4]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movaps xmm1, xmm15
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm6, xmm0
movss xmm0, dword [rbp + 0xf0]
cvtps2pd xmm1, xmm10
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movaps xmm1, xmm15
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm6, xmm0
xorps xmm1, xmm1
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
ucomiss xmm1, xmm0
ja 0x180027e59
sqrtss xmm0, xmm0
jmp 0x180027e5e
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [reloc.WLDAP32.dll_Ordinal_30]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x180027f3a
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test r13w, ax
je 0x180027f3a
movd xmm6, dword [reloc.WS2_32.dll_sendto]
mov edx, 0xffffffff
movabs rcx, 0x43a66c31c68491c0
cvtdq2ps xmm6, xmm6
call fcn.18001bd40
mov edx, 0xffffffff
movabs rcx, 0x43a66c31c68491c0
mov ebx, eax
call fcn.18001bd40
mov edx, eax
movabs rcx, 0xa6db4965674d243
call fcn.18001bd40
movss dword [rsp + 0x68], xmm6
movaps xmm2, xmm12
mov dword [rsp + 0x60], 1
movaps xmm1, xmm11
mov dword [rsp + 0x58], 1
movabs rcx, 0x867654cbc7606f2c
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov eax, dword [reloc.WS2_32.dll_getpeername]
mov dword [rsp + 0x40], eax
mov eax, dword [reloc.WS2_32.dll_ioctlsocket]
mov dword [rsp + 0x38], eax
cvtps2pd xmm0, xmm13
movss dword [rsp + 0x30], xmm7
addsd xmm0, qword [0x1801989b0]
movss dword [rsp + 0x28], xmm9
movss dword [rsp + 0x20], xmm8
cvtpd2ps xmm3, xmm0
call fcn.18001d200
inc r14d
add r15, 0x10
jmp 0x180027b35
movaps xmm11, xmmword [rsp + 0x160]
movaps xmm13, xmmword [rsp + 0x140]
movaps xmm12, xmmword [rsp + 0x150]
movaps xmm10, xmmword [rsp + 0x170]
movaps xmm14, xmmword [rsp + 0x130]
mov rsi, qword [rsp + 0x200]
mov r13, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1c8]
mov r15, qword [rsp + 0x1c0]
movaps xmm15, xmmword [rsp + 0x120]
movaps xmm6, xmmword [rsp + 0x1b0]
movaps xmm7, xmmword [rsp + 0x1a0]
mov r12, qword [rsp + 0x1d8]
movaps xmm8, xmmword [rsp + 0x190]
movaps xmm9, xmmword [rsp + 0x180]
mov rbx, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x208]
add rsp, 0x1e0
pop rbp
ret