Function at 0x18011bc50
Capabilities:
Encode data using base64
Encode data using xor
Hash data using fnv
Log keystrokes

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0xe0
vmovaps xmmword [rax - 0x38], xmm6
vmovaps xmmword [rax - 0x48], xmm7
vmovaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x180279b80]
xor rax, rsp
mov qword [rsp + 0xa8], rax
movzx ebx, r9w
movzx edi, dx
mov rsi, rcx
mov qword [rsp + 0x88], rcx
xor r15d, r15d
movzx r9d, r8w
mov r14d, 0x100
cmp dx, r14w
jne 0x18011bf92
mov edx, r9d
movzx ecx, r9b
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
mov eax, r9d
shr rax, 8
xor rcx, rax
imul rcx, r8
mov eax, r9d
shr rax, 0x10
xor rcx, rax
imul rcx, r8
mov eax, r9d
shr rax, 0x18
xor rcx, rax
imul rcx, r8
and rcx, qword [0x180b601d0]
shl rcx, 4
add rcx, qword [0x180b601b8]
mov rax, qword [rcx + 8]
mov r8, qword [0x180b601a8]
cmp rax, r8
je 0x18011bd31
mov rcx, qword [rcx]
cmp edx, dword [rax + 0x10]
je 0x18011bd34
cmp rax, rcx
je 0x18011bd31
mov rax, qword [rax + 8]
cmp edx, dword [rax + 0x10]
jne 0x18011bd21
jmp 0x18011bd34
mov rax, r15
test rax, rax
je 0x18011bd6c
cmp rax, r8
je 0x18011bd6c
mov dword [rsp + 0x88], r9d
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0x68]
call fcn.18011f480
mov rdx, qword [rax]
add rdx, 0x18
mov rcx, rsi
call fcn.18000d770
jmp 0x18011c355
mov r8, r14
xor edx, edx
lea rcx, [0x180b609b0]
call fcn.1801ff190
xor eax, eax
mov qword [rsp + 0x98], rax
mov word [rsp + 0xa0], ax
lea edx, [rax + 3]
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x98]
lea r8, [0x180b609b0]
mov edx, ebx
mov ecx, eax
call qword [sym.imp.USER32.dll_ToUnicode]
mov ebx, eax
test eax, eax
jns 0x18011bde6
movzx ecx, word [rsp + 0x98]
test cx, cx
je 0x18011beda
call fcn.1801dc91c
test eax, eax
jne 0x18011beda
neg ebx
mov r8, r14
xor edx, edx
lea rcx, [0x180b609b0]
call fcn.1801ff190
xor edx, edx
lea ecx, [rdx + 0x6e]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
xor eax, eax
mov qword [rsp + 0x88], rax
mov word [rsp + 0x90], ax
nop word [rax + rax]
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x88]
lea r8, [0x180b609b0]
mov edx, edi
mov ecx, WSAGetLastError
call qword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
js 0x18011be20
test ebx, ebx
jle 0x18011beda
cmp ebx, 1
jne 0x18011be6b
movzx ecx, word [rsp + 0x98]
call fcn.1801dc91c
test eax, eax
jne 0x18011beda
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov rbx, 0xffffffffffffffff
mov r9d, ebx
lea r8, [rsp + 0x98]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd r14, eax
vpxor xmm0, xmm0, xmm0
test eax, eax
jle 0x18011bede
vmovups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], r15b
mov rdi, r14
sub rdi, 1
jne 0x18011bef6
mov qword [rsp + 0x78], rdi
mov byte [rsp + rdi + 0x68], dil
jmp 0x18011bf2d
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], r15b
jmp 0x18011c355
lea rcx, [rsp + 0x68]
cmp rdi, 0xf
ja 0x18011bf17
mov qword [rsp + 0x78], rdi
mov r8, rdi
xor edx, edx
call fcn.1801ff190
mov byte [rsp + rdi + 0x68], 0
jmp 0x18011bf2d
mov byte [rsp + 0x20], 0
mov r9, rdi
movzx r8d, byte [rsp + 0x40]
mov rdx, rdi
call fcn.180026aa0
lea rax, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rsp + 0x98]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
vmovups ymm0, ymmword [rsp + 0x68]
vmovups ymmword [rsi], ymm0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
jmp 0x18011c348
mov edx, r9d
lea rcx, [rsp + 0x48]
call fcn.1800067e0
nop
vmovsd xmm0, qword [str.xQLUX_]
vmovsd qword [rsp + 0x88], xmm0
movzx ecx, word [0x180248060]
mov word [rsp + 0x90], cx
cmp byte [reloc.WLDAP32.dll_Ordinal_60], 0
je 0x18011c019
mov byte [rsp + 0x88], Ordinal_79
xor byte [rsp + 0x89], 0x34
xor byte [rsp + 0x8a], 0x35
xor byte [rsp + 0x8b], 0x36
xor byte [rsp + 0x8c], 0x37
xor byte [rsp + 0x8d], 0x38
xor byte [rsp + 0x8e], 0x39
xor byte [rsp + 0x8f], 0x3a
xor byte [rsp + 0x90], 0x3b
xor byte [rsp + 0x91], 0x3c
lea rcx, [rsp + 0x88]
mov rbx, 0xffffffffffffffff
mov r9, rbx
nop dword [rax + rax]
inc r9
cmp byte [rcx + r9], 0
jne 0x18011c030
lea r8, [rsp + 0x88]
xor edx, edx
mov rcx, rax
call fcn.180009ec0
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], r15
vmovups ymm0, ymmword [rax]
vmovups ymmword [rsp + 0x68], ymm0
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x48]
vzeroupper
call fcn.180005050
mov eax, 0x204
cmp di, ax
jne 0x18011c224
vmovsd xmm0, qword [0x1802482c0]
vmovsd qword [rsp + 0x88], xmm0
mov eax, dword [0x1802482c8]
mov dword [rsp + 0x90], eax
cmp byte [0x1802482cb], 0
je 0x18011c1c9
vmovdqu xmm6, xmmword [0x1802498c0]
vmovdqu xmm5, xmmword [0x1802493c0]
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 4
vpsrld xmm1, xmm4, 0x1f
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x180249420]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm0, xmm3, xmmword [0x180249360]
vpaddb xmm2, xmm0, xmmword [0x180249580]
vmovd xmm0, dword [0x1802482c0]
vpxor xmm1, xmm2, xmm0
vmovd dword [rsp + 0x88], xmm1
vmovdqu xmm5, xmmword [0x180249400]
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, 4
vpsrld xmm1, xmm4, 0x1f
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x180249420]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm0, xmm3, xmmword [0x180249360]
vpaddb xmm2, xmm0, xmmword [0x180249580]
vmovd xmm1, dword [rsp + 0x8c]
vpxor xmm0, xmm2, xmm1
vmovd dword [rsp + 0x8c], xmm0
mov r8d, 8
lea r9, [rsp + 0x90]
nop dword [rax]
mov eax, 0x51eb851f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
movzx eax, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xc
jl 0x18011c1a0
lea rax, [rsp + 0x88]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18011c1d1
mov rax, qword [rsp + 0x80]
cmp rbx, rax
ja 0x18011c217
lea rdi, [rsp + 0x68]
cmp rax, 0xf
cmova rdi, qword [rsp + 0x68]
mov qword [rsp + 0x78], rbx
mov r8, rbx
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.1801feaf0
mov byte [rdi + rbx], 0
jmp 0x18011c328
lea r9, [rsp + 0x88]
jmp 0x18011c31b
mov eax, 0x207
cmp di, ax
jne 0x18011c328
vmovsd xmm0, qword [str._QR__]
vmovsd qword [rsp + 0x88], xmm0
mov eax, dword [0x180248338]
mov dword [rsp + 0x90], eax
movzx ecx, byte [0x18024833c]
mov byte [rsp + 0x88], Ordinal_79
xor byte [rsp + 0x89], 0x34
xor byte [rsp + 0x8a], 0x35
xor byte [rsp + 0x8b], 0x36
xor byte [rsp + 0x8c], 0x37
xor byte [rsp + 0x8d], 0x38
xor byte [rsp + 0x8e], 0x39
xor byte [rsp + 0x8f], 0x3a
xor al, 0x3b
mov byte [rsp + 0x90], al
xor byte [rsp + 0x91], 0x3c
xor byte [rsp + 0x92], 0x3d
xor byte [rsp + 0x93], 0x3e
xor cl, 0x3f
mov byte [rsp + 0x94], cl
lea rax, [rsp + 0x88]
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18011c2d0
mov rax, qword [rsp + 0x80]
cmp rbx, rax
ja 0x18011c313
lea rdi, [rsp + 0x68]
cmp rax, 0xf
cmova rdi, qword [rsp + 0x68]
mov qword [rsp + 0x78], rbx
mov r8, rbx
lea rdx, [rsp + 0x88]
mov rcx, rdi
call fcn.1801feaf0
mov byte [rdi + rbx], 0
jmp 0x18011c328
lea r9, [rsp + 0x88]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.180005220
vmovups ymm0, ymmword [rsp + 0x68]
vmovups ymmword [rsi], ymm0
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x80], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x68], 0
lea rcx, [rsp + 0x68]
vzeroupper
call fcn.180005050
mov rax, rsi
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.1801be920
lea r11, [rsp + 0xe0]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret