Function at 0x140034560
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xf8]
sub rsp, 0x1c0
vmovaps xmmword [rax - 0x48], xmm6
vmovaps xmmword [rax - 0x58], xmm7
vmovaps xmmword [rax - 0x68], xmm8
vmovaps xmmword [rax - 0x78], xmm9
vmovaps xmmword [rax - 0x88], xmm10
vmovaps xmmword [rax - 0x98], xmm11
vmovaps xmmword [rax - 0xa8], xmm12
vmovaps xmmword [rax - 0xb8], xmm13
vmovaps xmmword [rax - 0xc8], xmm14
vmovaps xmmword [rax - 0xd8], xmm15
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
vmovsd xmm14, qword [0x14011cef8]
vmovss xmm13, dword [0x14011cd50]
vmovss xmm15, dword [0x14011ce44]
xor r12d, r12d
lea r14, [r15 + 0x160]
movabs r13, 0xb2f4fc0794908cf3
vxorps xmm12, xmm12, xmm12
movabs rsi, 0x431bde82d7b634db
cmp qword [r15 + 0xc8], r12
je 0x140034616
mov rcx, r15
call fcn.1400341a0
cmp byte [0x14012f0e8], r12b
mov rdi, rax
je 0x140034866
mov rcx, qword [r15 + 0xd8]
lea rax, [rbp + 0x110]
add rcx, 0x18e8
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], rcx
lea r8, [rsp + 0x40]
mov rcx, qword [0x1401d54a8]
mov r9d, 0x28
mov qword [rsp + 0x50], rax
mov edx, 0x226c78
mov eax, dword [0x1401d54b0]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rbp + 0x110], r12
mov dword [rsp + 0x62], r12d
mov word [rsp + 0x66], r12w
mov dword [rsp + 0x40], 0x7f1e8b
mov qword [rsp + 0x58], 8
mov dword [rsp + 0x44], eax
mov word [rsp + 0x60], 0x100
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp qword [rbp + 0x110], r12
je 0x140034866
cmp byte [0x1401d54e8], r12b
je 0x1400346ee
lea rcx, [rbp + 0x118]
call fcn.140031a00
mov byte [0x1401d54e8], r12b
mov rcx, qword [rax]
mov qword [0x1401d54d8], rcx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x14003470f
imul rcx, rcx, 0x64
jmp 0x14003477b
cmp rbx, 0x16e3600
jne 0x14003475a
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
jmp 0x140034771
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
mov qword [0x1401d54e0], rcx
mov rax, rsi
sub rcx, qword [0x1401d54d8]
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x1401d5664], edx
test rdi, rdi
je 0x140034866
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, edx
vcomiss xmm0, dword [0x1401d52f8]
jb 0x140034866
cmp byte [0x1401d53d0], r12b
jne 0x1400347e0
mov ecx, dword [0x1401d53ec]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140034866
movzx esi, byte [0x14012f0f5]
movzx ebx, byte [0x14012f0fd]
test sil, sil
je 0x14003480d
mov rcx, r14
call fcn.1400336f0
cmp rax, 0xffffffffffffffff
je 0x14003480d
call fcn.140002090
mov byte [0x1401d54e8], 1
test bl, bl
je 0x140034851
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x14003481e
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140034851
lea rcx, [rbp + 0x110]
mov qword [rbp + 0x110], 0x3e8
call fcn.140033a30
call fcn.140002090
mov byte [0x1401d54e8], 1
test sil, sil
jne 0x140034866
test bl, bl
jne 0x140034866
call fcn.140002090
mov byte [0x1401d54e8], 1
cmp byte [0x14012f0f4], r12b
je 0x140034cfa
test rdi, rdi
je 0x140034cfa
mov ecx, dword [0x1401d53e8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140034cfa
cmp byte [0x1401d53d8], r12b
mov rbx, qword [rdi]
mov rsi, qword [rdi + 8]
mov rdi, qword [rdi + 0x18]
mov ecx, dword [0x1401d54d0]
je 0x1400348c6
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, r12d
jmp 0x14003490c
test ecx, ecx
je 0x140034906
sub ecx, 1
je 0x1400348fe
sub ecx, 1
je 0x1400348f6
sub ecx, 1
je 0x1400348ee
cmp ecx, 1
jne 0x1400348e9
mov eax, 0x25
sub rax, 1
jne 0x1400348e3
mov r9d, r12d
jmp 0x14003490c
mov r9d, 2
jmp 0x14003490c
mov r9d, 0x42
jmp 0x14003490c
mov r9d, 0x43
jmp 0x14003490c
mov r9d, 0x6e
mov r8, rdi
lea rdx, [rbp - 0x60]
mov rcx, rsi
call fcn.140031c90
vmovsd xmm6, qword [rbp + 0x10]
vmovsd xmm7, qword [rbp]
vmovsd xmm8, qword [rbp + 8]
mov rcx, rbx
vmovsd qword [rbp - 0x68], xmm6
call fcn.140034110
mov rcx, qword [0x1401d54a8]
lea r8, [rsp + 0x40]
add rax, 0x168
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], rax
mov r9d, 0x28
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r12
vxorpd xmm0, xmm0, xmm0
mov qword [rsp + 0x50], rax
mov edx, 0x226c78
mov eax, dword [0x1401d54b0]
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x44], eax
vmovsd qword [rbp - 0x80], xmm0
vmovupd xmmword [rsp + 0x70], xmm0
mov dword [rsp + 0x62], r12d
mov word [rsp + 0x66], r12w
mov dword [rsp + 0x40], 0x7f1e8b
mov qword [rsp + 0x58], 0x18
mov word [rsp + 0x60], 0x100
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
vsubsd xmm0, xmm7, qword [0x1401d4738]
vsubsd xmm1, xmm8, qword [0x1401d4740]
vsubsd xmm2, xmm6, qword [0x1401d4748]
vmulsd xmm3, xmm0, xmm0
vfmadd231sd xmm3, xmm1, xmm1
vfmadd231sd xmm3, xmm2, xmm2
vsqrtsd xmm0, xmm3, xmm3
vmulsd xmm10, xmm0, qword [0x14011ce48]
mov rcx, rbx
call fcn.140031f10
mov rbx, rax
lea rcx, [rax + 0x1f64]
call fcn.1400315b0
lea rcx, [rbx + 0x1f60]
vmovaps xmm11, xmm0
call fcn.1400315b0
cmp byte [0x14012f0fc], r12b
vmovaps xmm9, xmm0
je 0x140034b0e
mov r9d, 0x6e
lea rdx, [rbp - 0x60]
mov r8, rdi
mov rcx, rsi
call fcn.140031c90
cmp byte [0x1401d5453], r12b
vmovsd xmm6, qword [rbp + 0x10]
vmovsd xmm7, qword [rbp]
vmovsd xmm8, qword [rbp + 8]
vmovsd qword [rbp - 0x68], xmm6
je 0x140034a91
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140034a62
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140034b0e
cmp byte [0x1401d54e9], r12b
je 0x140034a98
vmovss xmm0, dword [0x14011ce98]
vmovss dword [0x14012f390], xmm0
jmp 0x140034a98
vucomiss xmm9, xmm12
je 0x140034b0e
vxorps xmm0, xmm0, xmm0
vmovss xmm1, xmm0, xmm9
vandps xmm2, xmm1, xmmword [0x14011d380]
vcvtss2sd xmm0, xmm2, xmm2
vdivsd xmm1, xmm10, xmm0
vcvtsd2ss xmm4, xmm1, xmm1
vmulss xmm1, xmm11, dword [0x14011d0a0]
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rsp + 0x70]
vmulsd xmm2, xmm3, qword [rsp + 0x78]
vfmadd231sd xmm7, xmm0, xmm14
vxorps xmm0, xmm0, xmm0
vmovss xmm1, xmm0, xmm1
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm8, xmm2, xmm14
vandps xmm2, xmm1, xmmword [0x14011d380]
vmovaps xmm3, xmm6
vfmadd231sd xmm3, xmm0, xmm14
vmulss xmm0, xmm2, xmm4
vmulss xmm1, xmm0, dword [0x14011cf50]
vcvtss2sd xmm2, xmm1, xmm1
vaddsd xmm3, xmm3, xmm2
vmovsd qword [rbp - 0x68], xmm3
vunpcklpd xmm0, xmm7, xmm8
vmovups xmmword [rsp + 0x40], xmm0
vmovsd xmm0, qword [rbp - 0x68]
lea r8, [rbp + 0x108]
lea rdx, [rsp + 0x40]
vmovsd qword [rsp + 0x50], xmm0
vmovss dword [rbp + 0x108], xmm12
vmovss dword [rbp + 0x10c], xmm12
call fcn.140035cc0
test al, al
je 0x140034cfa
vmovss xmm0, dword [rbp + 0x108]
vucomiss xmm0, xmm12
vmovss xmm4, dword [0x14012f390]
vmovss xmm1, dword [0x1401d548c]
vmovss xmm2, dword [0x1401d5488]
vmovaps xmm7, xmm12
vmovaps xmm6, xmm12
je 0x140034ba0
vsubss xmm0, xmm0, xmm1
vdivss xmm7, xmm0, xmm4
vaddss xmm3, xmm7, xmm1
vaddss xmm1, xmm1, xmm1
vcomiss xmm3, xmm1
ja 0x140034b9b
vcomiss xmm3, xmm12
jae 0x140034ba0
vmovaps xmm7, xmm12
vmovss xmm0, dword [rbp + 0x10c]
vucomiss xmm0, xmm12
je 0x140034bd1
vsubss xmm1, xmm0, xmm2
vdivss xmm6, xmm1, xmm4
vaddss xmm3, xmm6, xmm2
vaddss xmm0, xmm2, xmm2
vcomiss xmm3, xmm0
ja 0x140034bcc
vcomiss xmm3, xmm12
jae 0x140034bd1
vmovaps xmm6, xmm12
cmp byte [0x1401d53c8], r12b
jne 0x140034cfa
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
vmulss xmm1, xmm0, xmm13
vfmadd231ss xmm1, xmm0, xmm13
vaddss xmm0, xmm1, xmm7
vsubss xmm7, xmm0, xmm15
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
mov rax, qword [0x1401d5300]
vmulss xmm1, xmm0, xmm13
vfmadd231ss xmm1, xmm0, xmm13
vaddss xmm0, xmm1, xmm6
vsubss xmm2, xmm0, xmm15
test rax, rax
jne 0x140034ce3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140034cc4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140034cc4
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140034cbf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140034ca0
cmp edx, 0x20785c9b
je 0x140034d16
test r8d, r8d
jne 0x140034c80
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140034cd9
cmp qword [rax + 0x30], r12
jne 0x140034c50
mov rax, r12
mov qword [0x1401d5300], rax
vcvttss2si r8d, xmm2
vcvttss2si edx, xmm7
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov ecx, 1
call rax
lea rcx, [rbp + 0x110]
mov qword [rbp + 0x110], 1
call fcn.140033a30
jmp 0x14003460c
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140034cdc