Function at 0x180049060
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0x100
movaps xmmword [rsp + 0xa0], xmm11
mov rax, qword [0x1800dd080]
xor rax, rsp
mov qword [rbp - 0x49], rax
mov rax, qword [0x1800de960]
mov rdx, qword [0x1800de880]
mov rcx, qword [rax + 0x10]
cmp byte [rdx + 0x168], 0
mov rdi, qword [rcx]
je 0x180049102
test rdi, rdi
je 0x180049102
mov r8, qword [rdi + 8]
test r8, r8
je 0x180049102
mov rax, qword [0x1800de950]
mov rcx, qword [rax + 0x68]
mov rax, qword [r8 + rcx]
test rax, rax
je 0x180049102
mov rax, qword [rax + 0x30]
test rax, rax
je 0x180049102
mov rax, qword [rax + 0x10]
test rax, rax
je 0x180049102
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x180049102
mov rax, qword [rcx + 0x70]
test rax, rax
je 0x180049102
mov rax, qword [rax]
test rax, rax
je 0x180049102
mov dword [rax + 0x2c], 0xbf800000
mov rdx, qword [0x1800de880]
cmp byte [rdx + 0x170], 0
mov qword [rsp + 0x120], rbx
mov qword [rsp + 0x128], rsi
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0xe0], xmm7
movaps xmmword [rsp + 0xd0], xmm8
je 0x18004922d
call fcn.180048db0
mov rsi, rax
test rax, rax
je 0x180049226
mov rcx, qword [0x1800de880]
mov ecx, dword [rcx + 0x164]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180049226
mov rcx, qword [0x1800de960]
mov rax, qword [rcx + 0x30]
test rax, rax
je 0x18004917a
mov rax, qword [rax]
jmp 0x18004917e
mov rax, qword [rbp - 0x79]
movsd xmm0, qword [rax + 0x3d0]
movsd xmm2, qword [rax + 0x60]
movaps xmm6, xmm0
movss xmm1, dword [0x1800cfb88]
movaps xmm7, xmm0
movss xmm8, dword [rax + 0x3d8]
mov rbx, qword [rcx + 0x50]
movsd qword [rbp - 0x79], xmm0
movaps xmm0, xmm2
shufps xmm6, xmm6, 0x55
mulss xmm8, xmm1
mulss xmm6, xmm1
addss xmm8, dword [rax + 0x68]
mov rax, qword [rcx + 0x60]
mov rcx, rsi
mulss xmm7, xmm1
shufps xmm0, xmm0, 0x55
addss xmm6, xmm0
movsd qword [rbp - 0x79], xmm2
addss xmm7, xmm2
call rax
mov ecx, eax
call rbx
mov rax, qword [rsi + 0x30]
xorps xmm0, xmm0
test rax, rax
je 0x1800491f3
movups xmmword [rax + 0x30], xmm0
movss dword [rsi + 0x90], xmm7
movss dword [rsi + 0x94], xmm6
movss dword [rsi + 0x98], xmm8
mov rcx, qword [rsi + 0x30]
test rcx, rcx
je 0x180049226
movaps xmm0, xmm7
unpcklps xmm0, xmm6
movsd qword [rcx + 0x50], xmm0
movss dword [rcx + 0x58], xmm8
mov rdx, qword [0x1800de880]
cmp byte [rdx + 0x169], 0
je 0x18004927c
test rdi, rdi
je 0x18004927c
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18004927c
mov r8, qword [0x1800de950]
mov rax, qword [r8 + 0x68]
mov rcx, qword [rcx + rax]
test rcx, rcx
je 0x18004927c
mov rax, qword [r8 + 0x20]
mov rcx, qword [rcx + rax]
test rcx, rcx
je 0x18004927c
movd xmm0, dword [rdx + 0x174]
cvtdq2ps xmm0, xmm0
movss dword [rcx + 0x4c], xmm0
mov rdx, qword [0x1800de880]
cmp byte [rdx + 0x16a], 0
je 0x1800492c1
test rdi, rdi
je 0x1800492c1
mov r8, qword [rdi + 8]
test r8, r8
je 0x1800492c1
mov rax, qword [0x1800de950]
mov rcx, qword [rax + 0x68]
mov rax, qword [r8 + rcx]
test rax, rax
je 0x1800492c1
movd xmm0, dword [rdx + 0x174]
cvtdq2ps xmm0, xmm0
movss dword [rax + 0xc3c], xmm0
mov rdx, qword [0x1800de880]
xor r15d, r15d
mov qword [rsp + 0x130], r14
cmp byte [rdx + 0x185], r15b
je 0x1800496bd
mov rax, qword [0x1800ddd40]
movsd xmm0, qword [str.gPFVFXWES9]
movsd qword [rbp - 0x79], xmm0
or dword [rax + 0x4790], 1
cmp byte [reloc.WS2_32.dll_gethostname], r15b
mov dword [rax + 0x47a0], 0x41a00000
mov qword [rax + 0x47a4], 0x42700000
mov dword [rax + 0x47ac], r15d
mov dword [rax + 0x4794], 1
movzx eax, word [0x1800cefd8]
mov word [rbp - 0x71], ax
je 0x180049356
xor byte [rbp - 0x78], 0x31
xor byte [rbp - 0x77], 0x32
xor byte [rbp - 0x76], 0x33
xor byte [rbp - 0x75], 0x34
xor byte [rbp - 0x74], 0x35
xor byte [rbp - 0x73], 0x36
xor byte [rbp - 0x72], 0x37
xor byte [rbp - 0x71], 0x38
xor byte [rbp - 0x70], 0x39
mov byte [rbp - 0x79], 0x57
xor edx, edx
lea rcx, [rbp - 0x79]
mov r8d, 0x87
call fcn.18000fce0
test al, al
je 0x1800496b1
cmp byte [0x1800cefcd], r15b
mov esi, reloc.WLDAP32.dll_Ordinal_26
movaps xmm0, xmmword [0x1800cffe0]
mov eax, dword [0x1800cefc8]
mov ebx, dword [reloc.WS2_32.dll_accept]
movups xmmword [rbp - 0x59], xmm0
lea r14d, [rsi + 5]
mov dword [rbp - 0x71], eax
movsd xmm0, qword [0x1800cefc0]
movzx eax, word [0x1800cefcc]
movsd qword [rbp - 0x79], xmm0
mov word [rbp - 0x6d], ax
je 0x180049514
mov r8d, r15d
cmp ebx, 2
jl 0x1800494c9
movdqa xmm2, xmmword [0x1800cfd20]
mov r8d, 8
movdqa xmm3, xmmword [0x1800cfd40]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x1800d0080]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, esi
movd xmm5, r14d
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800cfda0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1800cefc0]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800cfd90]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800cfe60]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x79], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800cfda0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x75]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800cfd90]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1800cfe60]
xorps xmm2, xmm0
movd dword [rbp - 0x75], xmm2
movsxd rax, r8d
lea r9, [rbp - 0x79]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8b6e9cf9
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x74
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0xe
jl 0x1800494e0
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.180030c50
mov eax, dword [0x1800cefe8]
mov r8d, r15d
movsd xmm0, qword [str.rhbrgf]
mov dword [rbp - 0x71], eax
movzx eax, word [0x1800cefec]
mov word [rbp - 0x6d], ax
movzx eax, byte [0x1800cefee]
mov byte [rbp - 0x6b], al
movsd qword [rbp - 0x79], xmm0
cmp ebx, 2
jl 0x180049664
movdqa xmm2, xmmword [0x1800cfd20]
mov r8d, 8
movdqa xmm3, xmmword [0x1800cfd40]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x1800d0080]
movdqa xmm0, xmm2
mov eax, dword [0x1800cfe60]
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movd xmm6, esi
movd xmm5, r14d
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800cfda0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1800cfd90]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.rhbrgf]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp - 0x79], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1800cfda0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1800cfd90]
movd xmm1, dword [rbp - 0x75]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
xorps xmm2, xmm1
movd dword [rbp - 0x75], xmm2
movsxd rax, r8d
lea r9, [rbp - 0x79]
add r9, rax
nop
mov eax, 0x8b6e9cf9
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 0x1a
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x74
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0xf
jl 0x180049670
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x59]
call fcn.180030c50
call fcn.180012120
mov rdx, qword [0x1800de880]
cmp byte [rdx + 0x186], r15b
je 0x1800497b7
mov rax, qword [0x1800ddd40]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax + 0x4890]
mov rcx, qword [rcx]
call fcn.180009f20
movaps xmm0, xmmword [0x1800cffd0]
lea rcx, [rbp - 0x69]
movups xmmword [rbp - 0x69], xmm0
mov r10, rax
mov dword [rbp - 0x59], 0x44728000
mov dword [rbp - 0x55], 0x44070000
mov dword [rbp - 0x79], 0x446d8000
mov dword [rbp - 0x75], 0x44070000
call fcn.180006b20
movss xmm0, dword [0x1800cfab8]
lea r8, [rbp - 0x59]
mov r9d, eax
movss dword [rsp + 0x20], xmm0
lea rdx, [rbp - 0x79]
mov rcx, r10
call fcn.180028b90
mov rax, qword [0x1800ddd40]
lea r8, str.Background
xor edx, edx
mov rcx, qword [rax + 0x4890]
mov rcx, qword [rcx]
call fcn.180009f20
movaps xmm0, xmmword [0x1800cffd0]
lea rcx, [rbp - 0x69]
movups xmmword [rbp - 0x69], xmm0
mov r10, rax
mov dword [rbp - 0x79], 0x44700000
mov dword [rbp - 0x75], 0x44098000
mov dword [rbp - 0x59], 0x44700000
mov dword [rbp - 0x55], 0x44048000
call fcn.180006b20
movss xmm0, dword [0x1800cfab8]
lea r8, [rbp - 0x79]
mov r9d, eax
movss dword [rsp + 0x20], xmm0
lea rdx, [rbp - 0x59]
mov rcx, r10
call fcn.180028b90
mov rdx, qword [0x1800de880]
xorps xmm11, xmm11
cmp byte [rdx + 0x171], r15b
je 0x180049afd
mov ecx, dword [rdx + 0x120]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1800497ea
cmp byte [0x1800de1b3], r15b
sete al
mov byte [0x1800de1b3], al
jmp 0x1800497f1
movzx eax, byte [0x1800de1b3]
movaps xmmword [rsp + 0xc0], xmm9
test al, al
je 0x180049ab0
mov rax, qword [0x1800de960]
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x180049817
mov rbx, qword [rbx]
jmp 0x18004981b
mov rbx, qword [rbp - 0x79]
test rbx, rbx
je 0x180049aed
mov rcx, qword [0x1800de950]
lea rsi, [rdi + 8]
movaps xmmword [rsp + 0x90], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0xb0], xmm10
test rdi, rdi
je 0x1800498ef
mov rdx, qword [rsi]
test rdx, rdx
je 0x180049878
mov rax, qword [rcx + 0x68]
mov r8, qword [rdx + rax]
test r8, r8
je 0x180049878
mov dword [r8 + 0xc3c], r15d
mov rcx, qword [0x1800de950]
jmp 0x18004987d
test rdi, rdi
je 0x1800498ef
mov rdx, qword [rsi]
test rdx, rdx
je 0x1800498a9
mov rax, qword [rcx + 0x68]
mov r8, qword [rdx + rax]
test r8, r8
je 0x1800498a9
mov rax, qword [r8 + 0x30]
xorps xmm0, xmm0
test rax, rax
je 0x1800498a9
movups xmmword [rax + 0x30], xmm0
mov rcx, qword [0x1800de950]
test rdi, rdi
je 0x1800498ef
mov r14, qword [rsi]
test r14, r14
je 0x1800498ef
mov rax, qword [rcx + 0x68]
mov r14, qword [r14 + rax]
test r14, r14
je 0x1800498ef
movsd xmm9, qword [r14 + 0x90]
mov r14d, dword [r14 + 0x98]
movaps xmm10, xmm9
movsd qword [rbp - 0x79], xmm9
movss xmm8, dword [rbp - 0x79]
shufps xmm10, xmm10, 0x55
movd xmm7, r14d
jmp 0x18004990d
xorps xmm10, xmm10
xorps xmm9, xmm9
unpcklps xmm9, xmm10
xorps xmm7, xmm7
movsd qword [rbp - 0x79], xmm9
xorps xmm8, xmm8
movd r14d, xmm7
movsd xmm6, qword [rbx + 0x3d0]
mov ecx, 0x57
mov ebx, dword [rbx + 0x3d8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movaps xmm12, xmm6
movsd qword [rbp - 0x59], xmm6
movss xmm6, dword [rbp - 0x59]
movd xmm13, ebx
shufps xmm12, xmm12, 0x55
test ax, ax
jns 0x180049968
addss xmm8, xmm6
addss xmm10, xmm12
addss xmm7, xmm13
movaps xmm0, xmm8
unpcklps xmm0, xmm10
movaps xmm9, xmm0
movsd qword [rbp - 0x79], xmm0
movd r14d, xmm7
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18004999d
subss xmm8, xmm6
subss xmm10, xmm12
subss xmm7, xmm13
movaps xmm0, xmm8
unpcklps xmm0, xmm10
movaps xmm9, xmm0
movsd qword [rbp - 0x79], xmm0
movd r14d, xmm7
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm12, xmmword [rsp + 0x90]
movaps xmm10, xmmword [rsp + 0xb0]
test ax, ax
jns 0x1800499e4
movsd xmm1, qword [rbp - 0x79]
addss xmm8, dword [0x1800cfab8]
movss xmm1, xmm8
movsd qword [rbp - 0x79], xmm1
movaps xmm9, xmm1
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movss xmm6, dword [0x1800cfc88]
test ax, ax
jns 0x180049a14
movsd xmm1, qword [rbp - 0x79]
addss xmm8, xmm6
movss xmm1, xmm8
movsd qword [rbp - 0x79], xmm1
movaps xmm9, xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180049a31
addss xmm7, dword [0x1800cfab8]
movd r14d, xmm7
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x180049a4a
addss xmm7, xmm6
movd r14d, xmm7
test rdi, rdi
je 0x180049aed
mov rdx, qword [rsi]
test rdx, rdx
je 0x180049a7f
mov rax, qword [0x1800de950]
mov rcx, qword [rax + 0x68]
mov rax, qword [rdx + rcx]
test rax, rax
je 0x180049a7f
movsd qword [rax + 0x90], xmm9
mov dword [rax + 0x98], r14d
mov rdx, qword [rsi]
test rdx, rdx
je 0x180049aed
mov rax, qword [0x1800de950]
mov rcx, qword [rax + 0x68]
mov rax, qword [rdx + rcx]
test rax, rax
je 0x180049aed
mov rax, qword [rax + 0x30]
test rax, rax
je 0x180049aed
movsd qword [rax + 0x50], xmm9
mov dword [rax + 0x58], r14d
jmp 0x180049aed
test rdi, rdi
je 0x180049aed
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x180049aed
mov rax, qword [0x1800de950]
mov rcx, qword [rax + 0x68]
mov r8, qword [rdx + rcx]
test r8, r8
je 0x180049aed
mov rax, qword [0x1800de880]
movd xmm0, dword [rax + 0x174]
cvtdq2ps xmm0, xmm0
movss dword [r8 + 0xc3c], xmm0
mov rdx, qword [0x1800de880]
movaps xmm9, xmmword [rsp + 0xc0]
movaps xmm8, xmmword [rsp + 0xd0]
movaps xmm7, xmmword [rsp + 0xe0]
mov r14, qword [rsp + 0x130]
cmp byte [rdx + 0x172], r15b
je 0x180049c02
call fcn.180048db0
test rax, rax
jne 0x180049b3b
xorps xmm6, xmm6
movd esi, xmm11
unpcklps xmm6, xmm11
jmp 0x180049b49
movsd xmm6, qword [rax + 0x90]
mov esi, dword [rax + 0x98]
mov rax, qword [0x1800de960]
lea r8, [rbp - 0x55]
mov rbx, qword [0x1800ddd40]
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x79]
movsd qword [rbp - 0x79], xmm6
mov dword [rbp - 0x71], esi
mov qword [rbp - 0x59], r15
call qword [rax + gethostname]
movss xmm1, dword [rbp - 0x59]
lea rax, [rbp - 0x69]
mulss xmm1, dword [rbx + 0x10]
mov dword [rsp + 0x30], r15d
movss xmm2, dword [rbp - 0x55]
movaps xmm0, xmmword [0x1800cff60]
movss xmm3, dword [0x1800cfb40]
movss dword [rbp - 0x59], xmm1
mulss xmm2, dword [rbx + 0x14]
mov qword [rsp + 0x28], rax
movss dword [rsp + 0x20], xmm3
movaps xmmword [rbp - 0x69], xmm0
movss dword [rbp - 0x55], xmm2
call fcn.18004e5d0
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180049c02
test rdi, rdi
je 0x180049c02
mov rax, qword [rdi + 8]
test rax, rax
je 0x180049c02
movsd qword [rax + 0x90], xmm6
mov dword [rax + 0x98], esi
mov rax, qword [rdi + 8]
test rax, rax
je 0x180049c02
mov rcx, qword [rax + 0x30]
test rcx, rcx
je 0x180049c02
movsd qword [rcx + 0x50], xmm6
mov dword [rcx + 0x58], esi
movaps xmm6, xmmword [rsp + 0xf0]
mov rsi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x120]
mov rcx, qword [rbp - 0x49]
xor rcx, rsp
call fcn.18009a130
movaps xmm11, xmmword [rsp + 0xa0]
add rsp, 0x100
pop r15
pop rdi
pop rbp
ret