Function at 0x180004520
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xc0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx ebx, dl
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov ecx, ebx
xor esi, esi
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r14d, eax
cmp bl, 1
jne 0x18000462d
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x1800045ab
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800045d5
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800045f4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a68
mov rcx, rax
call fcn.18000ff0c
test rax, rax
je 0x180004a03
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180004601
test rcx, rcx
je 0x180004601
call fcn.18000ff0c
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x11
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Left_Mouse_Button]
movups xmmword [rsi], xmm0
movzx ecx, byte [0x180012360]
mov byte [rsi + 0x10], cl
mov byte [rsi + 0x11], 0
jmp 0x180004a37
cmp bl, 2
jne 0x1800046fa
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x180004677
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1800046a1
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1800046c0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a68
mov rcx, rax
call fcn.18000ff0c
test rax, rax
je 0x180004a03
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1800046cd
test rcx, rcx
je 0x1800046cd
call fcn.18000ff0c
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x12
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Right_Mouse_Button]
movups xmmword [rsi], xmm0
movzx eax, word [0x180012378]
mov word [rsi + 0x10], ax
mov byte [rsi + 0x12], 0
jmp 0x180004a37
cmp bl, 4
jne 0x1800047d1
xorps xmm0, xmm0
movabs rbx, 0x7fffffffffffffff
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov rax, rbx
mov qword [rdi + 0x18], 0xf
mov rdx, qword [rdi + 0x18]
mov rcx, rdx
shr rcx, 1
sub rax, rcx
cmp rdx, rax
jbe 0x180004744
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x18000476e
lea rax, [rcx + rdx]
mov ebx, 0x1f
cmp rax, rbx
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x18000478d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a68
mov rcx, rax
call fcn.18000ff0c
test rax, rax
je 0x180004a03
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x18000479a
test rcx, rcx
je 0x18000479a
call fcn.18000ff0c
mov rsi, rax
mov qword [rdi], rsi
mov qword [rdi + 0x10], 0x13
mov qword [rdi + 0x18], rbx
movups xmm0, xmmword [str.Middle_Mouse_Button]
movups xmmword [rsi], xmm0
movzx eax, word [0x180012390]
mov word [rsi + 0x10], ax
movzx eax, byte [0x180012392]
mov byte [rsi + 0x12], al
mov byte [rsi + 0x13], 0
jmp 0x180004a37
cmp bl, 5
jne 0x180004814
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_1]
movsd qword [rdi], xmm0
mov eax, dword [0x1800123a0]
mov dword [rdi + 8], eax
movzx eax, byte [0x1800123a4]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], sil
jmp 0x180004a37
cmp bl, 6
jne 0x180004857
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0xd
mov qword [rdi + 0x18], 0xf
movsd xmm0, qword [str.Side_Button_2]
movsd qword [rdi], xmm0
mov eax, dword [0x1800123b0]
mov dword [rdi + 8], eax
movzx eax, byte [0x1800123b4]
mov byte [rdi + 0xc], al
mov byte [rdi + 0xd], sil
jmp 0x180004a37
lea eax, [rbx - 0x21]
cmp eax, 0x84
ja case.0x18000487c.41
lea rdx, [0x180000000]
cdqe
movzx eax, byte [rdx + rax + 0x4a78]
mov ecx, dword [rdx + rax*4 + 0x4a70]
add rcx, rdx
jmp rcx
bts r14d, 8
mov rax, qword gs:[0x60]
shl r14d, 0x10
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebp, dword [rcx + r10 + 0x88]
add rbp, r10
cmp rbp, r10
je 0x180004917
mov r9d, dword [rbp + 0x18]
test r9d, r9d
je 0x180004917
mov ebx, dword [rbp + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1b19b769
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180004912
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800048f0
cmp r8d, 0xb793e61
je 0x18000491c
test r9d, r9d
jne 0x1800048d0
mov rax, qword [rax]
jmp 0x1800048a0
mov ecx, dword [rbp + 0x24]
mov r8d, 0x80
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbp + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x30]
add rax, r10
mov ecx, r14d
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r14, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop dword [rax]
inc r14
cmp byte [rax + r14], sil
jne 0x180004960
movabs rbx, 0x7fffffffffffffff
cmp r14, rbx
ja 0x180004a62
mov qword [rdi + 0x18], 0xf
cmp r14, 0xf
ja 0x1800049a7
mov r8, r14
mov qword [rdi + 0x10], r14
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], sil
jmp 0x180004a37
mov rax, r14
or rax, 0xf
cmp rax, rbx
jbe 0x1800049dc
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.18000ff0c
test rax, rax
je 0x180004a03
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x180004a17
mov ecx, 0x16
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180004a0a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004a68
jmp 0x1800049c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x180004a17
call fcn.18000ff0c
mov rsi, rax
mov r8, r14
mov qword [rdi], rsi
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x10], r14
mov rcx, rsi
mov qword [rdi + 0x18], rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + r14], 0
mov rax, rdi
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18000fc50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1800016a0
int3
call fcn.180001600
int3