Function at 0x140037a50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x210
vmovaps xmmword [rax - 0x48], xmm6
vmovaps xmmword [rax - 0x58], xmm7
vmovaps xmmword [rax - 0x68], xmm8
vmovaps xmmword [rax - 0x78], xmm9
vmovaps xmmword [rax - 0x88], xmm10
vmovaps xmmword [rax - 0x98], xmm11
vmovaps xmmword [rax - 0xa8], xmm12
vmovaps xmmword [rax - 0xb8], xmm13
vmovaps xmmword [rax - 0xc8], xmm14
vmovaps xmmword [rax - 0xd8], xmm15
mov r15, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
vmovss xmm15, dword [0x14019be08]
vmovsd xmm14, qword [0x14019be68]
vmovss xmm12, dword [0x14019bcc0]
vmovss xmm13, dword [0x14019bdb4]
xor r12d, r12d
lea r14, [r15 + 0x160]
movabs r13, 0xb2f4fc0794908cf3
vxorps xmm11, xmm11, xmm11
movabs rsi, 0x431bde82d7b634db
nop
cmp qword [r15 + 0xc8], r12
je 0x140037b10
mov rcx, r15
call fcn.1400376d0
cmp byte [reloc.WS2_32.dll_accept], r12b
mov rdi, rax
je 0x140037d7e
mov ecx, dword [0x14025ca88]
lea rax, [rbp + 0x160]
mov qword [rsp + 0x68], rax
xor r9d, r9d
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [0x14025ca28]
xor r8d, r8d
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
xor edx, edx
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x60], rcx
mov rcx, qword [r15 + 0xd8]
add rcx, 0x1898
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x58], rcx
mov rcx, qword [0x14025ce00]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x160], r12
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x70], 8
mov dword [rbp - 0x68], r12d
mov dword [rbp - 0x64], 4
call fcn.14008d640
cmp qword [rbp + 0x160], r12
je 0x140037d7e
cmp byte [0x14025d010], r12b
je 0x140037c06
lea rcx, [rbp + 0x168]
call fcn.140032980
mov byte [0x14025d010], r12b
mov rcx, qword [rax]
mov qword [0x14025d000], rcx
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x140037c27
imul rcx, rcx, 0x64
jmp 0x140037c93
cmp rbx, 0x16e3600
jne 0x140037c72
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
add rdx, rcx
sar rdx, 0x18
mov rcx, rdx
shr rcx, 0x3f
add rcx, rdx
jmp 0x140037c89
cqo
idiv rbx
mov r8, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rcx, rax
imul rax, r8, 0x3b9aca00
add rcx, rax
mov qword [0x14025d008], rcx
mov rax, rsi
sub rcx, qword [0x14025d000]
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov dword [0x14025d194], edx
test rdi, rdi
je 0x140037d7e
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, edx
vcomiss xmm0, dword [0x14025ce30]
jb 0x140037d7e
cmp byte [0x14025cf08], r12b
jne 0x140037cf8
mov ecx, dword [0x14025cf24]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140037d7e
movzx esi, byte [reloc.WS2_32.dll_accept]
movzx ebx, byte [reloc.WS2_32.dll_accept]
test sil, sil
je 0x140037d25
mov rcx, r14
call fcn.140034e10
cmp rax, 0xffffffffffffffff
je 0x140037d25
call fcn.140002e30
mov byte [0x14025d010], 1
test bl, bl
je 0x140037d69
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140037d36
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140037d69
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x160], 0x3e8
call fcn.1400351a0
call fcn.140002e30
mov byte [0x14025d010], 1
test sil, sil
jne 0x140037d7e
test bl, bl
jne 0x140037d7e
call fcn.140002e30
mov byte [0x14025d010], 1
cmp byte [reloc.WS2_32.dll_accept], r12b
je 0x14003826a
test rdi, rdi
je 0x14003826a
mov ecx, dword [0x14025cf20]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003826a
cmp byte [0x14025cf10], r12b
mov rsi, qword [rdi]
mov rbx, qword [rdi + 8]
mov rdi, qword [rdi + 0x18]
mov ecx, dword [0x14025cff8]
je 0x140037dde
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r9d, r12d
jmp 0x140037e29
test ecx, ecx
je 0x140037e23
sub ecx, 1
je 0x140037e1b
sub ecx, 1
je 0x140037e13
sub ecx, 1
je 0x140037e0b
cmp ecx, 1
jne 0x140037e06
mov eax, Ordinal_41
nop dword [rax + rax]
sub rax, 1
jne 0x140037e00
mov r9d, r12d
jmp 0x140037e29
mov r9d, 2
jmp 0x140037e29
mov r9d, 0x42
jmp 0x140037e29
mov r9d, 0x43
jmp 0x140037e29
mov r9d, WSAGetLastError
mov r8, rdi
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140032c10
vmovsd xmm6, qword [rbp + 0x60]
vmovsd xmm7, qword [rbp + 0x50]
vmovsd xmm8, qword [rbp + 0x58]
mov rcx, rsi
vmovsd qword [rbp - 0x38], xmm6
call fcn.140035a00
mov ecx, dword [0x14025ca88]
add rax, 0x168
mov qword [rsp + 0x58], rax
xor r9d, r9d
mov dword [rsp + 0x48], reloc.WS2_32.dll_recv
lea rax, [rbp - 0x80]
mov qword [rsp + 0x68], rax
xor r8d, r8d
mov dword [rsp + 0x50], ecx
lea rax, [rsp + 0x50]
mov rcx, qword [0x14025ca28]
xor edx, edx
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x58]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x58]
mov dword [rsp + 0x38], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x20]
vxorpd xmm0, xmm0, xmm0
mov qword [rsp + 0x60], rcx
mov rcx, qword [0x14025ce00]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
vmovsd qword [rbp - 0x70], xmm0
vmovupd xmmword [rbp - 0x80], xmm0
mov dword [rsp + 0x54], r12d
mov qword [rsp + 0x70], Ordinal_26
mov dword [rbp - 0x58], r12d
mov dword [rbp - 0x54], 4
call fcn.14008d640
cmp byte [reloc.WS2_32.dll_accept], r12b
vsubsd xmm0, xmm7, qword [0x14025b7b8]
vsubsd xmm1, xmm8, qword [0x14025b7c0]
vsubsd xmm2, xmm6, qword [0x14025b7c8]
vmulsd xmm3, xmm0, xmm0
vfmadd231sd xmm3, xmm1, xmm1
vfmadd231sd xmm3, xmm2, xmm2
vsqrtsd xmm0, xmm3, xmm3
vmulsd xmm10, xmm0, qword [0x14019bdb8]
je 0x14003807c
mov r9d, WSAGetLastError
lea rdx, [rbp - 0x10]
mov r8, rdi
mov rcx, rbx
call fcn.140032c10
movzx ebx, byte [0x14025cf8b]
vmovsd xmm9, qword [rbp + 0x60]
vmovsd xmm7, qword [rbp + 0x50]
vmovsd xmm8, qword [rbp + 0x58]
vmovsd qword [rbp - 0x38], xmm9
test bl, bl
je 0x140037fcf
cmp qword [r14 + 0x18], 0xf
mov rcx, r14
jbe 0x140037f72
mov rcx, qword [r14]
lea rdx, str.Reaper_Sniper_Rifle
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140037fc7
cmp byte [0x14025d011], r12b
je 0x140037f93
vmovss dword [0x1401b6410], xmm15
vmovss xmm1, dword [0x14019bfb4]
vandps xmm2, xmm1, xmmword [0x14019c360]
vcvtss2sd xmm0, xmm2, xmm2
vdivsd xmm1, xmm10, xmm0
vcvtsd2ss xmm4, xmm1, xmm1
vmovss xmm1, dword [0x14019c038]
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm7, xmm0, xmm14
jmp 0x140038042
test bl, bl
jne 0x14003807c
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140034f40
mov rcx, rax
call fcn.140035b10
mov rdx, r14
lea rcx, [rsp + 0x50]
vmovaps xmm6, xmm0
call fcn.140034f40
mov rcx, rax
call fcn.140036930
vucomiss xmm6, xmm11
vmovaps xmm5, xmm0
je 0x14003807c
vxorps xmm1, xmm1, xmm1
vmovss xmm2, xmm1, xmm6
vandps xmm3, xmm2, xmmword [0x14019c360]
vcvtss2sd xmm1, xmm3, xmm3
vdivsd xmm2, xmm10, xmm1
vmulss xmm1, xmm5, dword [0x14019c030]
vcvtsd2ss xmm4, xmm2, xmm2
vcvtss2sd xmm3, xmm4, xmm4
vmulsd xmm0, xmm3, qword [rbp - 0x80]
vfmadd231sd xmm7, xmm0, xmm14
vxorps xmm0, xmm0, xmm0
vmovss xmm1, xmm0, xmm1
vmulsd xmm2, xmm3, qword [rbp - 0x78]
vmulsd xmm0, xmm3, qword [rbp - 0x70]
vfmadd231sd xmm8, xmm2, xmm14
vandps xmm2, xmm1, xmmword [0x14019c360]
vmovaps xmm3, xmm9
vfmadd231sd xmm3, xmm0, xmm14
vmulss xmm0, xmm2, xmm4
vmulss xmm1, xmm0, dword [0x14019bec0]
vcvtss2sd xmm2, xmm1, xmm1
vaddsd xmm3, xmm3, xmm2
vmovsd qword [rbp - 0x38], xmm3
vunpcklpd xmm0, xmm7, xmm8
vmovups xmmword [rsp + 0x50], xmm0
vmovsd xmm0, qword [rbp - 0x38]
lea r8, [rbp + 0x158]
lea rdx, [rsp + 0x50]
vmovsd qword [rsp + 0x60], xmm0
vmovss dword [rbp + 0x158], xmm11
vmovss dword [rbp + 0x15c], xmm11
call fcn.1400392a0
test al, al
je 0x14003826a
vmovss xmm0, dword [rbp + 0x158]
vucomiss xmm0, xmm11
vmovss xmm4, dword [0x1401b6410]
vmovss xmm1, dword [0x14025cfc4]
vmovss xmm2, dword [0x14025cfc0]
vmovaps xmm7, xmm11
vmovaps xmm6, xmm11
je 0x14003810e
vsubss xmm0, xmm0, xmm1
vdivss xmm7, xmm0, xmm4
vaddss xmm3, xmm7, xmm1
vaddss xmm1, xmm1, xmm1
vcomiss xmm3, xmm1
ja 0x140038109
vcomiss xmm3, xmm11
jae 0x14003810e
vmovaps xmm7, xmm11
vmovss xmm0, dword [rbp + 0x15c]
vucomiss xmm0, xmm11
je 0x14003813f
vsubss xmm1, xmm0, xmm2
vdivss xmm6, xmm1, xmm4
vaddss xmm3, xmm6, xmm2
vaddss xmm0, xmm2, xmm2
vcomiss xmm3, xmm0
ja 0x14003813a
vcomiss xmm3, xmm11
jae 0x14003813f
vmovaps xmm6, xmm11
cmp byte [0x14025cf00], r12b
jne 0x14003826a
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm7
vsubss xmm7, xmm0, xmm13
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
vxorps xmm0, xmm0, xmm0
vcvtsi2ss xmm0, xmm0, eax
mov rax, qword [0x14025ce38]
vmulss xmm1, xmm0, xmm12
vfmadd231ss xmm1, xmm0, xmm12
vaddss xmm0, xmm1, xmm6
vsubss xmm2, xmm0, xmm13
test rax, rax
jne 0x140038253
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rdi, qword [rax]
mov rbx, rdi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140038234
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140038234
mov r10d, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
lea rcx, [r9 + r8*4]
mov edx, dword [rcx + r10]
mov ecx, 0x811c9dc5
add rdx, r9
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14003822f
nop dword [rax]
movsx eax, al
lea rdx, [rdx + 1]
xor eax, ecx
imul ecx, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140038210
cmp ecx, 0x20785c9b
je 0x140038286
test r8d, r8d
jne 0x1400381f0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rdi
je 0x140038249
cmp qword [rax + 0x30], r12
jne 0x1400381c0
mov rax, r12
mov qword [0x14025ce38], rax
vcvttss2si r8d, xmm2
vcvttss2si edx, xmm7
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov ecx, 1
call rax
lea rcx, [rbp + 0x160]
mov qword [rbp + 0x160], 1
call fcn.1400351a0
jmp 0x140037b04
mov eax, dword [r11 + 0x24]
mov ecx, dword [r11 + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14003824c