Function at 0x140030948
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
movaps xmmword [rax - 0x78], xmm11
movaps xmmword [rax - 0x88], xmm13
movaps xmmword [rax - 0x98], xmm14
movaps xmmword [rax - 0xa8], xmm15
mov rax, qword [0x140043040]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor ebx, ebx
cmp byte [0x1400430c0], bl
je 0x140030a1b
mov rcx, qword [0x1400441b0]
add rcx, 0x1cc8
movd xmm2, dword [0x1400430c8]
cvtdq2ps xmm2, xmm2
mov eax, dword [0x1400441cc]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [0x140044298]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x70], xmm0
movss dword [rbp + 0x74], xmm1
movss xmm1, dword [0x14003e054]
movss dword [rsp + 0x28], xmm1
lea rdx, [rbp + 0x70]
call fcn.14001cb38
mov edx, 5
lea ecx, [rdx - 3]
mov eax, dword [0x140044314]
test eax, eax
jne 0x140030a39
mov dword [0x140044348], 0x6a
jmp 0x140030a61
cmp eax, 1
jne 0x140030a4a
mov dword [0x140044348], 0x42
jmp 0x140030a61
cmp eax, ecx
jne 0x140030a56
mov dword [0x140044348], edx
jmp 0x140030a61
cmp eax, 3
jne 0x140030a61
mov dword [0x140044348], ecx
mov r14d, 4
mov eax, dword [0x14004362c]
test eax, eax
jne 0x140030a80
mov dword [0x140044310], 1
jmp 0x140030b26
cmp eax, 1
jne 0x140030a90
mov dword [0x140044310], ecx
jmp 0x140030b26
cmp eax, ecx
jne 0x140030aa0
mov dword [0x140044310], r14d
jmp 0x140030b26
cmp eax, 3
jne 0x140030aad
mov dword [0x140044310], edx
jmp 0x140030b26
cmp eax, r14d
jne 0x140030abe
mov dword [0x140044310], 6
jmp 0x140030b26
cmp eax, edx
jne 0x140030ace
mov dword [0x140044310], 3
jmp 0x140030b26
cmp eax, 6
jne 0x140030adf
mov dword [0x140044310], 8
jmp 0x140030b26
cmp eax, 7
jne 0x140030af0
mov dword [0x140044310], 9
jmp 0x140030b26
cmp eax, 8
jne 0x140030b01
mov dword [0x140044310], 0xc
jmp 0x140030b26
cmp eax, 9
je 0x140030b26
cmp eax, 0xa
jne 0x140030b17
mov dword [0x140044310], 0x10
jmp 0x140030b26
cmp eax, 0xb
jne 0x140030b26
mov dword [0x140044310], 0x11
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
mov qword [rbp + 0x98], rbx
mov rax, qword [0x1400443a8]
sub rax, qword [0x1400443a0]
sar rax, 3
movabs rsi, 0xaaaaaaaaaaaaaaab
imul rax, rsi
test rax, rax
je 0x140030c27
movabs rcx, 0xaaaaaaaaaaaaaaa
cmp rax, rcx
ja 0x1400315c8
lea rax, [rax + rax*2]
lea rbx, [rax*8]
cmp rbx, 0x1000
jb 0x140030bb5
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x1400315c2
call fcn.1400336ac
test rax, rax
je 0x140030bae
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140030bc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x140030bc7
mov rcx, rbx
call fcn.1400336ac
mov rdi, rax
jmp 0x140030bc9
xor edi, edi
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], rdi
lea rax, [rbx + rdi]
mov qword [rbp + 0x98], rax
mov rbx, qword [0x1400443a8]
mov rdx, qword [0x1400443a0]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 3
imul rbx, rsi
lea rax, [rbx + rbx*2]
lea rcx, [rdi + rax*8]
mov qword [rbp + 0x90], rcx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x60]
call fcn.140032fbc
nop
movss xmm13, dword [0x14003e15c]
mov rsi, rbx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0xb0], rbx
mov rcx, qword [0x1400441c0]
add rcx, 0x1078a7d8
call fcn.140032a44
mov qword [0x1400442b0], rax
lea rcx, [rax + 0x1b8]
call fcn.140032a44
lea rcx, [rax + 0x38]
call fcn.140032a44
mov rcx, rax
call fcn.140032a44
mov qword [0x140044290], rax
lea rcx, [rax + 0x30]
call fcn.140032a44
mov qword [0x1400441b8], rax
lea rcx, [rax + 0x330]
call fcn.140032a44
mov qword [0x140044260], rax
lea rcx, [rax + 0x2a8]
call fcn.140032a44
mov qword [0x140044250], rax
mov rcx, qword [0x140044260]
add rcx, 0x190
call fcn.140032a44
mov qword [0x1400442a0], rax
mov rcx, qword [0x1400442b0]
add rcx, 0x30
call fcn.140032a44
mov qword [0x140044278], rax
lea rcx, [rax + 0xa0]
mov dword [rbp + 0x80], ebx
mov eax, dword [0x1400441c8]
mov dword [rbp + 0x38], eax
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x48], pe_nt_image_headers64
mov byte [rbp + 0x4a], bl
lea rax, [rbp + 0x80]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x20]
call fcn.140032a10
mov rcx, qword [0x140044278]
add rcx, 0x98
call fcn.140032a44
mov r13, rax
mov r15d, ebx
cmp dword [rbp + 0x80], ebx
jbe 0x1400314ed
movss xmm10, dword [0x14003e030]
mov rcx, qword [0x140044260]
add rcx, 0x8f8
call fcn.140032a44
movsxd rax, r15d
lea rcx, [rax*8]
add rcx, r13
call fcn.140032a44
mov r14, rax
lea rcx, [rax + 0x310]
call fcn.140032a44
mov rdi, rax
lea rcx, [r14 + 0x4480]
call fcn.140032b48
ucomiss xmm0, dword [0x14003e120]
jp 0x1400314dd
jne 0x1400314dd
mov rcx, qword [0x140044250]
add rcx, 0x10b0
call fcn.140032d98
mov ebx, eax
lea rcx, [r14 + 0x2a8]
call fcn.140032a44
lea rcx, [rax + 0x10b0]
call fcn.140032d98
cmp ebx, eax
je 0x1400314db
cmp r14, qword [0x140044260]
je 0x1400314db
mov r8d, 0x6a
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14002d378
mov rdx, qword [0x1400442a0]
add rdx, 0x128
lea rcx, [rbp - 0x80]
call fcn.140032bb4
movups xmm7, xmmword [rax]
movups xmmword [0x140044318], xmm7
movsd xmm0, qword [rax + 0x10]
movsd qword [0x140044328], xmm0
movsd xmm9, qword [rsp + 0x48]
movaps xmm1, xmm9
movaps xmm0, xmm7
unpckhpd xmm0, xmm7
subsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e084]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm6, xmm0
movsd xmm8, qword [rsp + 0x40]
movaps xmm1, xmm8
subsd xmm1, xmm7
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e084]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
movsd xmm7, qword [rsp + 0x50]
movaps xmm1, xmm7
subsd xmm1, qword [0x140044328]
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e084]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm11, xmm0
divss xmm11, dword [0x14003e148]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.14002d378
movups xmm14, xmmword [rbp - 0x40]
movaps xmmword [rsp + 0x40], xmm14
movsd xmm15, qword [rbp - 0x30]
movsd qword [rsp + 0x50], xmm15
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.14002dbbc
movaps xmm0, xmm7
addsd xmm0, qword [0x14003e0b0]
cvtpd2ps xmm3, xmm0
cvtpd2ps xmm2, xmm9
cvtpd2ps xmm0, xmm8
cvtps2pd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
cvtps2pd xmm2, xmm2
movsd qword [rsp + 0x48], xmm2
cvtps2pd xmm0, xmm3
movsd qword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14002dbbc
movaps xmm0, xmm8
unpcklpd xmm0, xmm9
movaps xmmword [rbp - 0x40], xmm0
movsd qword [rbp - 0x30], xmm7
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.14002dbbc
movsd xmm8, qword [rbp - 0x18]
movaps xmm0, xmm8
subsd xmm0, qword [rbp - 0x58]
andps xmm0, xmmword [0x14003e270]
cvtpd2ps xmm9, xmm0
cvtps2pd xmm0, xmm9
mulsd xmm0, qword [0x14003e070]
cvtpd2ps xmm7, xmm0
movd xmm0, dword [0x140043648]
cvtdq2ps xmm0, xmm0
xor ebx, ebx
comiss xmm0, xmm11
jbe 0x140031460
movsd xmm6, qword [rbp - 0x20]
cmp byte [0x1400430c1], bl
je 0x140030ff9
mov rcx, rdi
call fcn.140030904
test al, al
je 0x140030fb1
mov dword [rsp + 0x30], 0xff2ee800
jmp 0x140030fc5
mov rcx, rdi
call fcn.140030904
test al, al
jne 0x140030ff9
mov dword [rsp + 0x30], 0xff0019ff
movaps xmm0, xmm7
mulss xmm0, xmm10
cvtps2pd xmm1, xmm0
movaps xmm2, xmm6
lea rax, [rsp + 0x30]
subsd xmm2, xmm1
mov qword [rsp + 0x20], rax
cvttss2si r9d, xmm9
cvttss2si r8d, xmm7
cvttsd2si edx, xmm8
cvttsd2si ecx, xmm2
call fcn.14002e5a4
cmp byte [0x1400441ae], bl
je 0x14003105f
mov rcx, rdi
call fcn.140030904
test al, al
je 0x140031017
mov dword [rsp + 0x30], 0xff2ee800
jmp 0x14003102b
mov rcx, rdi
call fcn.140030904
test al, al
jne 0x14003105f
mov dword [rsp + 0x30], 0xff0019ff
movaps xmm0, xmm7
mulss xmm0, xmm10
cvtps2pd xmm1, xmm0
movaps xmm2, xmm6
lea rax, [rsp + 0x30]
subsd xmm2, xmm1
mov qword [rsp + 0x20], rax
cvttss2si r9d, xmm9
cvttss2si r8d, xmm7
cvttsd2si edx, xmm8
cvttsd2si ecx, xmm2
call fcn.14002eb8c
mov rcx, rdi
call fcn.140030904
test al, al
je 0x14003116a
mov dword [rbp + 0x70], 0xbef9f3f5
mov word [rbp + 0x74], 0xd0b4
xor eax, eax
mov byte [rbp + 0x76], al
mov edx, ebx
movsxd rcx, edx
lea eax, [rdx - 0x2b]
xor byte [rbp + rcx + 0x70], al
inc edx
cmp edx, 6
jb 0x140031083
mov byte [rbp + 0x76], bl
xorps xmm2, xmm2
cvtss2sd xmm2, xmm11
movq r8, xmm2
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xc0]
call fcn.140032e04
movaps xmm0, xmmword [0x14003e250]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002724
mov ebx, eax
movaps xmm5, xmm8
subsd xmm5, qword [0x14003e0c0]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm5
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
movss dword [rsp + 0x68], xmm0
movss dword [rsp + 0x6c], xmm1
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x80]
call fcn.140032734
nop
mov dword [rsp + 0x20], ebx
movss xmm3, dword [0x14003e134]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140044268]
call fcn.14002de30
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140031260
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003125b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003125b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140030904
test al, al
jne 0x140031262
mov dword [rbp + 0x78], 0xb5b1f8f0
mov word [rbp + 0x7c], 0xd3
mov edx, ebx
movsxd rcx, edx
lea eax, [rdx - 0x2b]
xor byte [rbp + rcx + 0x78], al
inc edx
cmp edx, 5
jb 0x140031189
mov byte [rbp + 0x7d], bl
xorps xmm2, xmm2
cvtss2sd xmm2, xmm11
movq r8, xmm2
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x20]
call fcn.140032e04
movaps xmm0, xmmword [0x14003e230]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002724
mov ebx, eax
movaps xmm5, xmm8
subsd xmm5, qword [0x14003e0c0]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm5
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
movss dword [rsp + 0x70], xmm0
movss dword [rsp + 0x74], xmm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.140032734
nop
mov dword [rsp + 0x20], ebx
movss xmm3, dword [0x14003e134]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x140044268]
call fcn.14002de30
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140031260
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003125b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400315bb
call fcn.140033634
xor ebx, ebx
movsd xmm9, qword [rbp - 0x60]
cmp byte [0x1400441ac], bl
je 0x14003130c
mov r10, qword [0x1400441b0]
movaps xmm0, xmmword [0x14003e210]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002724
movsd xmm5, qword [rbp - 0x58]
cvtpd2ps xmm5, xmm5
mulss xmm7, xmm10
xorps xmm2, xmm2
cvtss2sd xmm2, xmm7
movaps xmm0, xmm2
addsd xmm0, xmm9
cvtpd2ps xmm0, xmm0
movss dword [rsp + 0x78], xmm0
movss dword [rsp + 0x7c], xmm5
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm8
movaps xmm0, xmm6
subsd xmm0, xmm2
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
mov dword [rsp + 0x28], 0xf
movss xmm0, dword [0x14003e044]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x60]
lea rcx, [r10 + 0x1cc8]
call fcn.14001c924
cmp byte [0x1400441aa], bl
je 0x140031328
movaps xmmword [rbp - 0x20], xmm14
movsd qword [rbp - 0x10], xmm15
lea rcx, [rbp - 0x20]
call fcn.140030790
cmp byte [0x1400430c2], bl
je 0x140031460
mov rcx, rdi
call fcn.140030904
test al, al
je 0x1400313ca
mov ecx, dword [0x14004429c]
test ecx, ecx
je 0x14003139b
sub ecx, 1
je 0x14003138b
cmp ecx, 1
jne 0x1400313ca
mov eax, 0x431bde83
imul dword [0x1400441cc]
mov r10d, edx
sar r10d, 0x12
mov eax, r10d
shr eax, 0x1f
add r10d, eax
cvttsd2si r8d, xmm6
cvttsd2si r9d, xmm8
mov eax, dword [0x140044298]
cdq
sub eax, edx
mov edx, r10d
jmp 0x1400313b5
mov eax, dword [0x1400441cc]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
jmp 0x140031373
cvttsd2si r9d, qword [rbp - 0x58]
cvttsd2si r8d, xmm9
mov eax, dword [0x140044298]
cdq
sub eax, edx
mov edx, dword [0x1400441cc]
sar eax, 1
mov ecx, eax
lea rax, [0x1400432a0]
mov qword [rsp + 0x20], rax
call fcn.14002e4f0
mov rcx, rdi
call fcn.140030904
test al, al
jne 0x140031460
mov ecx, dword [0x14004429c]
test ecx, ecx
je 0x140031431
sub ecx, 1
je 0x14003140b
cmp ecx, 1
jne 0x140031460
mov eax, 0x6b5fca6b
imul dword [0x1400441cc]
mov r10d, edx
sar r10d, 0x16
mov eax, r10d
shr eax, 0x1f
add r10d, eax
jmp 0x140031419
mov eax, dword [0x1400441cc]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
cvttsd2si r8d, xmm6
cvttsd2si r9d, xmm8
mov eax, dword [0x140044298]
cdq
sub eax, edx
mov edx, r10d
jmp 0x14003144b
cvttsd2si r9d, qword [rbp - 0x58]
cvttsd2si r8d, xmm9
mov eax, dword [0x140044298]
cdq
sub eax, edx
mov edx, dword [0x1400441cc]
sar eax, 1
mov ecx, eax
lea rax, [0x1400432a0]
mov qword [rsp + 0x20], rax
call fcn.14002e4f0
mov eax, dword [0x140044298]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm2, qword [rbp]
subsd xmm2, xmm0
mov eax, dword [0x1400441cc]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm1, qword [rbp + 8]
subsd xmm1, xmm0
mulsd xmm1, xmm1
mulsd xmm2, xmm2
addsd xmm1, xmm2
cvtpd2ps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm6, xmm0
mov rcx, rdi
call fcn.140030904
test al, al
je 0x1400314dd
movd xmm1, dword [0x1400430c8]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm6
jbe 0x1400314dd
comiss xmm13, xmm6
jbe 0x1400314dd
movaps xmm13, xmm6
mov rsi, r14
jmp 0x1400314dd
xor ebx, ebx
inc r15d
cmp r15d, dword [rbp + 0x80]
jb 0x140030d53
cmp byte [0x1400441a9], bl
je 0x14003151b
cmp byte [0x1400441ab], bl
je 0x140031542
test rsi, rsi
je 0x14003151b
mov ecx, dword [0x140044310]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14003151b
mov rcx, rsi
call fcn.140030890
cmp byte [0x1400441ab], bl
je 0x140031542
test rsi, rsi
je 0x140031542
mov ecx, dword [0x140044310]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140031542
mov rcx, rsi
call fcn.140030890
nop
lea rcx, [rbp + 0xa0]
call fcn.140032034
nop
lea rcx, [rbp + 0x88]
call fcn.140032034
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140033220
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm13, xmmword [r11 - 0x70]
movaps xmm14, xmmword [r11 - 0x80]
movaps xmm15, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14002cc90
int3
call fcn.140033034
int3