Function at 0x14001bb80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x1403d3080]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor esi, esi
cmp byte [0x1403ec8e0], sil
jne 0x14001c18a
movabs r14, 0x7fffffffffffffff
mov r15d, 0xff
nop dword [rax]
nop word [rax + rax]
mov eax, dword [reloc.WS2_32.dll_accept]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x48]
call fcn.140001c50
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x14001bc35
js 0x14001bc35
imul r8, rbx, 0xf4240
mov rdx, r14
sub rdx, r8
cmp rax, rdx
je 0x14001bc30
mov ecx, 1
cmovl ecx, r15d
test cl, cl
jns 0x14001bc30
lea rcx, [r8 + rax]
mov qword [rsp + 0x30], rcx
jmp 0x14001bc35
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.140004c30
cmp byte [0x1403ec7b0], 0
je 0x14001c17d
cmp qword [0x140424718], 0
je 0x14001c17d
mov ecx, dword [0x1403ec7b4]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14001bd5e
cmp byte [0x140423de9], al
je 0x14001c17d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001bd26
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001bd26
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xf619f8fe
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001bd21
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001bd00
cmp r8d, 0x8946e328
je 0x14001bd2b
test r9d, r9d
jne 0x14001bce0
mov rax, qword [rax]
jmp 0x14001bcb0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r8d, Ordinal_41
lea rdx, [rbp + 8]
lea ecx, [r8 - 0x27]
call rax
mov byte [0x140423de9], 0
jmp 0x14001c17d
mov rcx, qword [0x140423f30]
test rcx, rcx
je 0x14001bd8f
cmp dword [0x140423e9c], 0
je 0x14001bd8f
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x30]
mov rdx, qword [0x140424500]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14001bdc6
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [0x140424450]
call fcn.14002d750
mov rdx, qword [rax]
add rdx, 0x18
lea rcx, [rsp + 0x70]
call fcn.14001ab30
jmp 0x14001bdfb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rsp + 0x70]
call fcn.14001aa40
nop
cmp dword [rsp + 0x78], 0
jle 0x14001c080
movups xmm0, xmmword [0x140424718]
movups xmmword [rbp + 8], xmm0
movups xmm6, xmmword [0x140424728]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [0x140423f30]
test rdx, rdx
jne 0x14001be37
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x40], edx
xorps xmm1, xmm1
jmp 0x14001be72
test rbx, rbx
je 0x14001be6c
cmp dword [0x140423e9c], 0
je 0x14001be6c
add rdx, 0x90
mov qword [rsp + 0x20], rsi
mov r9d, recvfrom
lea r8, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [0x140423f30]
movss xmm1, dword [rsp + 0x38]
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
subss xmm0, xmm1
movaps xmm1, xmm6
shufps xmm1, xmm6, 0xaa
subss xmm1, dword [rsp + 0x3c]
shufps xmm6, xmm6, 0xff
subss xmm6, dword [rsp + 0x40]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
mulss xmm6, xmm6
addss xmm1, xmm6
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x14001beb9
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x14001bec1
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [0x1403ec7bc]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
setbe al
cmp byte [rbp - 0x7f], 0
je 0x14001bee5
movzx eax, al
cmp byte [0x1403ec7b8], 0
cmove eax, esi
movzx edi, al
cmp byte [rbp - 0x50], 0
cmovne edi, esi
test rbx, rbx
je 0x14001bf1c
cmp dword [0x140423e9c], 0
je 0x14001bf1c
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp]
mov rdx, qword [0x1404244f8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp], 0
je 0x14001c080
test dil, dil
je 0x14001c080
cmp byte [0x140423de9], 0
jne 0x14001c16b
movsxd rbx, dword [0x1403ec7c0]
lea rcx, [rsp + 0x50]
call fcn.140001c50
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rcx
test rbx, rbx
je 0x14001bf8d
js 0x14001bf8d
imul r8, rbx, 0xf4240
mov rax, r14
sub rax, r8
cmp rcx, rax
je 0x14001bf88
mov edx, 1
cmovl edx, r15d
test dl, dl
jns 0x14001bf88
lea rax, [rcx + r8]
mov qword [rsp + 0x30], rax
jmp 0x14001bf8d
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.140004c30
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001c046
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001c046
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x9c25d3a0
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001c041
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001c020
cmp r8d, 0x7be66392
je 0x14001c04b
test r9d, r9d
jne 0x14001c000
mov rax, qword [rax]
jmp 0x14001bfd0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_41
lea rdx, [rbp + 8]
lea ecx, [r8 - 0x27]
call r9
mov byte [0x140423de9], 1
jmp 0x14001c16b
cmp byte [0x140423de9], 0
je 0x14001c16b
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3c], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov dword [rbp + 0x38], esi
mov dword [rbp + 0x4c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14001c136
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14001c136
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xba8b9305
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14001c131
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14001c110
cmp r8d, 0xcd0fa6bd
je 0x14001c13b
test r9d, r9d
jne 0x14001c0f0
mov rax, qword [rax]
jmp 0x14001c0c0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, Ordinal_41
lea rdx, [rbp + 0x38]
lea ecx, [r8 - 0x27]
call r9
mov byte [0x140423de9], 0
lea rcx, [rbp - 0x48]
call fcn.140005190
lea rcx, [rbp - 0x78]
call fcn.140003530
cmp byte [0x1403ec8e0], 0
je 0x14001bbe0
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140161860
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret