Function at 0x140094880
Capabilities:
Create thread
Hash data using fnv
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x14015d460]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
xor esi, esi
xor r8d, r8d
lea rdx, [rbp - 9]
mov rcx, qword [rcx]
call fcn.14000dc10
test eax, eax
jle 0x140094a61
lea r14, [0x140000000]
movabs r13, 0x100000001b3
lea r15, [0x140009f10]
lea r12, [0x140085a00]
nop dword [rax]
mov ecx, dword [rbp - 9]
sub ecx, 1
je 0x140094d0a
sub ecx, 1
je 0x140094cda
cmp ecx, 1
je 0x14009491b
lea rcx, str._SERVER_:_UNHANDLED_n
call fcn.14000b010
jmp 0x140094ee3
mov r8, qword [rbp + 0xf]
mov r9, qword [r8 + 0x18]
cmp r9, 3
jbe 0x140094c86
mov rax, qword [r8 + 0x10]
movzx edx, byte [rax]
mov ecx, edx
sub ecx, 2
je 0x140094c26
sub ecx, 1
je 0x140094bcb
sub ecx, 1
je 0x140094968
sub ecx, 2
je 0x14009495b
cmp ecx, 2
jne 0x140094c88
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
jmp 0x140094a61
cmp r9, 0x38
jae 0x140094973
mov rbx, rsi
jmp 0x1400949a4
mov rax, qword [rbp + 0xf]
mov rbx, qword [rax + 0x10]
add rbx, 4
test byte [rbx + 0xc], 8
je 0x1400949a1
mov eax, dword [rbx + 0x34]
add eax, 0x3c
cmp r9, rax
jae 0x1400949a4
lea rcx, str.got_invalid_packet.__too_small__n
call fcn.14000b010
mov rbx, rsi
jmp 0x1400949a4
mov dword [rbx + 0x34], esi
mov rax, qword [rbp + 0xf]
mov r8, qword [rax + 0x18]
cmp r8, 0x38
jae 0x1400949b7
mov rdx, rsi
jmp 0x1400949e8
mov rax, qword [rbp + 0xf]
mov rdx, qword [rax + 0x10]
add rdx, 4
test byte [rdx + 0x14], 8
je 0x1400949e5
mov eax, dword [rdx + 0x34]
add eax, 0x3c
cmp r8, rax
jae 0x1400949e8
lea rcx, str.got_invalid_packet.__too_small__n
call fcn.14000b010
mov rdx, rsi
jmp 0x1400949e8
mov dword [rdx + 0x34], esi
test rbx, rbx
je 0x140094c94
movzx r8d, byte [rbx]
cmp r8d, 0x19
ja case.0x140094a13.8
movzx eax, byte [r14 + r8 + 0x94f48]
mov ecx, dword [r14 + rax*4 + 0x94f24]
add rcx, r14
jmp rcx
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
mov rcx, rbx
call fcn.140054f40
test al, al
je 0x140094c94
mov rbx, qword [rbp + 0xf]
test rbx, rbx
je 0x140094a61
cmp qword [rbx + 0x20], 0
je 0x140094a43
mov rcx, rbx
call qword [rbx + reloc.WLDAP32.dll_Ordinal_32]
test byte [rbx + 8], 4
jne 0x140094a58
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140094a58
call qword [fcn.1401082ca]
mov rcx, rbx
call qword [fcn.1401082ca]
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140106d80
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
mov rcx, rbx
call fcn.140021280
test al, al
jne 0x140094a2d
jmp 0x140094c94
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
movzx edx, byte [rbx]
lea rcx, str._SERVER_:_Packet_Type:__d_n
call fcn.14000b010
mov rax, qword [0x14019fcf8]
cmp byte [rax + 0x63b0], 0
je 0x140094c94
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x140094a2d
jmp 0x140094c94
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
movzx edx, byte [rbx]
lea rcx, str._SERVER_:_Packet_Type:__d_n
call fcn.14000b010
mov rcx, rbx
call fcn.140061e30
test al, al
jne 0x140094a2d
jmp 0x140094c94
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
movzx edx, byte [rbx]
lea rcx, str._SERVER_:_Packet_Type:__d_n
jmp 0x140094c8f
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
movzx edx, byte [rbx]
lea rcx, str._SERVER_:_Packet_Type:__d_n
call fcn.14000b010
mov rcx, rbx
call fcn.140062ce0
test al, al
jne 0x140094a2d
jmp 0x140094c94
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
movzx edx, byte [rbx]
lea rcx, str._SERVER_:_Packet_Type:__d_n
call fcn.14000b010
mov rcx, rbx
call fcn.14002d660
test al, al
jne 0x140094a2d
jmp 0x140094c94
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
movzx edx, byte [rbx]
lea rcx, str._SERVER_:_Packet_Type:__d_n
call fcn.14000b010
cmp byte [0x14019d152], 0
jne 0x140094a61
jmp 0x140094c94
mov edx, r8d
lea rcx, str._SERVER_:_Packet_Type:__d_n
call fcn.14000b010
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
jmp 0x140094c94
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
mov rax, qword [rbp + 0xf]
mov rcx, qword [rax + 0x10]
mov rax, qword [r8 + 0x18]
xor edx, edx
mov byte [rax + rcx - 1], dl
lea rdx, [rcx + 4]
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140094c00
lea rcx, [rbp - 0x29]
call fcn.14006e1d0
lea rcx, [rbp - 0x29]
call fcn.140054c40
test al, al
jne 0x140094a2d
jmp 0x140094c94
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
mov rax, qword [rbp + 0xf]
mov rcx, qword [rax + 0x10]
mov rax, qword [r8 + 0x18]
xor edx, edx
mov byte [rax + rcx - 1], dl
lea rdx, [rcx + 4]
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], rsi
mov qword [rbp - 0x11], rsi
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140094c60
lea rcx, [rbp - 0x29]
call fcn.14006e1d0
lea rcx, [rbp - 0x29]
call fcn.14003a8a0
test al, al
jne 0x140094a2d
jmp 0x140094c94
mov edx, esi
lea rcx, str._SERVER_:_Got_unknown_packet_of_type__d._n
call fcn.14000b010
mov rcx, qword [rdi + 0x20]
test rcx, rcx
je 0x140094a61
cmp qword [rdi + 0x10], 0
je 0x140094a61
mov r8, qword [rbp + 0xf]
call fcn.140009f90
mov rbx, qword [rdi + 0x10]
call qword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x14019d070]
mov dword [rbx + 0x40], eax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000d450
jmp 0x140094ee3
cmp byte [0x14019d152], 0
jne 0x140094a61
cmp byte [0x14019d161], 0
je 0x140094ee3
xor edx, edx
mov rcx, rdi
call fcn.140097830
mov byte [0x14019d161], 0
jmp 0x140094a61
mov rax, qword [rbp - 1]
mov qword [rdi + 0x50], rax
cmp byte [0x14019d152], 0
je 0x140094ea5
cmp byte [0x14019d163], 0
jne 0x140094ea5
cmp qword [rdi + 0x48], 0
jne 0x140094ea5
cmp dword [0x14019d1b4], 1
jl 0x140094ea5
cmp byte [rdi + 0x71], 0
jne 0x140094ea5
cmp byte [rdi + 0x605c], 0
jne 0x140094e90
mov rbx, qword [0x14019fcf8]
lea rdx, str.0.0.0.0
lea rcx, [rbp - 0x49]
call fcn.14000e060
mov eax, 0x4327
mov word [rbp - 0x45], ax
mov edx, 0x400
mov r8d, 0xa
lea rcx, [rbp - 0x49]
call fcn.140009240
mov qword [rbx + 8], rax
mov qword [rax + 0x2b10], rsi
call qword [sym.imp.MSVCP140.dll__Thrd_id]
mov dword [rbp + 0x17], eax
movzx ecx, al
movabs rax, 0xcbf29ce484222325
xor rcx, rax
imul rcx, r13
movzx eax, byte [rbp + 0x18]
xor rcx, rax
imul rcx, r13
movzx eax, byte [rbp + 0x19]
xor rcx, rax
imul rcx, r13
movzx eax, byte [rbp + 0x1a]
xor rcx, rax
imul rcx, r13
mov dword [rbx + 0x6774], ecx
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140094df5
lea rcx, str.Failed_to_connect_to_Proxy_Server._n
call fcn.14000b010
jmp 0x140094e1d
mov qword [rax + 0xa90], r15
mov rcx, qword [rbx + 8]
call fcn.1400091a0
test eax, eax
je 0x140094e15
lea rcx, str._SERVER_:_enet_host_compressing_failed_n
call fcn.14000b010
mov rcx, rbx
call fcn.1400973c0
mov byte [rdi + 0x605c], 1
mov ecx, 8
call fcn.140106da0
mov qword [rax], r12
mov qword [rbp + 0x17], rax
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140074040]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp - 0x39], rax
test rax, rax
je 0x140094f14
cmp dword [rbp - 0x31], 0
je 0x140094f08
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140094eff
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x39], xmm0
mov rax, qword [rbp - 1]
mov qword [rdi + 0x48], rax
mov byte [0x14019d163], 1
mov rcx, rdi
call fcn.1400985c0
jmp 0x140094eb1
mov qword [rdi + 0x40], rax
mov rcx, rdi
call fcn.140098500
test al, al
je 0x140094a61
mov rdx, qword [0x1401a0248]
cmp rdx, qword [0x1401a0250]
je 0x140094eda
mov rax, qword [rbp - 1]
mov qword [rdx], rax
add qword [0x1401a0248], 8
jmp 0x140094ee3
lea r8, [rbp - 1]
call fcn.14009dc50
xor r8d, r8d
lea rdx, [rbp - 9]
mov rcx, qword [rdi]
call fcn.14000dc10
test eax, eax
jle 0x140094a61
jmp 0x1400948f0
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
int3
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x31], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3