Function at 0x1400307e8
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x1b8]
sub rsp, 0x2a0
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
movaps xmmword [rax - 0x68], xmm10
movaps xmmword [rax - 0x78], xmm11
movaps xmmword [rax - 0x88], xmm13
movaps xmmword [rax - 0x98], xmm14
movaps xmmword [rax - 0xa8], xmm15
mov rax, qword [0x140043010]
xor rax, rsp
mov qword [rbp + 0x100], rax
xor ebx, ebx
cmp byte [0x140043050], bl
je 0x1400308bb
mov rcx, qword [0x140044140]
add rcx, 0x1cc8
movd xmm2, dword [0x140043058]
cvtdq2ps xmm2, xmm2
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [0x140044228]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbp + 0x70], xmm0
movss dword [rbp + 0x74], xmm1
movss xmm1, dword [0x14003e024]
movss dword [rsp + 0x28], xmm1
lea rdx, [rbp + 0x70]
call fcn.14001ca38
mov edx, 5
lea ecx, [rdx - 3]
mov eax, dword [0x1400442a4]
test eax, eax
jne 0x1400308d9
mov dword [0x1400442d8], 0x6a
jmp 0x140030901
cmp eax, 1
jne 0x1400308ea
mov dword [0x1400442d8], 0x42
jmp 0x140030901
cmp eax, ecx
jne 0x1400308f6
mov dword [0x1400442d8], edx
jmp 0x140030901
cmp eax, 3
jne 0x140030901
mov dword [0x1400442d8], ecx
mov r14d, 4
mov eax, dword [0x1400435bc]
test eax, eax
jne 0x140030920
mov dword [0x1400442a0], 1
jmp 0x1400309c6
cmp eax, 1
jne 0x140030930
mov dword [0x1400442a0], ecx
jmp 0x1400309c6
cmp eax, ecx
jne 0x140030940
mov dword [0x1400442a0], r14d
jmp 0x1400309c6
cmp eax, 3
jne 0x14003094d
mov dword [0x1400442a0], edx
jmp 0x1400309c6
cmp eax, r14d
jne 0x14003095e
mov dword [0x1400442a0], 6
jmp 0x1400309c6
cmp eax, edx
jne 0x14003096e
mov dword [0x1400442a0], 3
jmp 0x1400309c6
cmp eax, 6
jne 0x14003097f
mov dword [0x1400442a0], 8
jmp 0x1400309c6
cmp eax, 7
jne 0x140030990
mov dword [0x1400442a0], 9
jmp 0x1400309c6
cmp eax, 8
jne 0x1400309a1
mov dword [0x1400442a0], 0xc
jmp 0x1400309c6
cmp eax, 9
je 0x1400309c6
cmp eax, 0xa
jne 0x1400309b7
mov dword [0x1400442a0], 0x10
jmp 0x1400309c6
cmp eax, 0xb
jne 0x1400309c6
mov dword [0x1400442a0], 0x11
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
mov qword [rbp + 0x98], rbx
mov rax, qword [0x140044338]
sub rax, qword [0x140044330]
sar rax, 3
movabs rsi, 0xaaaaaaaaaaaaaaab
imul rax, rsi
test rax, rax
je 0x140030ac7
movabs rcx, 0xaaaaaaaaaaaaaaa
cmp rax, rcx
ja 0x140031468
lea rax, [rax + rax*2]
lea rbx, [rax*8]
cmp rbx, 0x1000
jb 0x140030a55
lea rcx, [rbx + 0x27]
cmp rcx, rbx
jbe 0x140031462
call fcn.14003355c
test rax, rax
je 0x140030a4e
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140030a69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x140030a67
mov rcx, rbx
call fcn.14003355c
mov rdi, rax
jmp 0x140030a69
xor edi, edi
mov qword [rbp + 0x88], rdi
mov qword [rbp + 0x90], rdi
lea rax, [rbx + rdi]
mov qword [rbp + 0x98], rax
mov rbx, qword [0x140044338]
mov rdx, qword [0x140044330]
sub rbx, rdx
mov r8, rbx
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
sar rbx, 3
imul rbx, rsi
lea rax, [rbx + rbx*2]
lea rcx, [rdi + rax*8]
mov qword [rbp + 0x90], rcx
xor ebx, ebx
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x60]
call fcn.140032e64
nop
movss xmm13, dword [0x14003e12c]
mov rsi, rbx
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0xb0], rbx
mov rcx, qword [0x140044150]
add rcx, 0x1078a7d8
call fcn.1400328f0
mov qword [0x140044240], rax
lea rcx, [rax + 0x1b8]
call fcn.1400328f0
lea rcx, [rax + 0x38]
call fcn.1400328f0
mov rcx, rax
call fcn.1400328f0
mov qword [0x140044220], rax
lea rcx, [rax + 0x30]
call fcn.1400328f0
mov qword [0x140044148], rax
lea rcx, [rax + 0x330]
call fcn.1400328f0
mov qword [0x1400441f0], rax
lea rcx, [rax + 0x2a8]
call fcn.1400328f0
mov qword [0x1400441e0], rax
mov rcx, qword [0x1400441f0]
add rcx, 0x190
call fcn.1400328f0
mov qword [0x140044230], rax
mov rcx, qword [0x140044240]
add rcx, 0x30
call fcn.1400328f0
mov qword [0x140044208], rax
lea rcx, [rax + 0xa0]
mov dword [rbp + 0x80], ebx
mov eax, dword [0x140044158]
mov dword [rbp + 0x38], eax
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x28], rcx
mov word [rbp + 0x48], 0x100
mov byte [rbp + 0x4a], bl
lea rax, [rbp + 0x80]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x20]
call fcn.1400328bc
mov rcx, qword [0x140044208]
add rcx, 0x98
call fcn.1400328f0
mov r13, rax
mov r15d, ebx
cmp dword [rbp + 0x80], ebx
jbe 0x14003138d
movss xmm10, dword [0x14003e000]
mov rcx, qword [0x1400441f0]
add rcx, 0x8f8
call fcn.1400328f0
movsxd rax, r15d
lea rcx, [rax*8]
add rcx, r13
call fcn.1400328f0
mov r14, rax
lea rcx, [rax + 0x310]
call fcn.1400328f0
mov rdi, rax
lea rcx, [r14 + 0x4480]
call fcn.1400329f4
ucomiss xmm0, dword [0x14003e0f0]
jp 0x14003137d
jne 0x14003137d
mov rcx, qword [0x1400441e0]
add rcx, 0x10b0
call fcn.140032c44
mov ebx, eax
lea rcx, [r14 + 0x2a8]
call fcn.1400328f0
lea rcx, [rax + 0x10b0]
call fcn.140032c44
cmp ebx, eax
je 0x14003137b
cmp r14, qword [0x1400441f0]
je 0x14003137b
mov r8d, 0x6a
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.14002d220
mov rdx, qword [0x140044230]
add rdx, 0x128
lea rcx, [rbp - 0x80]
call fcn.140032a60
movups xmm7, xmmword [rax]
movups xmmword [0x1400442a8], xmm7
movsd xmm0, qword [rax + 0x10]
movsd qword [0x1400442b8], xmm0
movsd xmm9, qword [rsp + 0x48]
movaps xmm1, xmm9
movaps xmm0, xmm7
unpckhpd xmm0, xmm7
subsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e054]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
movaps xmm6, xmm0
movsd xmm8, qword [rsp + 0x40]
movaps xmm1, xmm8
subsd xmm1, xmm7
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e054]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
movsd xmm7, qword [rsp + 0x50]
movaps xmm1, xmm7
subsd xmm1, qword [0x1400442b8]
cvtpd2ps xmm0, xmm1
movss xmm1, dword [0x14003e054]
call sub.api_ms_win_crt_math_l1_1_0.dll_powf
addss xmm6, xmm0
movaps xmm0, xmm6
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm11, xmm0
divss xmm11, dword [0x14003e118]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.14002d220
movups xmm14, xmmword [rbp - 0x40]
movaps xmmword [rsp + 0x40], xmm14
movsd xmm15, qword [rbp - 0x30]
movsd qword [rsp + 0x50], xmm15
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.14002da5c
movaps xmm0, xmm7
addsd xmm0, qword [0x14003e080]
cvtpd2ps xmm3, xmm0
cvtpd2ps xmm2, xmm9
cvtpd2ps xmm0, xmm8
cvtps2pd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
cvtps2pd xmm2, xmm2
movsd qword [rsp + 0x48], xmm2
cvtps2pd xmm0, xmm3
movsd qword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14002da5c
movaps xmm0, xmm8
unpcklpd xmm0, xmm9
movaps xmmword [rbp - 0x40], xmm0
movsd qword [rbp - 0x30], xmm7
lea rdx, [rbp - 0x40]
lea rcx, [rbp]
call fcn.14002da5c
movsd xmm8, qword [rbp - 0x18]
movaps xmm0, xmm8
subsd xmm0, qword [rbp - 0x58]
andps xmm0, xmmword [0x14003e270]
cvtpd2ps xmm9, xmm0
cvtps2pd xmm0, xmm9
mulsd xmm0, qword [0x14003e040]
cvtpd2ps xmm7, xmm0
movd xmm0, dword [0x1400435d8]
cvtdq2ps xmm0, xmm0
xor ebx, ebx
comiss xmm0, xmm11
jbe 0x140031300
movsd xmm6, qword [rbp - 0x20]
cmp byte [0x140043051], bl
je 0x140030e99
mov rcx, rdi
call fcn.1400307a4
test al, al
je 0x140030e51
mov dword [rsp + 0x30], 0xff2ee800
jmp 0x140030e65
mov rcx, rdi
call fcn.1400307a4
test al, al
jne 0x140030e99
mov dword [rsp + 0x30], 0xff0019ff
movaps xmm0, xmm7
mulss xmm0, xmm10
cvtps2pd xmm1, xmm0
movaps xmm2, xmm6
lea rax, [rsp + 0x30]
subsd xmm2, xmm1
mov qword [rsp + 0x20], rax
cvttss2si r9d, xmm9
cvttss2si r8d, xmm7
cvttsd2si edx, xmm8
cvttsd2si ecx, xmm2
call fcn.14002e440
cmp byte [0x14004413e], bl
je 0x140030eff
mov rcx, rdi
call fcn.1400307a4
test al, al
je 0x140030eb7
mov dword [rsp + 0x30], 0xff2ee800
jmp 0x140030ecb
mov rcx, rdi
call fcn.1400307a4
test al, al
jne 0x140030eff
mov dword [rsp + 0x30], 0xff0019ff
movaps xmm0, xmm7
mulss xmm0, xmm10
cvtps2pd xmm1, xmm0
movaps xmm2, xmm6
lea rax, [rsp + 0x30]
subsd xmm2, xmm1
mov qword [rsp + 0x20], rax
cvttss2si r9d, xmm9
cvttss2si r8d, xmm7
cvttsd2si edx, xmm8
cvttsd2si ecx, xmm2
call fcn.14002ea28
mov rcx, rdi
call fcn.1400307a4
test al, al
je 0x14003100a
mov dword [rbp + 0x70], 0x773e2a2e
mov word [rbp + 0x74], 0x197f
xor eax, eax
mov byte [rbp + 0x76], al
mov edx, ebx
movsxd rcx, edx
lea eax, [rdx + 0xe]
xor byte [rbp + rcx + 0x70], al
inc edx
cmp edx, 6
jb 0x140030f23
mov byte [rbp + 0x76], bl
xorps xmm2, xmm2
cvtss2sd xmm2, xmm11
movq r8, xmm2
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0xc0]
call fcn.140032cb0
movaps xmm0, xmmword [0x14003e220]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002704
mov ebx, eax
movaps xmm5, xmm8
subsd xmm5, qword [0x14003e090]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm5
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
movss dword [rsp + 0x68], xmm0
movss dword [rsp + 0x6c], xmm1
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x80]
call fcn.1400325e4
nop
mov dword [rsp + 0x20], ebx
movss xmm3, dword [0x14003e104]
lea r8, [rsp + 0x68]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x1400441f8]
call fcn.14002dcd0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140031100
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400310fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400310fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.1400307a4
test al, al
jne 0x140031102
mov dword [rbp + 0x78], 0x7c76212b
mov word [rbp + 0x7c], 0x18
mov edx, ebx
movsxd rcx, edx
lea eax, [rdx + 0xe]
xor byte [rbp + rcx + 0x78], al
inc edx
cmp edx, 5
jb 0x140031029
mov byte [rbp + 0x7d], bl
xorps xmm2, xmm2
cvtss2sd xmm2, xmm11
movq r8, xmm2
lea rdx, [rbp + 0x78]
lea rcx, [rbp + 0x20]
call fcn.140032cb0
movaps xmm0, xmmword [0x14003e200]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002704
mov ebx, eax
movaps xmm5, xmm8
subsd xmm5, qword [0x14003e090]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm5
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm6
movss dword [rsp + 0x70], xmm0
movss dword [rsp + 0x74], xmm1
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x80]
call fcn.1400325e4
nop
mov dword [rsp + 0x20], ebx
movss xmm3, dword [0x14003e104]
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
mov rcx, qword [0x1400441f8]
call fcn.14002dcd0
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x140031100
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400310fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003145b
call fcn.1400334e4
xor ebx, ebx
movsd xmm9, qword [rbp - 0x60]
cmp byte [0x14004413c], bl
je 0x1400311ac
mov r10, qword [0x140044140]
movaps xmm0, xmmword [0x14003e1e0]
movups xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.140002704
movsd xmm5, qword [rbp - 0x58]
cvtpd2ps xmm5, xmm5
mulss xmm7, xmm10
xorps xmm2, xmm2
cvtss2sd xmm2, xmm7
movaps xmm0, xmm2
addsd xmm0, xmm9
cvtpd2ps xmm0, xmm0
movss dword [rsp + 0x78], xmm0
movss dword [rsp + 0x7c], xmm5
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm8
movaps xmm0, xmm6
subsd xmm0, xmm2
cvtsd2ss xmm0, xmm0
movss dword [rsp + 0x60], xmm0
movss dword [rsp + 0x64], xmm1
mov dword [rsp + 0x28], 0xf
movss xmm0, dword [0x14003e014]
movss dword [rsp + 0x20], xmm0
mov r9d, eax
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x60]
lea rcx, [r10 + 0x1cc8]
call fcn.14001c824
cmp byte [0x14004413a], bl
je 0x1400311c8
movaps xmmword [rbp - 0x20], xmm14
movsd qword [rbp - 0x10], xmm15
lea rcx, [rbp - 0x20]
call fcn.140030630
cmp byte [0x140043052], bl
je 0x140031300
mov rcx, rdi
call fcn.1400307a4
test al, al
je 0x14003126a
mov ecx, dword [0x14004422c]
test ecx, ecx
je 0x14003123b
sub ecx, 1
je 0x14003122b
cmp ecx, 1
jne 0x14003126a
mov eax, 0x431bde83
imul dword [0x14004415c]
mov r10d, edx
sar r10d, 0x12
mov eax, r10d
shr eax, 0x1f
add r10d, eax
cvttsd2si r8d, xmm6
cvttsd2si r9d, xmm8
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, r10d
jmp 0x140031255
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
jmp 0x140031213
cvttsd2si r9d, qword [rbp - 0x58]
cvttsd2si r8d, xmm9
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, dword [0x14004415c]
sar eax, 1
mov ecx, eax
lea rax, [0x140043230]
mov qword [rsp + 0x20], rax
call fcn.14002e38c
mov rcx, rdi
call fcn.1400307a4
test al, al
jne 0x140031300
mov ecx, dword [0x14004422c]
test ecx, ecx
je 0x1400312d1
sub ecx, 1
je 0x1400312ab
cmp ecx, 1
jne 0x140031300
mov eax, 0x6b5fca6b
imul dword [0x14004415c]
mov r10d, edx
sar r10d, 0x16
mov eax, r10d
shr eax, 0x1f
add r10d, eax
jmp 0x1400312b9
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
mov r10d, eax
cvttsd2si r8d, xmm6
cvttsd2si r9d, xmm8
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, r10d
jmp 0x1400312eb
cvttsd2si r9d, qword [rbp - 0x58]
cvttsd2si r8d, xmm9
mov eax, dword [0x140044228]
cdq
sub eax, edx
mov edx, dword [0x14004415c]
sar eax, 1
mov ecx, eax
lea rax, [0x140043230]
mov qword [rsp + 0x20], rax
call fcn.14002e38c
mov eax, dword [0x140044228]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm2, qword [rbp]
subsd xmm2, xmm0
mov eax, dword [0x14004415c]
cdq
sub eax, edx
sar eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd xmm1, qword [rbp + 8]
subsd xmm1, xmm0
mulsd xmm1, xmm1
mulsd xmm2, xmm2
addsd xmm1, xmm2
cvtpd2ps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movaps xmm6, xmm0
mov rcx, rdi
call fcn.1400307a4
test al, al
je 0x14003137d
movd xmm1, dword [0x140043058]
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm6
jbe 0x14003137d
comiss xmm13, xmm6
jbe 0x14003137d
movaps xmm13, xmm6
mov rsi, r14
jmp 0x14003137d
xor ebx, ebx
inc r15d
cmp r15d, dword [rbp + 0x80]
jb 0x140030bf3
cmp byte [0x140044139], bl
je 0x1400313bb
cmp byte [0x14004413b], bl
je 0x1400313e2
test rsi, rsi
je 0x1400313bb
mov ecx, dword [0x1400442a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400313bb
mov rcx, rsi
call fcn.140030730
cmp byte [0x14004413b], bl
je 0x1400313e2
test rsi, rsi
je 0x1400313e2
mov ecx, dword [0x1400442a0]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400313e2
mov rcx, rsi
call fcn.140030730
nop
lea rcx, [rbp + 0xa0]
call fcn.140031ed4
nop
lea rcx, [rbp + 0x88]
call fcn.140031ed4
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.1400330c0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm13, xmmword [r11 - 0x70]
movaps xmm14, xmmword [r11 - 0x80]
movaps xmm15, xmmword [r11 - 0x90]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14002cb38
int3
call fcn.140032edc
int3