Function at 0x1800555b8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x38]
sub rsp, 0x110
movaps xmmword [rax - 0x38], xmm6
xor r14d, r14d
cmp byte [0x1802c42fa], r14b
xorps xmm6, xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
je 0x180055bf1
mov rax, qword [0x1802c4280]
mov rbx, qword [rax]
test rbx, rbx
je 0x180055e6d
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x180055e6d
mov r13, qword [rbx + 0x30]
test r13, r13
je 0x180055e6d
movsd xmm0, qword [rbx + 0x90]
movabs rcx, 0x4f8644af03d0e0d6
mov edi, dword [rbx + 0x98]
movsd qword [rbp - 0x80], xmm0
call fcn.180048b2c
cmp byte [0x1802c41d4], r14b
mov byte [0x1802c4248], r14b
je 0x180055671
movd xmm0, dword [reloc.WS2_32.dll_ioctlsocket]
cvtdq2ps xmm0, xmm0
jmp 0x180055679
movss xmm0, dword [0x1800a39cc]
movss dword [0x18011f750], xmm0
movaps xmm0, xmmword [0x1800a3bd0]
movdqu xmmword [r13 + 0x30], xmm0
mov ecx, dword [str.WSAD_n]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
movss xmm7, dword [rbp - 0x7c]
movss xmm9, dword [rbp - 0x80]
movd xmm8, edi
test ax, ax
jns 0x180055782
mov qword [rbx + 0x320], r14
mov dword [rbx + 0x328], r14d
mov rax, qword [0x1802c4290]
test rax, rax
je 0x1800556d2
mov rax, qword [rax]
jmp 0x1800556d6
mov rax, qword [rbp + 0x40]
movsd xmm0, qword [rax + 0x3d0]
mov ecx, dword [rax + 0x3d8]
movsd qword [rsp + 0x70], xmm0
movss xmm1, dword [rsp + 0x70]
ucomiss xmm1, xmm6
mov dword [rsp + 0x78], ecx
jp 0x18005572b
jne 0x18005572b
movss xmm0, dword [rsp + 0x74]
ucomiss xmm0, xmm6
jp 0x18005572b
jne 0x18005572b
movd xmm3, ecx
ucomiss xmm3, xmm6
jp 0x180055731
jne 0x180055731
movsd xmm0, qword [rax + 0x40]
movss xmm3, dword [rax + 0x48]
movsd qword [rsp + 0x70], xmm0
movss xmm1, dword [rsp + 0x70]
jmp 0x180055731
movss xmm3, dword [rsp + 0x78]
movss xmm2, dword [0x18011f750]
movaps xmm0, xmm2
mulss xmm0, xmm1
movaps xmm1, xmm2
mulss xmm1, dword [rsp + 0x74]
addss xmm0, xmm9
mulss xmm2, xmm3
addss xmm1, xmm7
addss xmm2, xmm8
movss dword [rbx + 0x90], xmm0
movss dword [rbx + 0x94], xmm1
unpcklps xmm0, xmm1
movss dword [rbx + 0x98], xmm2
movsd qword [r13 + 0x50], xmm0
movss dword [r13 + 0x58], xmm2
mov ecx, dword [0x18011fb6c]
lea r12, [rbx + 0x324]
lea r15, [rbx + 0x328]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x18005587e
mov dword [rbx + 0x320], r14d
mov dword [r12], r14d
mov dword [r15], r14d
mov rax, qword [0x1802c4290]
test rax, rax
je 0x1800557c4
mov rax, qword [rax]
jmp 0x1800557c8
mov rax, qword [rbp + 0x40]
movsd xmm0, qword [rax + 0x3d0]
mov ecx, dword [rax + 0x3d8]
movsd qword [rsp + 0x70], xmm0
movss xmm2, dword [rsp + 0x70]
ucomiss xmm2, xmm6
mov dword [rsp + 0x78], ecx
jp 0x18005581d
jne 0x18005581d
movss xmm0, dword [rsp + 0x74]
ucomiss xmm0, xmm6
jp 0x18005581d
jne 0x18005581d
movd xmm5, ecx
ucomiss xmm5, xmm6
jp 0x180055823
jne 0x180055823
movsd xmm0, qword [rax + 0x40]
movss xmm5, dword [rax + 0x48]
movsd qword [rsp + 0x70], xmm0
movss xmm2, dword [rsp + 0x70]
jmp 0x180055823
movss xmm5, dword [rsp + 0x78]
movss xmm1, dword [0x18011f750]
movaps xmm4, xmm9
movss xmm0, dword [rsp + 0x74]
movaps xmm3, xmm7
mulss xmm2, xmm1
mulss xmm0, xmm1
subss xmm4, xmm2
mulss xmm5, xmm1
subss xmm3, xmm0
movaps xmm2, xmm8
subss xmm2, xmm5
movss dword [rbx + 0x90], xmm4
movaps xmm0, xmm4
movss dword [rbx + 0x94], xmm3
unpcklps xmm0, xmm3
movss dword [rbx + 0x98], xmm2
movsd qword [r13 + 0x50], xmm0
movss dword [r13 + 0x58], xmm2
mov rax, qword [0x1802c4338]
test rax, rax
jne 0x180055926
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r10, rsi
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18005590b
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x18005590b
mov r14d, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [r14 + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180055904
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x1800558e5
cmp r11d, 0x95466b05
je 0x180055960
test edx, edx
jne 0x1800558c9
xor r14d, r14d
mov rax, qword [r10]
mov r10, rax
cmp rax, rsi
je 0x18005591c
cmp qword [rax + 0x30], r14
jne 0x1800558a5
mov rax, r14
mov qword [0x1802c4338], rax
mov ecx, dword [0x18011fb70]
mov rdi, r15
call rax
test ax, ax
jns 0x180055a3c
mov dword [rbx + 0x320], r14d
lea rdi, [rbx + 0x328]
mov dword [r12], r14d
mov dword [rdi], r14d
mov rcx, qword [0x1802c4290]
test rcx, rcx
je 0x18005597d
mov rcx, qword [rcx]
jmp 0x180055981
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
xor r14d, r14d
jmp 0x18005591f
mov rcx, qword [rbp + 0x40]
mov rax, qword [rbx + 0x30]
mov dword [rax + 0x30], 0x3f800000
movsd xmm0, qword [rcx + 0x3d0]
mov eax, dword [rcx + 0x3d8]
movsd qword [rsp + 0x70], xmm0
movss xmm4, dword [rsp + 0x70]
ucomiss xmm4, xmm6
mov dword [rsp + 0x78], eax
jp 0x1800559e1
jne 0x1800559e1
movss xmm0, dword [rsp + 0x74]
ucomiss xmm0, xmm6
jp 0x1800559e1
jne 0x1800559e1
movd xmm3, eax
ucomiss xmm3, xmm6
jp 0x1800559e7
jne 0x1800559e7
movsd xmm0, qword [rcx + 0x40]
movss xmm3, dword [rcx + 0x48]
movsd qword [rsp + 0x70], xmm0
movss xmm4, dword [rsp + 0x70]
jmp 0x1800559e7
movss xmm3, dword [rsp + 0x78]
movss xmm1, dword [0x18011fb7c]
movaps xmm2, xmm9
movss xmm0, dword [rsp + 0x74]
mulss xmm0, xmm1
mulss xmm4, xmm1
subss xmm2, xmm0
mulss xmm3, xmm1
addss xmm4, xmm7
addss xmm3, xmm8
movss dword [rbx + 0x90], xmm2
movaps xmm0, xmm2
movss dword [rbx + 0x94], xmm4
unpcklps xmm0, xmm4
movss dword [rbx + 0x98], xmm3
movsd qword [r13 + 0x50], xmm0
movss dword [r13 + 0x58], xmm3
mov rax, qword [0x1802c4338]
test rax, rax
jne 0x180055ae7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r10, rsi
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180055ac9
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180055ac9
mov r14d, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [r14 + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180055ac2
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180055aa3
cmp r11d, 0x95466b05
je 0x180055b17
test edx, edx
jne 0x180055a87
xor r14d, r14d
mov rax, qword [r10]
mov r10, rax
cmp rax, rsi
je 0x180055ada
cmp qword [rax + 0x30], r14
jne 0x180055a63
mov rax, r14
mov qword [0x1802c4338], rax
mov rdi, r15
mov ecx, dword [0x18011fb74]
call rax
test ax, ax
jns 0x180055bf1
mov dword [rbx + 0x320], r14d
mov dword [r12], r14d
mov dword [rdi], r14d
mov rcx, qword [0x1802c4290]
test rcx, rcx
je 0x180055b34
mov rcx, qword [rcx]
jmp 0x180055b38
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
xor r14d, r14d
jmp 0x180055add
mov rcx, qword [rbp + 0x40]
mov rax, qword [rbx + 0x30]
mov dword [rax + 0x30], 0x3f800000
movsd xmm0, qword [rcx + 0x3d0]
mov eax, dword [rcx + 0x3d8]
movsd qword [rsp + 0x70], xmm0
movss xmm3, dword [rsp + 0x70]
ucomiss xmm3, xmm6
mov dword [rsp + 0x78], eax
jp 0x180055b98
jne 0x180055b98
movss xmm0, dword [rsp + 0x74]
ucomiss xmm0, xmm6
jp 0x180055b98
jne 0x180055b98
movd xmm2, eax
ucomiss xmm2, xmm6
jp 0x180055b9e
jne 0x180055b9e
movsd xmm0, qword [rcx + 0x40]
movss xmm2, dword [rcx + 0x48]
movsd qword [rsp + 0x70], xmm0
movss xmm3, dword [rsp + 0x70]
jmp 0x180055b9e
movss xmm2, dword [rsp + 0x78]
movss xmm0, dword [0x18011fb7c]
movss xmm1, dword [rsp + 0x74]
mulss xmm1, xmm0
mulss xmm3, xmm0
mulss xmm2, xmm0
addss xmm1, xmm9
subss xmm7, xmm3
subss xmm8, xmm2
movss dword [rbx + 0x90], xmm1
movaps xmm0, xmm1
movss dword [rbx + 0x94], xmm7
unpcklps xmm0, xmm7
movss dword [rbx + 0x98], xmm8
movsd qword [r13 + 0x50], xmm0
movss dword [r13 + 0x58], xmm8
cmp byte [0x1802c42f8], r14b
jne 0x180055cb8
mov rax, qword [0x1802c4338]
test rax, rax
jne 0x180055ca7
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180055c8c
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180055c8c
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180055c88
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x180055c65
cmp r11d, 0x95466b05
je 0x180055ea7
test edx, edx
jne 0x180055c49
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x180055c9d
cmp qword [rax + 0x30], r14
jne 0x180055c25
mov rax, r14
mov qword [0x1802c4338], rax
mov ecx, dword [0x18011f778]
call rax
test ax, ax
js 0x180055e6d
movabs rcx, 0xd80958fc74e988a6
call fcn.180048b2c
mov ebx, eax
test eax, eax
je 0x180055e6d
mov edx, eax
movabs rcx, 0xa6db4965674d243
call fcn.180048be0
xor r8d, r8d
mov edx, eax
movabs rcx, 0x3133b907d8b32053
mov edi, eax
call fcn.180049074
movaps xmm9, xmm0
call fcn.180054808
mov rsi, rax
test edi, edi
je 0x180055e6d
ucomiss xmm9, xmm6
jp 0x180055d18
je 0x180055e6d
test rsi, rsi
je 0x180055e6d
xor r8d, r8d
lea rcx, [rbp - 0x80]
mov rdx, rsi
call fcn.180054538
movsd xmm0, qword [rsi + 0x90]
lea rdx, [rbp - 0x70]
movss xmm10, dword [rsi + 0x98]
lea rcx, [rbp + 0x40]
movss xmm8, dword [0x1802c42e0]
movss xmm6, dword [0x1802c42e4]
mov esi, dword [rbp - 0x78]
mulss xmm8, dword [0x1800a39ec]
mov dword [rbp - 0x68], esi
mulss xmm6, dword [0x1800a39ec]
movsd qword [rsp + 0x70], xmm0
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbp - 0x70], xmm0
call fcn.1800561b0
movss xmm0, dword [rbp + 0x44]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x1800aae70]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0x40]
cvtps2pd xmm1, xmm8
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x1800aae70]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
mov eax, dword [0x1802c42f0]
lea ecx, [rax + rax*2]
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x180055e6d
mov edx, ebx
movabs rcx, 0x34616828cd07f1a1
call fcn.180048be0
test eax, eax
je 0x180055e6d
movss xmm0, dword [0x1800a3a14]
movaps xmm3, xmm10
movss xmm4, dword [rbp - 0x7c]
movabs rcx, 0x867654cbc7606f2c
movss xmm2, dword [rsp + 0x74]
movss xmm1, dword [rsp + 0x70]
movss dword [rsp + 0x68], xmm0
movss xmm0, dword [rbp - 0x80]
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x40], 1
cvttss2si eax, xmm9
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], esi
movss dword [rsp + 0x28], xmm4
movss dword [rsp + 0x20], xmm0
call fcn.180049654
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180055ca0