Function at 0x140043d80
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
sub rsp, 0x48
cmp byte [0x14011180a], 0
je 0x140043d92
call fcn.140043020
movsxd rax, dword [0x1401118cc]
cmp eax, 0xb
ja case.default.0x140043db3
lea rdx, [0x140000000]
mov ecx, dword [rdx + rax*4 + 0x44148]
add rcx, rdx
jmp rcx
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [0x140111ad0], 0
sete byte [0x140111ad0]
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [0x140111b91], 0
sete byte [0x140111b91]
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [0x140111abb], 0
sete byte [0x140111abb]
add rsp, 0x48
ret
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140043e3c
inc dword [0x1401104bc]
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
dec dword [0x1401104bc]
add rsp, 0x48
ret
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140043e6f
inc dword [reloc.WS2_32.dll_ntohs]
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
dec dword [reloc.WS2_32.dll_ntohs]
add rsp, 0x48
ret
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140043ea2
inc dword [0x140111af0]
mov ecx, Ordinal_41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
dec dword [0x140111af0]
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [0x1400cfaeb], 0
movsd xmm0, qword [str.gPZR_M]
mov eax, dword [0x1400cfae8]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
je 0x14004405f
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14004401a
movdqa xmm2, xmmword [0x1400d0400]
mov eax, 4
movdqa xmm4, xmmword [0x1400d07f0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x1400d0410]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x30], xmm6
movd xmm6, eax
mov eax, Ordinal_32
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400d0420]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.gPZR_M]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400d0480]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400d0610]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400d0420]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x24]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400d0480]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1400d0610]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x34
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0xc
jl 0x140044030
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140044070
lea rdx, [rsp + 0x20]
lea rcx, [0x140111d18]
call fcn.140050560
mov byte [0x14011180a], 1
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [reloc.WS2_32.dll_accept], 0
sete byte [0x140110489]
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [reloc.WS2_32.dll_accept], 0
sete byte [0x1401104b8]
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [reloc.WS2_32.dll_accept], 0
sete byte [0x140110488]
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [0x140111ab9], 0
sete byte [0x140111ab9]
add rsp, 0x48
ret
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je case.default.0x140043db3
cmp byte [reloc.WS2_32.dll_accept], 0
sete byte [0x1401104b9]
add rsp, 0x48
ret