Function at 0x180005ae4
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x18004b010]
xor rax, rsp
mov qword [rbp - 0x30], rax
movabs rax, qword [0x142293718]
mov rcx, qword [rax + 0xd0]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x78]
call rdx
xor r13d, r13d
lea rdx, [rbp - 0x48]
mov qword [rbp - 0x48], r13
mov rcx, qword [rax]
mov r8, qword [rcx + 0x470]
mov rcx, rax
call r8
neg al
sbb r12, r12
and r12, qword [rbp - 0x48]
mov qword [rbp - 0x48], r12
je 0x1800063e5
mov rax, qword [r12]
xor edx, edx
mov rcx, r12
mov r8, qword [rax + 0x1d0]
call r8
mov r15, rax
test rax, rax
je 0x1800063e5
lea rdi, [rax + 0x28]
test rdi, rdi
je 0x1800063e5
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1800063e5
mov r14, qword [r12 + 0xd80]
test r14, r14
je 0x1800063e5
mov rsi, qword [rdx + 0xc0]
test rsi, rsi
je 0x1800063e5
cmp qword [r12 + 0x18], r13
je 0x1800063e5
movabs rax, qword [0x142293718]
mov rcx, qword [rax + 0xd0]
mov rbx, qword [rcx + 0x130]
cmp qword [rdx + 0xb0], r13
je 0x1800063e5
cmp byte [0x18007f6f9], r13b
lea r9d, [r13 + 0x52]
je 0x180005c6c
lea ecx, [r13 + 0x42]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180005c66
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x58]
mov rdx, qword [rsi + 0x68]
lea r9d, [r13 + 0x52]
mov dword [rbp - 0x60], 0x459c4000
mov rcx, rdx
mov rax, qword [rdx + 8]
cmp byte [rax + 0x19], r13b
jne 0x180005c44
cmp word [rax + 0x1c], r9w
jae 0x180005c3c
mov rax, qword [rax + 0x10]
jmp 0x180005c29
mov rcx, rax
mov rax, qword [rax]
jmp 0x180005c29
cmp byte [rcx + 0x19], r13b
jne 0x180005c6c
cmp r9w, word [rcx + 0x1c]
jb 0x180005c6c
cmp rcx, rdx
je 0x180005c6c
add rcx, 0x20
je 0x180005c6c
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
jmp 0x180005c6c
mov r9d, 0x52
cmp byte [0x18007f6e1], r13b
je 0x180005cce
mov rdx, qword [rsi + 0x68]
mov r8d, 0x6e
movss xmm0, dword [0x180045e18]
mov rcx, rdx
movss dword [rbp - 0x60], xmm0
mov rax, qword [rdx + 8]
jmp 0x180005ca8
cmp word [rax + 0x1c], r8w
jae 0x180005ca2
mov rax, qword [rax + 0x10]
jmp 0x180005ca8
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180005c95
cmp byte [rcx + 0x19], r13b
jne 0x180005cce
cmp r8w, word [rcx + 0x1c]
jb 0x180005cce
cmp rcx, rdx
je 0x180005cce
add rcx, 0x20
je 0x180005cce
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
cmp byte [0x18007f702], r13b
mov r10d, 1
mov rcx, qword [rsi + 0x68]
movss xmm7, dword [0x180045d58]
mov rdx, rcx
mov rax, qword [rcx + 8]
je 0x180005d27
mov dword [rbp - 0x60], 0x459c4000
cmp byte [rax + 0x19], r13b
jne 0x180005d1a
cmp word [rax + 0x1c], r9w
jae 0x180005d0a
mov rax, qword [rax + 0x10]
jmp 0x180005d10
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180005cfd
mov rdx, qword [rsi + 0x68]
cmp byte [rcx + 0x19], r13b
jne 0x180005d71
cmp r9w, word [rcx + 0x1c]
jmp 0x180005d5c
mov dword [rbp - 0x60], 0x3f800000
cmp byte [rax + 0x19], r13b
jne 0x180005d51
cmp word [rax + 0x1c], r10w
jae 0x180005d41
mov rax, qword [rax + 0x10]
jmp 0x180005d47
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180005d34
mov rdx, qword [rsi + 0x68]
cmp byte [rcx + 0x19], r13b
jne 0x180005d71
cmp r10w, word [rcx + 0x1c]
jb 0x180005d71
cmp rcx, rdx
je 0x180005d71
add rcx, 0x20
je 0x180005d71
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
cmp byte [0x18007f6cb], r13b
je 0x180005d84
mov dword [rbx + 0x4c0], 0x497423f0
cmp byte [0x18007f6f2], r13b
je 0x180005d91
mov dword [rbx + 0x44], r13d
cmp byte [0x18007f6c1], r13b
je 0x180005db5
mov byte [rbx + 0x178], r13b
mov dword [rbx + 0x854], 0x5d5e0b6b
mov dword [rbx + 0x858], 0x60ad78ec
cmp byte [0x18007f6ec], r13b
xorps xmm6, xmm6
mov rax, qword [r12 + 0xd80]
je 0x180005dd3
movss xmm0, dword [0x180045dbc]
jmp 0x180005dd6
xorps xmm0, xmm0
movss dword [rax], xmm0
cmp byte [0x18007f67d], r13b
je 0x180005e87
mov rdx, qword [rsi + 0x68]
mov r8d, 0x4a
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180005e11
cmp word [rax + 0x1c], r8w
jae 0x180005e0b
mov rax, qword [rax + 0x10]
jmp 0x180005e11
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180005dfe
cmp byte [rcx + 0x19], r13b
jne 0x180005e37
cmp r8w, word [rcx + 0x1c]
jb 0x180005e37
cmp rcx, rdx
je 0x180005e37
add rcx, 0x20
je 0x180005e37
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
mov rdx, qword [rsi + 0x68]
mov r8d, 0x4b
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180005e61
cmp word [rax + 0x1c], r8w
jae 0x180005e5b
mov rax, qword [rax + 0x10]
jmp 0x180005e61
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180005e4e
cmp byte [rcx + 0x19], r13b
jne 0x180005e87
cmp r8w, word [rcx + 0x1c]
jb 0x180005e87
cmp rcx, rdx
je 0x180005e87
add rcx, 0x20
je 0x180005e87
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
cmp byte [0x18007f6c4], r13b
mov ebx, 0x51eb851f
je 0x180005ef9
cmp byte [0x18004589d], r13b
mov eax, dword [0x180045898]
movsd xmm0, qword [str.f__ZPDgJVP_I_]
mov rcx, qword [r12 + 0x10]
mov dword [rbp - 0x38], eax
movzx eax, word [0x18004589c]
mov word [rbp - 0x34], ax
movsd qword [rbp - 0x40], xmm0
je 0x180005eef
mov r8d, r13d
lea r9, [rbp - 0x40]
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul edx, eax, 0x32
mov al, r8b
add r8d, r10d
sub al, dl
add al, 0x31
xor byte [r9], al
add r9, r10
cmp r8d, 0xe
jl 0x180005ecb
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x58]
cmp byte [0x18007f675], r13b
je 0x180005f24
movss dword [r14 + 0xb8], xmm6
movss dword [r14 + 0xbc], xmm6
movss dword [r14 + 0xc0], xmm6
mov byte [r14 + 0xb4], r13b
mov rcx, qword [r15 + 0x10]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x60]
call rdx
cmp byte [0x18007f693], r13b
mov r10, rax
mov r14d, 1
je 0x180005fb4
movzx ecx, word [0x180045850]
lea r9, [rbp - 0x60]
mov word [rbp - 0x60], cx
mov r8d, r13d
mov cl, byte [0x180045852]
mov byte [rbp - 0x5e], cl
mov eax, ebx
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, r14d
sub al, cl
add al, 0x31
xor byte [r9], al
add r9, r14
cmp r8d, 3
jl 0x180005f5e
lea rdx, [rbp - 0x60]
mov rcx, r10
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x180005fb4
mov ecx, r14d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x180005fb4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x58]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x60]
cmp byte [0x18007f679], r13b
je 0x18000605b
mov rdx, qword [rsi + 0x68]
mov r8d, 0x61
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180005feb
cmp word [rax + 0x1c], r8w
jae 0x180005fe5
mov rax, qword [rax + 0x10]
jmp 0x180005feb
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180005fd8
cmp byte [rcx + 0x19], r13b
jne 0x180006011
cmp r8w, word [rcx + 0x1c]
jb 0x180006011
cmp rcx, rdx
je 0x180006011
add rcx, 0x20
je 0x180006011
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
mov rdx, qword [rsi + 0x68]
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180006035
cmp word [rax + 0x1c], r8w
jae 0x18000602f
mov rax, qword [rax + 0x10]
jmp 0x180006035
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180006022
cmp byte [rcx + 0x19], r13b
jne 0x18000605b
cmp r8w, word [rcx + 0x1c]
jb 0x18000605b
cmp rcx, rdx
je 0x18000605b
add rcx, 0x20
je 0x18000605b
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
cmp byte [0x18007f678], r13b
je 0x180006248
mov rdx, qword [rsi + 0x68]
mov r8d, 0x3a
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180006092
cmp word [rax + 0x1c], r8w
jae 0x18000608c
mov rax, qword [rax + 0x10]
jmp 0x180006092
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x18000607f
cmp byte [rcx + 0x19], r13b
jne 0x1800060b8
cmp r8w, word [rcx + 0x1c]
jb 0x1800060b8
cmp rcx, rdx
je 0x1800060b8
add rcx, 0x20
je 0x1800060b8
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
mov rdx, qword [rsi + 0x68]
mov r8d, 0x3b
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x1800060e2
cmp word [rax + 0x1c], r8w
jae 0x1800060dc
mov rax, qword [rax + 0x10]
jmp 0x1800060e2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x1800060cf
cmp byte [rcx + 0x19], r13b
jne 0x180006108
cmp r8w, word [rcx + 0x1c]
jb 0x180006108
cmp rcx, rdx
je 0x180006108
add rcx, 0x20
je 0x180006108
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
mov rdx, qword [rsi + 0x68]
mov r8d, 0x3f
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180006132
cmp word [rax + 0x1c], r8w
jae 0x18000612c
mov rax, qword [rax + 0x10]
jmp 0x180006132
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x18000611f
cmp byte [rcx + 0x19], r13b
jne 0x180006158
cmp r8w, word [rcx + 0x1c]
jb 0x180006158
cmp rcx, rdx
je 0x180006158
add rcx, 0x20
je 0x180006158
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
mov rdx, qword [rsi + 0x68]
mov r8d, 0x55
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180006182
cmp word [rax + 0x1c], r8w
jae 0x18000617c
mov rax, qword [rax + 0x10]
jmp 0x180006182
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x18000616f
cmp byte [rcx + 0x19], r13b
jne 0x1800061a8
cmp r8w, word [rcx + 0x1c]
jb 0x1800061a8
cmp rcx, rdx
je 0x1800061a8
add rcx, 0x20
je 0x1800061a8
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
mov rdx, qword [rsi + 0x68]
mov r8d, 0x56
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x1800061d2
cmp word [rax + 0x1c], r8w
jae 0x1800061cc
mov rax, qword [rax + 0x10]
jmp 0x1800061d2
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x1800061bf
cmp byte [rcx + 0x19], r13b
jne 0x1800061f8
cmp r8w, word [rcx + 0x1c]
jb 0x1800061f8
cmp rcx, rdx
je 0x1800061f8
add rcx, 0x20
je 0x1800061f8
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
mov rdx, qword [rsi + 0x68]
mov r8d, 0x57
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180006222
cmp word [rax + 0x1c], r8w
jae 0x18000621c
mov rax, qword [rax + 0x10]
jmp 0x180006222
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x18000620f
cmp byte [rcx + 0x19], r13b
jne 0x180006248
cmp r8w, word [rcx + 0x1c]
jb 0x180006248
cmp rcx, rdx
je 0x180006248
add rcx, 0x20
je 0x180006248
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
cmp byte [0x18007f67f], r13b
je 0x1800062a1
mov rdx, qword [rsi + 0x68]
mov r8d, 0x1f
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x18000627b
cmp word [rax + 0x1c], r8w
jae 0x180006275
mov rax, qword [rax + 0x10]
jmp 0x18000627b
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180006268
cmp byte [rcx + 0x19], r13b
jne 0x1800062a1
cmp r8w, word [rcx + 0x1c]
jb 0x1800062a1
cmp rcx, rdx
je 0x1800062a1
add rcx, 0x20
je 0x1800062a1
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
cmp byte [0x18007f6ca], r13b
je 0x1800062c8
mov ecx, 0x42
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov rcx, r12
mov rax, qword [r12]
setne dl
call qword [rax + 0x218]
cmp byte [0x18007f6c8], r13b
je 0x180006321
mov rdx, qword [rsi + 0x68]
mov r8d, 0x68
and dword [rbp - 0x60], r13d
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x1800062fb
cmp word [rax + 0x1c], r8w
jae 0x1800062f5
mov rax, qword [rax + 0x10]
jmp 0x1800062fb
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x1800062e8
cmp byte [rcx + 0x19], r13b
jne 0x180006321
cmp r8w, word [rcx + 0x1c]
jb 0x180006321
cmp rcx, rdx
je 0x180006321
add rcx, 0x20
je 0x180006321
mov eax, dword [rbp - 0x60]
xor eax, dword [rcx + 4]
mov dword [rcx], eax
cmp byte [0x18007f6c5], r13b
je 0x1800063bb
cmp byte [0x18007f6c6], r13b
je 0x18000637b
mov rbx, qword [r12 + 0x10]
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x180006356
movss xmm0, dword [0x180045da8]
jmp 0x180006359
movaps xmm0, xmm7
movss dword [rbp - 0x58], xmm0
lea rdx, [rbp - 0x58]
movss dword [rbp - 0x54], xmm0
mov r8, r14
movss dword [rbp - 0x50], xmm0
mov rcx, rbx
mov rax, qword [rbx]
call qword [rax + 0xf8]
cmp byte [0x18007f6c7], r13b
je 0x1800063e5
mov rbx, qword [r12 + 0x10]
mov ecx, 0x4d
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x1800063a1
movss xmm7, dword [0x180045ee4]
movss dword [rbp - 0x58], xmm7
mov r8, r14
movss dword [rbp - 0x54], xmm7
mov rcx, rbx
movss dword [rbp - 0x50], xmm7
mov rax, qword [rbx]
jmp 0x1800063db
mov rcx, qword [r12 + 0x10]
xor r8d, r8d
mov dword [rbp - 0x58], 0x3f800000
mov dword [rbp - 0x54], 0x3f800000
mov dword [rbp - 0x50], 0x3f800000
mov rax, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [rax + 0xf8]
mov rcx, qword [rbp - 0x30]
xor rcx, rsp
call fcn.18000be90
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret