Function at 0x140111ab0
Capabilities:
Encode data using xor
Get file attributes
Log keystrokes via polling
Set console window title
Set file attributes

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
xorps xmm0, xmm0
mov rdi, rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
nop word [rax + rax]
mov rcx, qword [0x1408a67a0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [0x1408a67a0]
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov rdx, qword [0x1408a67a0]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov dword [rsp + 0x20], 1
xor r8d, r8d
call qword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x140111839
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
call fcn.140019510
mov rcx, qword [0x1408a67a0]
mov rbx, rax
mov qword [rax + 0xe30], rcx
lea rcx, [rbp + 0xb8]
mov dword [rax + 0x10], 0x3c888889
call qword [sym.imp.USER32.dll_GetCursorPos]
movd xmm0, dword [rbp + 0xb8]
mov ecx, 1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe40], xmm0
movd xmm0, dword [rbp + 0xbc]
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0xe44], xmm0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1401118b5
mov byte [rbx + 0xe48], 1
mov eax, dword [rbx + 0xe44]
mov dword [rbx + 0x3810], eax
mov byte [rbx + 0x3860], 1
jmp 0x1401118bc
mov byte [rbx + 0xe48], 0
xor ecx, ecx
call fcn.140049da0
call fcn.1400712e0
call fcn.140072640
call fcn.140019550
mov rcx, qword [0x1408a6cb8]
call fcn.1400ebeb0
cmp byte [0x1408a7249], 0
je 0x1401118f3
mov rcx, qword [0x1408a6bf0]
call fcn.1400e5eb0
cmp byte [0x1408a5b7d], 0
je 0x14011190d
cmp dword [0x1408a688c], 1
ja 0x14011190d
mov rcx, rdi
call fcn.140111f20
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movzx eax, byte [0x1408a5b7f]
cmp al, 1
jne 0x1401119c5
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
or eax, 6
lea rcx, [rsp + 0x70]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, qword [0x1408a67a0]
mov edx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
movzx ecx, word [0x14037e324]
mov eax, dword [str.EAPVIO_]
mov dword [rbp + 0xb0], eax
movzx eax, byte [0x14037e326]
xor byte [rbp + 0xb1], 0x37
xor al, 0x3c
xor byte [rbp + 0xb2], 0x38
xor byte [rbp + 0xb3], 0x39
mov word [rbp + 0xb4], cx
xor cl, 0x3a
xor byte [rbp + 0xb5], 0x3b
mov byte [rbp + 0xb4], cl
lea rcx, [rbp + 0xb0]
mov byte [rbp + 0xb0], reloc.WS2_32.dll_WSAStartup
mov byte [rbp + 0xb6], al
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
movzx eax, byte [0x1408a5b7f]
test al, al
jne 0x1401119f9
xor edx, edx
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov rcx, qword [0x1408a67a0]
xor edx, edx
call qword [sym.imp.USER32.dll_SetWindowDisplayAffinity]
lea rcx, [rbp + 0xa8]
mov byte [rbp + 0xa8], 0
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, rdi
call fcn.140103230
call fcn.14001aa10
mov rcx, qword [0x1408a67b8]
lea r8, [0x1408a67c8]
xorps xmm0, xmm0
xor r9d, r9d
movups xmmword [rsp + 0x60], xmm0
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x108]
mov rcx, qword [0x1408a67b8]
lea r8, [rsp + 0x60]
mov rdx, qword [0x1408a67c8]
mov rax, qword [rcx]
call qword [rax + 0x190]
call fcn.14001ad80
mov rcx, rax
call fcn.140071320
mov rcx, qword [0x1408a67c0]
xor r8d, r8d
mov edx, 1
mov rax, qword [rcx]
call qword [rax + 0x40]
cmp dword [rsp + 0x38], 0x12
jne 0x1401117e0
call fcn.140071250
call fcn.1400725d0
xor ecx, ecx
call fcn.140019490
mov rcx, qword [0x1408a67a0]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov al, 1
add rsp, 0x180
pop rdi
pop rbx
pop rbp
ret
push rbp
push rdi
lea rbp, [rsp - 0x4f]
sub rsp, 0xb8
mov rdi, rcx
call fcn.140101a90
test al, al
jne 0x140111eec
movsd xmm0, qword [str.yA_KVZE]
mov eax, dword [0x14037e330]
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xe0], rsi
mov esi, dword [reloc.WS2_32.dll_accept]
mov qword [rsp + 0xb0], r14
xor r14d, r14d
cmp byte [0x14037e333], r14b
movaps xmmword [rsp + 0xa0], xmm7
movdqa xmm7, xmmword [0x14037bad0]
movsd qword [rbp - 0x49], xmm0
mov dword [rbp - 0x41], eax
je 0x140111caa
mov r8d, r14d
cmp esi, 2
jl 0x140111c72
movdqa xmm2, xmmword [0x140379a20]
movdqa xmm4, xmmword [0x140380750]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x14037ba90]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
movdqa xmm5, xmmword [str.::::HKRC_NGO]
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, dword [str.yA_KVZE]
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14037bae0]
xorps xmm2, xmm0
movd dword [rbp - 0x49], xmm2
movdqa xmm2, xmmword [0x14037ba80]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm5
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rbp - 0x45]
andps xmm2, xmm7
packuswb xmm2, xmm2
pmuldq xmm1, xmm4
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14037bae0]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rbp - 0x45], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm3, xmm0
movd xmm0, eax
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x14037bae0]
xorps xmm3, xmm0
movd dword [rbp - 0x41], xmm3
jmp 0x140111caa
lea r9, [rbp - 0x49]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9 - 1], al
cmp r8d, 0xc
jl 0x140111c80
xorps xmm0, xmm0
mov qword [rbp - 0x29], r14
mov rbx, 0xffffffffffffffff
mov qword [rbp - 0x21], r14
movups xmmword [rbp - 0x39], xmm0
mov r8, rbx
lea rax, [rbp - 0x49]
inc r8
cmp byte [rax + r8], r14b
jne 0x140111cc7
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.14006d8c0
lea rcx, [rbp - 0x39]
call fcn.1400b1f80
movups xmm0, xmmword [0x14037e340]
cmp esi, 2
movups xmm1, xmmword [0x14037e350]
mov ecx, r14d
movzx eax, word [0x14037e388]
mov rsi, qword [rsp + 0xe0]
movups xmmword [rbp - 0x19], xmm0
mov word [rbp + 0x2f], ax
movups xmm0, xmmword [0x14037e360]
movups xmmword [rbp + 7], xmm0
movsd xmm0, qword [0x14037e380]
movups xmmword [rbp - 9], xmm1
movups xmm1, xmmword [0x14037e370]
movsd qword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x17], xmm1
jl 0x140111e5e
movdqa xmm0, xmmword [0x14037bae0]
lea rdx, [rbp - 0x15]
movdqa xmm4, xmmword [0x140379a20]
movdqa xmm3, xmmword [0x140380750]
movdqa xmm5, xmmword [str.::::HKRC_NGO]
movdqa xmmword [rbp - 0x49], xmm0
mov r8d, dword [rbp - 0x49]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x48
jl 0x140111d70
cmp ecx, 0x4a
jge 0x140111e9f
movsxd rax, ecx
lea r8, [rbp - 0x19]
add r8, rax
nop dword [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x36
xor byte [r8 - 1], al
cmp ecx, 0x4a
jl 0x140111e70
movaps xmm7, xmmword [rsp + 0xa0]
lea rax, [rbp - 0x19]
xorps xmm0, xmm0
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], r14
mov r14, qword [rsp + 0xb0]
movups xmmword [rbp - 0x39], xmm0
inc rbx
cmp byte [rax + rbx], 0
jne 0x140111ec2
mov r8, rbx
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 0x39]
call fcn.14006d8c0
lea rcx, [rbp - 0x39]
call fcn.1400b1d90
mov rbx, qword [rsp + 0xd0]
mov edx, 0x1f4
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
mov rcx, rdi
call fcn.140101f60
mov rcx, rdi
add rsp, 0xb8
pop rdi
pop rbp
jmp 0x1401117b0