Function at 0x18001a110
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x18027d040]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor esi, esi
cmp byte [0x1802b3b10], sil
jne 0x18001a749
movabs r14, 0x7fffffffffffffff
mov r15d, 0xff
nop dword [rax]
nop word [rax + rax]
mov eax, dword [0x1802b3b20]
inc eax
movsxd rbx, eax
lea rcx, [rsp + 0x48]
call fcn.180001690
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x30], rcx
test rbx, rbx
je 0x18001a1c5
js 0x18001a1c5
imul r8, rbx, 0xf4240
mov rax, r14
sub rax, r8
cmp rcx, rax
je 0x18001a1c0
mov edx, 1
cmovl edx, r15d
test dl, dl
jns 0x18001a1c0
lea rax, [r8 + rcx]
mov qword [rsp + 0x30], rax
jmp 0x18001a1c5
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.180004800
cmp byte [0x1802b3940], 0
je 0x18001a73c
cmp qword [0x1802b5648], 0
je 0x18001a73c
mov ecx, dword [0x1802b3944]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x18001a2ef
cmp byte [0x1802b4ac1], al
je 0x18001a73c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x18001a2b6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x18001a2b6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x40c95a6b
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18001a2b1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x18001a290
cmp r8d, 0x9f0d2813
je 0x18001a2bb
test r9d, r9d
jne 0x18001a270
mov rax, qword [rax]
jmp 0x18001a240
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov r8d, 0x28
lea rdx, [rbp + 8]
mov ecx, 1
call rax
mov byte [0x1802b4ac1], 0
jmp 0x18001a73c
mov rcx, qword [0x1802b4c68]
test rcx, rcx
je 0x18001a320
cmp dword [0x1802b4c60], 0
je 0x18001a320
mov qword [rsp + 0x20], rsi
mov r9d, 8
lea r8, [rbp + 0x30]
mov rdx, qword [0x1802b5480]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x68], rax
test rax, rax
je 0x18001a357
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
lea rcx, [0x1802b5380]
call fcn.180029760
mov rdx, qword [rax]
add rdx, 0x18
lea rcx, [rsp + 0x70]
call fcn.180019110
jmp 0x18001a38c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rax
lea rcx, [rsp + 0x70]
call fcn.180019060
nop
cmp dword [rsp + 0x78], 0
jle 0x18001a611
movups xmm0, xmmword [0x1802b5648]
movups xmmword [rbp + 8], xmm0
movups xmm6, xmmword [0x1802b5658]
mov rdx, qword [rsp + 0x70]
mov rbx, qword [0x1802b4c68]
test rdx, rdx
jne 0x18001a3c8
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x40], edx
xorps xmm1, xmm1
jmp 0x18001a403
test rbx, rbx
je 0x18001a3fd
cmp dword [0x1802b4c60], 0
je 0x18001a3fd
add rdx, 0x90
mov qword [rsp + 0x20], rsi
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rbx, qword [0x1802b4c68]
movss xmm1, dword [rsp + 0x38]
movaps xmm0, xmm6
shufps xmm0, xmm6, 0x55
subss xmm0, xmm1
movaps xmm1, xmm6
shufps xmm1, xmm6, 0xaa
subss xmm1, dword [rsp + 0x3c]
shufps xmm6, xmm6, 0xff
subss xmm6, dword [rsp + 0x40]
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm1, xmm0
mulss xmm6, xmm6
addss xmm1, xmm6
xorps xmm0, xmm0
ucomiss xmm0, xmm1
ja 0x18001a44a
xorps xmm0, xmm0
sqrtss xmm0, xmm1
jmp 0x18001a452
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movd xmm1, dword [0x1802b394c]
cvtdq2ps xmm1, xmm1
comiss xmm0, xmm1
setbe al
cmp byte [rbp - 0x7f], 0
je 0x18001a476
movzx eax, al
cmp byte [0x1802b3948], 0
cmove eax, esi
movzx edi, al
cmp byte [rbp - 0x50], 0
cmovne edi, esi
test rbx, rbx
je 0x18001a4ad
cmp dword [0x1802b4c60], 0
je 0x18001a4ad
mov qword [rsp + 0x20], rsi
mov r9d, 1
lea r8, [rbp]
mov rdx, qword [0x1802b5478]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp], 0
je 0x18001a611
test dil, dil
je 0x18001a611
cmp byte [0x1802b4ac1], 0
jne 0x18001a6fc
movsxd rbx, dword [0x1802b3950]
lea rcx, [rsp + 0x50]
call fcn.180001690
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
test rbx, rbx
je 0x18001a51e
js 0x18001a51e
imul r8, rbx, 0xf4240
mov rcx, r14
sub rcx, r8
cmp rax, rcx
je 0x18001a519
mov edx, 1
cmovl edx, r15d
test dl, dl
jns 0x18001a519
lea rcx, [rax + r8]
mov qword [rsp + 0x30], rcx
jmp 0x18001a51e
mov qword [rsp + 0x30], r14
lea rcx, [rsp + 0x30]
call fcn.180004800
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xc], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
mov dword [rbp + 8], esi
mov dword [rbp + 0x1c], 2
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x18001a5d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x18001a5d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x82b45fa5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18001a5d1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x18001a5b0
cmp r8d, 0xe712755d
je 0x18001a5db
test r9d, r9d
jne 0x18001a590
mov rax, qword [rax]
jmp 0x18001a560
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, 0x28
lea rdx, [rbp + 8]
mov ecx, 1
call r9
mov byte [0x1802b4ac1], 1
jmp 0x18001a6fc
cmp byte [0x1802b4ac1], 0
je 0x18001a6fc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x3c], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov dword [rbp + 0x38], esi
mov dword [rbp + 0x4c], 4
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x18001a6c6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x18001a6c6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x7c57c064
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x18001a6c1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x18001a6a0
cmp r8d, 0xdd2212ae
je 0x18001a6cb
test r9d, r9d
jne 0x18001a680
mov rax, qword [rax]
jmp 0x18001a650
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
mov r8d, 0x28
lea rdx, [rbp + 0x38]
mov ecx, 1
call r9
mov byte [0x1802b4ac1], 0
lea rcx, [rbp - 0x48]
call fcn.180004e60
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x18001a73c
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001a737
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a777
call fcn.180074ce4
cmp byte [0x1802b3b10], 0
je 0x18001a170
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.180074910
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3