Function at 0x1400ec6d0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rcx
mov rbx, qword [rsp + 0x100]
mov r14, qword [rsp + 0x108]
cmp dword [rsp + 0x110], 0
jne 0x1400ecc53
cmp r8d, 0x110
jne 0x1400ec739
call fcn.1400ed110
mov qword [r14], rax
mov eax, 1
jmp 0x1400ecc55
mov esi, 1
xor ebp, ebp
lea r15d, [rsi + 0xe]
cmp r8d, 0x111
jne 0x1400ec8c9
mov rax, r9
shr rax, 0x10
cmp si, r9w
jne 0x1400ec779
cmp bp, ax
jne 0x1400ec779
mov edx, esi
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
mov edx, 2
cmp dx, r9w
jne 0x1400ec7a1
cmp bp, ax
jne 0x1400ec9d5
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
mov eax, 0xc
cmp ax, r9w
jne 0x1400ec7e8
mov rax, r9
shr rax, 0x10
cmp bp, ax
jne 0x1400ec9d5
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r15w, r9w
jne 0x1400ec9d5
mov rax, r9
shr rax, 0x10
cmp bp, ax
jne 0x1400ec9d5
call fcn.1400e2200
cmp byte [rax + 0x14], bpl
je 0x1400ec816
lea r8, str.ms_windows_store:__review__ProductId9P2W3W81SPPB
jmp 0x1400ec87a
cmp dword [rdi + 0x1c8], 0x2f7d
jne 0x1400ec844
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_kb_xx_12157_
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [rdi + 0x17c]
test eax, eax
jne 0x1400ec860
mov rcx, rdi
call fcn.1400ee3c0
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp eax, 2
jne 0x1400ecc4c
call fcn.1400e2200
cmp dword [rax + 0x10], ebp
je 0x1400ec89f
lea r8, str.https:__www.bandisoft.com_bandizip_
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov qword [rsp + 0x20], rbp
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
mov rcx, rdi
call fcn.1400ef5a0
mov edx, r15d
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, r15d
jne 0x1400ec919
lea rdx, [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_BeginPaint]
cmp dword [rdi + 0x1a8], ebp
jne 0x1400ec900
lea rcx, [rdi + 0x48]
mov r9d, dword [rdi + 0xb4]
mov r8d, dword [rdi + 0xb0]
mov rdx, qword [rdi + 8]
call fcn.140092160
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_EndPaint]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, 0x113
jne 0x1400ec993
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jae 0x1400ec95e
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jb 0x1400ec966
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jb 0x1400ec966
cmp dword [rdi + 0x128], ebp
je 0x1400ec96b
mov r8d, esi
jmp 0x1400ec971
mov r8d, 0x64
xor r9d, r9d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, rdi
call fcn.1400edbb0
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, 0x201
jne 0x1400ec9b6
mov dword [rcx + 0x128], esi
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetCapture]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, 0x202
jne 0x1400ec9d5
mov dword [rcx + 0x128], ebp
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, dword [0x14031530c]
jne 0x1400ec9fb
cmp dword [rcx + 0x17c], 3
jne 0x1400ecc4c
mov dword [rcx + 0x1ac], ebx
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, dword [0x140315310]
jne 0x1400eca94
cmp dword [rcx + 0x17c], 3
jne 0x1400ecc4c
cmp dword [rcx + 0x1ac], ebp
jl 0x1400ecc4c
mov qword [rsp + 0x50], rbp
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1400ecc82
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r8d, dword [rdi + 0x1ac]
mov edx, 0x64
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, eax
lea rdx, str._d___
lea rcx, [rsp + 0x50]
call fcn.14001c4c0
mov rbx, qword [rsp + 0x50]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
nop
lea rdx, [rbx - 0x18]
jmp 0x1400ecb91
cmp r8d, dword [0x140315314]
jne 0x1400ecaaf
mov r9, rbx
call fcn.1400ee910
mov qword [r14], rax
mov eax, esi
jmp 0x1400ecc55
cmp r8d, dword [0x14031531c]
jne 0x1400ecacf
mov dword [rcx + 0x1c4], r9d
mov dword [rcx + 0x1c8], ebx
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, 0x4e
jne 0x1400ecb3a
cmp qword [rbx + 8], 0x46e
jne 0x1400ecc53
cmp dword [rbx + 0x10], 0xfffffdd9
jne 0x1400ecc53
mov edx, 0x46e
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x1a8], eax
mov rcx, qword [rdi + 0x180]
test eax, eax
jne 0x1400ecc41
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, 0x111
jne 0x1400ecbee
mov eax, InitCommonControls
cmp ax, r9w
mov rax, r9
jne 0x1400ecbbe
shr rax, 0x10
cmp bp, ax
jne 0x1400ecbc2
lea rcx, [rsp + 0x50]
call fcn.1400e2a80
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rax]
lea rdx, [0x14026ad70]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ecc4c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
shr rax, 0x10
mov ecx, InitCommonControls
cmp cx, r9w
jne 0x1400ecc53
cmp bp, ax
jne 0x1400ecc53
mov byte [rdi + 0x40], sil
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
cmp r8d, 0x2e0
jne 0x1400ecc53
shr r9, 0x10
movzx eax, r9w
mov dword [rcx + 0x1b0], eax
call fcn.1400ee030
call fcn.140044d30
mov rcx, rax
mov rdx, qword [rdi + 8]
call fcn.140048190
mov rcx, rdi
call fcn.1400f08f0
mov rcx, qword [rdi + 0x180]
cmp dword [rdi + 0x1a8], ebp
jne 0x1400ecc41
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ecc55
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401f74b0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.140019300
int3