Function at 0x140001420
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
mov r11, rsp
push rbp
push rsi
lea rbp, [r11 - 0x5f]
sub rsp, 0xa8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [r11 + 8], rbx
lea rdx, [rbp - 0x29]
mov qword [r11 - 0x18], r13
xorps xmm0, xmm0
movups xmmword [rbp - 0x29], xmm0
xor eax, eax
mov qword [r11 - 0x20], r14
mov r13d, 9
mov qword [rbp - 9], rax
mov r8d, 0x28
mov word [rbp - 0x21], r13w
mov ecx, 1
mov dword [rbp - 0x29], 1
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x1d], 2
lea rdx, [rbp - 0x29]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [0x140005078]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0xf
mov dword [rbp - 0x39], 0x434c4548
mov dword [rbp - 0x35], 0x41474548
lea rbx, [rbp - 0x39]
mov dword [rbp - 0x31], 0x47454c55
mov word [rbp - 0x2d], 0x4f42
mov byte [rbp - 0x2b], 0x4f
call fcn.140001ed0
mov r8d, 0xf
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call sub.VCRUNTIME140.dll_memmove
lea r14, [rsi + 0xf]
mov rbx, rsi
cmp rsi, r14
je 0x1400017ce
mov qword [rsp + 0xc8], rdi
mov qword [rsp + 0xd0], r12
mov r12d, 8
mov qword [rsp + 0x90], r15
xor r15d, r15d
nop dword [rax]
mov edx, 0xe6
mov ecx, 0xfa
call qword [sym.imp.USER32.dll_SetCursorPos]
xorps xmm0, xmm0
mov dword [rbp - 0x29], r15d
xor eax, eax
lea rdx, [rbp - 0x29]
movups xmmword [rbp - 0x21], xmm0
mov r8d, 0x28
mov ecx, 2
movups xmmword [rbp - 1], xmm0
mov dword [rbp - 0x15], 2
movups xmmword [rbp + 0xf], xmm0
mov dword [rbp - 1], r15d
mov dword [rbp + 0x13], 4
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp + 0x1f], rax
call qword [sym.imp.USER32.dll_SendInput]
xorps xmm0, xmm0
lea rdx, [rbp - 0x29]
movups xmmword [rbp - 0x29], xmm0
xor eax, eax
mov dword [rbp - 0x29], 1
mov r8d, 0x28
mov word [rbp - 0x21], r12w
mov ecx, 1
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x1d], 2
lea rdx, [rbp - 0x29]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
xorps xmm0, xmm0
lea rdx, [rbp - 0x29]
movups xmmword [rbp - 0x29], xmm0
xor eax, eax
mov dword [rbp - 0x29], 1
mov r8d, 0x28
mov word [rbp - 0x21], r12w
mov ecx, 1
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x1d], 2
lea rdx, [rbp - 0x29]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
xorps xmm0, xmm0
lea rdx, [rbp - 0x29]
movups xmmword [rbp - 0x29], xmm0
xor eax, eax
mov dword [rbp - 0x29], 1
mov r8d, 0x28
mov word [rbp - 0x21], r12w
mov ecx, 1
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x1d], 2
lea rdx, [rbp - 0x29]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
lea rdi, [rbx + 3]
cmp rbx, rdi
je 0x1400016da
nop word [rax + rax]
movsx ecx, byte [rbx]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x29], 1
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rax
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov r8d, 0x28
lea rdx, [rbp - 0x29]
mov ecx, 1
mov word [rbp - 0x21], ax
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x1d], 2
lea rdx, [rbp - 0x29]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [0x140005074]
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, rdi
jne 0x140001670
mov edx, 0x14a
mov ecx, 0xc8
call qword [sym.imp.USER32.dll_SetCursorPos]
mov ecx, dword [0x140005074]
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
mov dword [rbp - 0x29], r15d
xor eax, eax
lea rdx, [rbp - 0x29]
movups xmmword [rbp - 0x21], xmm0
mov r8d, 0x28
mov ecx, 2
movups xmmword [rbp - 1], xmm0
mov dword [rbp - 0x15], 2
movups xmmword [rbp + 0xf], xmm0
mov dword [rbp - 1], r15d
mov dword [rbp + 0x13], 4
movups xmmword [rbp - 0x11], xmm0
mov qword [rbp + 0x1f], rax
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [0x140005074]
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x29], xmm0
mov ecx, 0x45
mov dword [rbp - 0x29], 1
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], rax
call qword [sym.imp.USER32.dll_VkKeyScanW]
mov r8d, 0x28
lea rdx, [rbp - 0x29]
mov ecx, 1
mov word [rbp - 0x21], ax
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x1d], 2
lea rdx, [rbp - 0x29]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov ecx, dword [0x140005074]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, rdi
cmp rdi, r14
jne 0x140001520
mov r15, qword [rsp + 0x90]
mov r12, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xc8]
xorps xmm0, xmm0
lea rdx, [rbp - 0x29]
movups xmmword [rbp - 0x29], xmm0
xor eax, eax
mov dword [rbp - 0x29], 1
mov r8d, 0x28
mov word [rbp - 0x21], r13w
mov ecx, 1
mov qword [rbp - 9], rax
movups xmmword [rbp - 0x19], xmm0
call qword [sym.imp.USER32.dll_SendInput]
mov r8d, 0x28
mov dword [rbp - 0x1d], 2
lea rdx, [rbp - 0x29]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov r14, qword [rsp + 0x98]
mov r13, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xc0]
test rsi, rsi
je 0x140001846
mov edx, 0xf
mov rcx, rsi
call fcn.140001f0c
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140001eb0
add rsp, 0xa8
pop rsi
pop rbp
ret