Function at 0x140048560
Capabilities:
Get system information on windows
Log keystrokes via polling
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movsxd rbp, ecx
mov edi, 0x1008
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x14004861a
mov r14, 0xffffffffffffffff
nop dword [rax + rax]
xor r9d, r9d
mov r8d, edi
mov rdx, rbx
lea ecx, [r9 + 0x10]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
mov rcx, rbx
mov eax, 2
mul rdi
cmovo rax, r14
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_realloc]
mov rbx, rax
test rax, rax
je 0x1400485e0
add rdi, rdi
cmp esi, 0xc0000004
je 0x1400485a0
test rbx, rbx
je 0x14004861a
mov edx, dword [rax]
xor ecx, ecx
test rdx, rdx
je 0x14004860d
add rax, 0xc
cmp dword [rax - 4], 4
jne 0x140048601
cmp byte [rax], 7
je 0x140048795
inc rcx
add rax, 0x18
cmp rcx, rdx
jb 0x1400485f2
mov edx, 8
mov rcx, rbx
call fcn.14004f410
xor edi, edi
add rdi, qword [0x140199f68]
mov edx, 0x14
lea ecx, [rdx - 0x13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140048668
mov r8d, 0x14
mov qword [rax], rdi
mov rdx, rax
mov dword [rax + 8], 0x10
mov ecx, 0x83064000
call fcn.14004bbb0
test al, al
je 0x140048668
cmp dword [rbx], 0
jne 0x140048668
movups xmm0, xmmword [rbx + 4]
movups xmmword [rsp + 0x20], xmm0
mov r14, qword [rsp + 0x20]
mov r15, rbp
mov rbp, qword [0x140199f50]
xor edi, edi
mov rsi, r14
sub rsi, qword [0x140199f68]
add rbp, rsi
lea edx, [rdi + 0xc]
lea ecx, [rdi + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x1400486c1
lea r8d, [rdi + 0xc]
mov qword [rax], rbp
mov rdx, rax
mov dword [rax + 8], 8
mov ecx, 0x83064000
call fcn.14004bbb0
test al, al
je 0x1400486c1
cmp dword [rbx], edi
jne 0x1400486c1
mov rdi, qword [rbx + 4]
mov rbx, qword [0x140199f58]
mov edx, 0x10003
mov ecx, 1
add rbx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
test rax, rax
je 0x1400486fd
mov r8d, 0x10003
mov qword [rax], rbx
mov rdx, rax
mov dword [rax + 8], 0xffff
mov ecx, 0x83064000
call fcn.14004bbb0
mov rbp, qword [0x140199f68]
mov edx, 0x14
add rbp, rsi
lea ecx, [rdx - 0x13]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov rbx, rax
test rax, rax
je 0x140048747
mov r8d, 0x14
mov qword [rax], rbp
mov rdx, rax
mov dword [rax + 8], 0x10
mov ecx, 0x83064000
call fcn.14004bbb0
test al, al
je 0x140048747
cmp dword [rbx], 0
jne 0x140048747
mov r14, qword [rbx + 4]
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14004877d
mov rcx, qword [0x14019acc0]
test rcx, rcx
je 0x140048769
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x14019acc8], 0
je 0x14004877d
call fcn.14004dff0
call fcn.14004db70
cmp rdi, r15
je 0x1400487b0
cmp rdi, 4
je 0x140048791
test rdi, rdi
jne 0x140048670
xor eax, eax
jmp 0x1400487b3
lea rax, [rcx + rcx*2]
mov edx, 8
mov rdi, qword [rbx + rax*8 + 0x10]
mov rcx, rbx
call fcn.14004f410
jmp 0x14004861c
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret