Function at 0x14001e978
Capabilities:
Check if file exists
Get file attributes
Log keystrokes via polling

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x4030
call fcn.1400332d0
sub rsp, rax
mov rax, qword [0x140051040]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov r13, rcx
mov rbp, r8
mov r12d, edx
mov edi, 0xffc
lea rcx, [rsp + 0x2024]
xor r14d, r14d
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x2020], r14d
call fcn.140021ef0
lea rcx, [rsp + 0x24]
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x20], r14d
call fcn.140021ef0
lea rcx, [rsp + 0x3024]
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x3020], r14d
call fcn.140021ef0
mov rcx, qword [r13 + 0x45868]
lea r8, [rsp + 0x2020]
mov r9d, 0x800
mov edx, 0x410
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
cmp rbp, r14
je 0x14001ea31
lea rcx, [rsp + 0x2020]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x2020]
call fcn.1400193fc
lea rcx, [rsp + 0x3020]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r14d
jg 0x14001ea77
xor eax, eax
jmp 0x14001ec59
lea rcx, [rsp + 0x1024]
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x1020], r14d
call fcn.140021ef0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x1020]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rcx, [rsp + 0x1020]
call fcn.140019468
lea rcx, [rsp + 0x1020]
call fcn.1400196bc
cmp eax, r14d
jle 0x14001eb08
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
lea rcx, [rsp + 0x1020]
mov r11w, ax
lea rax, str.runas
shr r11d, 0xf
and r11d, 1
cmp r12d, r14d
cmovne r11d, r12d
neg r11d
sbb r8, r8
xor r9d, r9d
xor edx, edx
and r8, rax
call fcn.140017e00
jmp 0x14001ec59
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [rbx], 0x22
mov rsi, r14
movsxd rcx, eax
jne 0x14001eb38
mov edx, 1
mov rax, rdx
jmp 0x14001eb33
cmp word [rbx + rax*2], 0x22
je 0x14001eb56
inc edx
inc rax
cmp rax, rcx
jl 0x14001eb27
cmp rcx, r14
mov edx, r14d
mov rax, r14
jle 0x14001eb73
cmp word [rbx + rax*2], 0x20
je 0x14001eb66
inc rax
inc edx
cmp rax, rcx
jl 0x14001eb43
jmp 0x14001eb73
movsxd rax, edx
mov word [rbx + rax*2 + 2], r14w
lea rsi, [rbx + rax*2 + 4]
jmp 0x14001eb73
movsxd rax, edx
lea rsi, [rbx + rax*2 + 2]
mov word [rbx + rax*2], r14w
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, rsi
mov di, ax
shr edi, 0xf
and edi, 1
cmp r12d, r14d
cmovne edi, r12d
call fcn.140019468
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14001ebb4
neg edi
lea rcx, [rsp + 0x20]
sbb r8, r8
xor edx, edx
jmp 0x14001ec1b
cmp word [rbx], 0x73
je 0x14001ebc0
cmp word [rbx], 0x53
jne 0x14001ec10
cmp word [rbx + 2], 0x68
je 0x14001ebce
cmp word [rbx + 2], 0x48
jne 0x14001ec10
cmp word [rbx + 4], 0x65
je 0x14001ebdc
cmp word [rbx + 4], 0x45
jne 0x14001ec10
cmp word [rbx + 6], 0x6c
je 0x14001ebea
cmp word [rbx + 6], 0x4c
jne 0x14001ec10
cmp word [rbx + 8], 0x6c
je 0x14001ebf8
cmp word [rbx + 8], 0x4c
jne 0x14001ec10
cmp word [rbx + 0xa], 0x3a
jne 0x14001ec10
neg edi
lea rcx, [rsp + 0x3020]
sbb r8, r8
xor edx, edx
jmp 0x14001ec1b
neg edi
mov rdx, rsi
mov rcx, rbx
sbb r8, r8
lea rax, str.runas
xor r9d, r9d
and r8, rax
call fcn.140017e00
lea rdx, [rsp + 0x20]
lea rcx, str.last_run
mov ebx, eax
call fcn.140015358
cmp ebx, r14d
je 0x14001ec57
cmp rbp, r14
jne 0x14001ec57
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.14001e76c
mov eax, ebx
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140021e20
add rsp, 0x4030
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret