Function at 0x1400ea050
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xc0
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, rcx
mov rbx, qword [rsp + 0x100]
mov r14, qword [rsp + 0x108]
cmp dword [rsp + 0x110], 0
jne 0x1400ea5d5
cmp r8d, 0x110
jne 0x1400ea0b9
call fcn.1400eaa90
mov qword [r14], rax
mov eax, 1
jmp 0x1400ea5d7
mov esi, 1
xor ebp, ebp
lea r15d, [rsi + 0xe]
cmp r8d, 0x111
jne 0x1400ea249
mov rax, r9
shr rax, 0x10
cmp si, r9w
jne 0x1400ea0f9
cmp bp, ax
jne 0x1400ea0f9
mov edx, esi
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
mov edx, 2
cmp dx, r9w
jne 0x1400ea121
cmp bp, ax
jne 0x1400ea357
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
mov eax, 0xc
cmp ax, r9w
jne 0x1400ea168
mov rax, r9
shr rax, 0x10
cmp bp, ax
jne 0x1400ea357
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_bandizip_
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r15w, r9w
jne 0x1400ea357
mov rax, r9
shr rax, 0x10
cmp bp, ax
jne 0x1400ea357
call fcn.1400dfe10
cmp byte [rax + 0x14], bpl
je 0x1400ea196
lea r8, str.ms_windows_store:__review__ProductId9P2W3W81SPPB
jmp 0x1400ea1fa
cmp dword [rdi + 0x1c8], 0x2f7d
jne 0x1400ea1c4
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
xor r9d, r9d
lea r8, str.https:__www.bandisoft.com_kb_xx_12157_
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [rdi + 0x17c]
test eax, eax
jne 0x1400ea1e0
mov rcx, rdi
call fcn.1400ebd00
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp eax, 2
jne 0x1400ea5ce
call fcn.1400dfe10
cmp dword [rax + 0x10], ebp
je 0x1400ea21f
lea r8, str.https:__www.bandisoft.com_bandizip_
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov qword [rsp + 0x20], rbp
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
mov rcx, rdi
call fcn.1400ecee0
mov edx, r15d
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_EnableWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, r15d
jne 0x1400ea29a
lea rdx, [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_BeginPaint]
cmp dword [rdi + 0x1a8], ebp
jne 0x1400ea280
lea rcx, [rdi + 0x48]
mov r9d, dword [rdi + 0xb4]
mov r8d, dword [rdi + 0xb0]
mov rdx, qword [rdi + 8]
call fcn.14008fb40
lea rdx, [rsp + 0x60]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_EndPaint]
mov qword [r14], rbp
mov rax, rsi
jmp 0x1400ea5d7
cmp r8d, 0x113
jne 0x1400ea314
mov ecx, reloc.COMCTL32.dll_InitCommonControls
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jae 0x1400ea2df
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jb 0x1400ea2e7
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
bt ecx, 0x10
jb 0x1400ea2e7
cmp dword [rdi + 0x128], ebp
je 0x1400ea2ec
mov r8d, esi
jmp 0x1400ea2f2
mov r8d, 0x64
xor r9d, r9d
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, rdi
call fcn.1400eb4f0
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, 0x201
jne 0x1400ea337
mov dword [rcx + 0x128], esi
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_SetCapture]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, 0x202
jne 0x1400ea357
mov dword [rcx + 0x128], ebp
call qword [sym.imp.USER32.dll_ReleaseCapture]
mov qword [r14], rbp
mov rax, rsi
jmp 0x1400ea5d7
cmp r8d, dword [0x14030f214]
jne 0x1400ea37d
cmp dword [rcx + 0x17c], 3
jne 0x1400ea5ce
mov dword [rcx + 0x1ac], ebx
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, dword [0x14030f218]
jne 0x1400ea416
cmp dword [rcx + 0x17c], 3
jne 0x1400ea5ce
cmp dword [rcx + 0x1ac], ebp
jl 0x1400ea5ce
mov qword [rsp + 0x50], rbp
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1400ea604
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r8d, dword [rdi + 0x1ac]
mov edx, 0x64
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_MulDiv]
mov r8d, eax
lea rdx, str._d___
lea rcx, [rsp + 0x50]
call fcn.14001c3d0
mov rbx, qword [rsp + 0x50]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
nop
lea rdx, [rbx - 0x18]
jmp 0x1400ea513
cmp r8d, dword [0x14030f21c]
jne 0x1400ea431
mov r9, rbx
call fcn.1400ec250
mov qword [r14], rax
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, dword [0x14030f224]
jne 0x1400ea451
mov dword [rcx + 0x1c4], r9d
mov dword [rcx + 0x1c8], ebx
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, 0x4e
jne 0x1400ea4bc
cmp qword [rbx + 8], 0x46e
jne 0x1400ea5d5
cmp dword [rbx + 0x10], 0xfffffdd9
jne 0x1400ea5d5
mov edx, 0x46e
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x130b
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov dword [rdi + 0x1a8], eax
mov rcx, qword [rdi + 0x180]
test eax, eax
jne 0x1400ea5c3
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, 0x111
jne 0x1400ea570
mov eax, InitCommonControls
cmp ax, r9w
mov rax, r9
jne 0x1400ea540
shr rax, 0x10
cmp bp, ax
jne 0x1400ea544
lea rcx, [rsp + 0x50]
call fcn.1400e0690
nop
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rbp
xor r9d, r9d
mov r8, qword [rax]
lea rdx, [0x140265d30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ea5ce
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
shr rax, 0x10
mov ecx, InitCommonControls
cmp cx, r9w
jne 0x1400ea5d5
cmp bp, ax
jne 0x1400ea5d5
mov byte [rdi + 0x40], sil
mov rdx, rsi
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_EndDialog]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
cmp r8d, 0x2e0
jne 0x1400ea5d5
shr r9, 0x10
movzx eax, r9w
mov dword [rcx + 0x1b0], eax
call fcn.1400eb970
call fcn.140044940
mov rcx, rax
mov rdx, qword [rdi + 8]
call fcn.140047d90
mov rcx, rdi
call fcn.1400ee220
mov rcx, qword [rdi + 0x180]
cmp dword [rdi + 0x1a8], ebp
jne 0x1400ea5c3
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
mov qword [r14], rbp
mov eax, esi
jmp 0x1400ea5d7
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1401f3bf0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.140019320
int3