Function at 0x140024100
Capabilities:
Execute command
Log keystrokes via polling
Self delete

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
cmp byte [0x1400c912a], 0
jne 0x1400244ec
mov ecx, dword [0x1400c91ac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor esi, esi
test al, 1
je 0x1400242dc
cmp dword [0x1400c9140], esi
jne 0x1400242dc
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x48], 0xf
mov rax, qword [str.del__Q]
mov dword [rsp + 0x30], eax
movzx eax, word [0x1400a102c]
mov word [rsp + 0x34], ax
movzx eax, byte [0x1400a102e]
mov byte [rsp + 0x36], al
mov byte [rsp + 0x37], sil
movups xmmword [rsp + 0x50], xmm0
lea ecx, [rsi + 0x30]
call fcn.140097c60
mov r9, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x22
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [str.C:WindowsPrefetchSKYWALKER..pf]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400a1040]
movups xmmword [rax + 0x10], xmm1
movzx ecx, word [0x1400a1050]
mov word [rax + 0x20], cx
mov byte [rax + 0x22], sil
mov rdi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
sub rax, rdi
cmp rax, 0x22
jb 0x140024224
lea rax, [rdi + 0x22]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x30]
lea rcx, [rbx + rdi]
lea r8d, [rsi + 0x22]
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi + 0x22], sil
lea rax, [rsp + 0x30]
jmp 0x14002423e
mov qword [rsp + 0x20], 0x22
xor r8d, r8d
lea edx, [r8 + 0x22]
lea rcx, [rsp + 0x30]
call fcn.140003c40
cmp qword [rax + 0x18], 0xf
jbe 0x140024248
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, esi
xchg byte [0x1400c9031], al
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14002429a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024294
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097c9c
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400242f3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400242d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400242d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097c9c
jmp 0x1400242f3
mov ecx, dword [0x1400c91ac]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1400242f3
mov dword [0x1400c9140], esi
test dword [0x1400c9120], 0xfffffffd
jne 0x14002438e
mov ecx, dword [0x1400c90f8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14002438e
mov eax, dword [0x1400c90ec]
cmp dword [0x1400c90f8], eax
jne 0x14002434b
mov rcx, qword [0x1400c8f50]
cmp byte [0x1400c90e8], 0
je 0x140024338
call fcn.140020d00
jmp 0x14002433d
call fcn.14002bf30
cmp byte [0x1400c90e8], 0
sete byte [0x1400c90e8]
cmp byte [0x1400c91aa], 0
je 0x140024364
mov edx, 0x64
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Beep]
mov rcx, qword [0x1400c8f48]
cmp byte [0x1400c8f70], 0
je 0x14002437b
call fcn.140020d00
jmp 0x140024380
call fcn.14002bd70
cmp byte [0x1400c8f70], 0
sete byte [0x1400c8f70]
test dword [0x1400c9114], 0xfffffffd
jne 0x1400243ed
mov ecx, dword [0x1400c90ec]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400243ed
cmp byte [0x1400c91aa], 0
je 0x1400243c3
mov edx, 0x64
mov ecx, 0x15e
call qword [sym.imp.KERNEL32.dll_Beep]
mov rcx, qword [0x1400c8f50]
cmp byte [0x1400c90e8], 0
je 0x1400243da
call fcn.140020d00
jmp 0x1400243df
call fcn.14002bf30
cmp byte [0x1400c90e8], 0
sete byte [0x1400c90e8]
mov ecx, dword [0x1400c9224]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140024466
cmp byte [0x1400c8ff8], 0
je 0x140024440
cmp byte [0x1400c9221], 0
je 0x14002442e
mov dword [0x1400c9224], esi
mov r8d, 4
lea rdx, [0x14009dd20]
lea rcx, [0x1400c60f0]
call fcn.140017210
mov dword [0x1400c90ac], esi
mov dword [0x1400c6130], 2
jmp 0x140024458
mov dword [0x1400c9098], esi
mov dword [0x1400c6130], esi
mov rcx, qword [0x1400c8f60]
call fcn.1400089e0
cmp byte [0x1400c8ff8], 0
sete byte [0x1400c8ff8]
mov ecx, dword [0x1400c9228]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400244a9
mov rax, qword [0x1400c9008]
cmp qword [0x1400c9000], rax
je 0x1400244a9
cmp byte [0x1400c90b8], 0
jne 0x14002449b
mov rcx, qword [0x1400c8f60]
call fcn.1400074f0
cmp byte [0x1400c9094], 0
sete byte [0x1400c9094]
mov ecx, dword [0x1400c910c]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1400249cb
cmp byte [0x1400c9108], 0
sete al
mov byte [0x1400c9108], al
mov rcx, qword [0x1400c8f68]
test al, al
je 0x1400244e2
call fcn.14002be10
jmp 0x1400249cb
call fcn.14002c040
jmp 0x1400249cb
mov ebx, 3
mov edi, ebx
xor esi, esi
lea rbp, [0x1400c60f0]
lea r15, [0x1400c6040]
lea r14, [0x1400c6200]
lea r12, [0x1400c6020]
lea r13, [0x1400c60b0]
nop dword [rax + rax]
mov rcx, r15
cmp qword [0x1400c6058], 0xf
cmova rcx, qword [0x1400c6040]
mov r8, qword [0x1400c6050]
cmp r8, 2
jne 0x1400245da
lea rdx, [0x1400a1054]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400245da
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400245bb
cmp ebx, 0x1b
jne 0x14002458c
lea r8d, [rbx - 0x17]
lea rdx, [0x14009dd20]
mov rcx, r15
call fcn.140017210
mov byte [0x1400c912a], sil
mov dword [0x1400c90f8], esi
jmp 0x1400245bb
mov rdx, rdi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp r15, rdx
je 0x1400245b5
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400245ad
mov rdx, qword [rdx]
mov rcx, r15
call fcn.140017210
mov dword [0x1400c90f8], ebx
mov rcx, r15
cmp qword [0x1400c6058], 0xf
cmova rcx, qword [0x1400c6040]
mov r8, qword [0x1400c6050]
jmp 0x14002499d
mov rcx, r12
cmp qword [0x1400c6038], 0xf
cmova rcx, qword [0x1400c6020]
mov r8, qword [0x1400c6030]
cmp r8, 2
jne 0x140024694
lea rdx, [0x1400a1054]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140024694
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140024675
cmp ebx, 0x1b
jne 0x140024646
lea r8d, [rbx - 0x17]
lea rdx, [0x14009dd20]
mov rcx, r12
call fcn.140017210
mov byte [0x1400c912a], sil
mov dword [0x1400c90ec], esi
jmp 0x140024675
mov rdx, rdi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp r12, rdx
je 0x14002466f
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140024667
mov rdx, qword [rdx]
mov rcx, r12
call fcn.140017210
mov dword [0x1400c90ec], ebx
mov rcx, r12
cmp qword [0x1400c6038], 0xf
cmova rcx, qword [0x1400c6020]
mov r8, qword [0x1400c6030]
jmp 0x14002499d
mov rcx, r13
cmp qword [0x1400c60c8], 0xf
cmova rcx, qword [0x1400c60b0]
mov r8, qword [0x1400c60c0]
cmp r8, 2
jne 0x14002474e
lea rdx, [0x1400a1054]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14002474e
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002472f
cmp ebx, 0x1b
jne 0x140024700
lea r8d, [rbx - 0x17]
lea rdx, [0x14009dd20]
mov rcx, r13
call fcn.140017210
mov byte [0x1400c912a], sil
mov dword [0x1400c91ac], esi
jmp 0x14002472f
mov rdx, rdi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp r13, rdx
je 0x140024729
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140024721
mov rdx, qword [rdx]
mov rcx, r13
call fcn.140017210
mov dword [0x1400c91ac], ebx
mov rcx, r13
cmp qword [0x1400c60c8], 0xf
cmova rcx, qword [0x1400c60b0]
mov r8, qword [0x1400c60c0]
jmp 0x14002499d
mov rcx, rbp
cmp qword [0x1400c6108], 0xf
cmova rcx, qword [0x1400c60f0]
mov r8, qword [0x1400c6100]
cmp r8, 2
jne 0x140024808
lea rdx, [0x1400a1054]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140024808
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400247e9
cmp ebx, 0x1b
jne 0x1400247ba
lea r8d, [rbx - 0x17]
lea rdx, [0x14009dd20]
mov rcx, rbp
call fcn.140017210
mov byte [0x1400c912a], sil
mov dword [0x1400c9224], esi
jmp 0x1400247e9
mov rdx, rdi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
cmp rbp, rdx
je 0x1400247e3
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400247db
mov rdx, qword [rdx]
mov rcx, rbp
call fcn.140017210
mov dword [0x1400c9224], ebx
mov rcx, rbp
cmp qword [0x1400c6108], 0xf
cmova rcx, qword [0x1400c60f0]
mov r8, qword [0x1400c6100]
jmp 0x14002499d
lea rcx, str.none
cmp qword [0x1400c6128], 0xf
cmova rcx, qword [str.none]
mov r8, qword [0x1400c6120]
cmp r8, 2
jne 0x1400248d5
lea rdx, [0x1400a1054]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400248d5
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1400248b2
cmp ebx, 0x1b
jne 0x14002487c
lea r8d, [rbx - 0x17]
lea rdx, [0x14009dd20]
lea rcx, str.none
call fcn.140017210
mov byte [0x1400c912a], sil
mov dword [0x1400c9228], esi
jmp 0x1400248b2
mov rdx, rdi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
lea rax, str.none
cmp rax, rdx
je 0x1400248ac
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400248a4
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140017210
mov dword [0x1400c9228], ebx
lea rcx, str.none
cmp qword [0x1400c6128], 0xf
cmova rcx, qword [str.none]
mov r8, qword [0x1400c6120]
jmp 0x14002499d
lea rcx, [0x1400c6060]
cmp qword [0x1400c6078], 0xf
cmova rcx, qword [0x1400c6060]
mov r8, qword [0x1400c6070]
cmp r8, 2
jne 0x1400249ba
lea rdx, [0x1400a1054]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400249ba
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x14002497f
cmp ebx, 0x1b
jne 0x140024949
lea r8d, [rbx - 0x17]
lea rdx, [0x14009dd20]
lea rcx, [0x1400c6060]
call fcn.140017210
mov byte [0x1400c912a], sil
mov dword [0x1400c910c], esi
jmp 0x14002497f
mov rdx, rdi
shl rdx, 5
add rdx, 0xffffffffffffffe0
add rdx, r14
lea rax, [0x1400c6060]
cmp rax, rdx
je 0x140024979
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140024971
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140017210
mov dword [0x1400c910c], ebx
lea rcx, [0x1400c6060]
cmp qword [0x1400c6078], 0xf
cmova rcx, qword [0x1400c6060]
mov r8, qword [0x1400c6070]
cmp r8, 2
jne 0x1400249b3
lea rdx, [0x1400a1054]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400249ba
mov byte [0x1400c912a], sil
inc ebx
inc rdi
cmp ebx, 0xfb
jl 0x140024520
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret