Function at 0x1400012d0
Capabilities:
Encode data using xor
Enumerate processes
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x140057010]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001325
cmp byte [0x140057051], 0
sete al
mov byte [0x140057051], al
jmp 0x14000132c
movzx eax, byte [0x140057051]
test al, al
je 0x140001c20
cmp byte [0x140057050], 1
jne 0x140001c20
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x140001372
cmp byte [0x1400889d0], 0
sete al
mov byte [0x1400889d0], al
xor ecx, ecx
test al, al
je 0x14000136d
call fcn.14002fd60
jmp 0x140001372
call fcn.14002f7e0
mov rax, qword [0x1400889e0]
mov dword [rax + 0x4114], 0x43a00000
mov dword [rax + 0x4118], 0x43480000
mov r15d, 1
mov dword [rax + 0x40f8], r15d
or dword [rax + 0x40f0], 0x42
mov dword [rax + 0x4150], 0x3f800000
xor ebx, ebx
mov dword [rax + 0x3918], ebx
mov dword [rax + 0x3934], 0x40400000
mov dword [rax + 0x394c], 0x40400000
mov dword [rax + 0x3988], 0x40400000
mov dword [rax + 0x393c], 0x40400000
mov dword [rax + 0x3980], 0x40400000
movdqa xmm0, xmmword [0x14004f250]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xd6f2001
mov word [rsp + 0x44], 0x212e
xor eax, eax
mov byte [rsp + 0x46], al
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0x15
jb 0x140001410
mov byte [rsp + 0x46], bl
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], bl
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], bl
jne 0x140001450
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x60]
call fcn.140001cb0
nop
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rcx, qword [rsp + 0x60]
mov r8d, 0x128
lea rdx, [0x140057050]
call fcn.140011660
mov cl, 0x40
mov dword [rsp + 0x30], 0x6d040840
mov dword [rsp + 0x34], 0x39212c10
mov dword [rsp + 0x38], 0x256e3225
mov word [rsp + 0x3c], 0x2538
xor eax, eax
mov byte [rsp + 0x3e], al
mov rax, rbx
nop word [rax + rax]
xor byte [rsp + rax + 0x31], cl
inc rax
cmp rax, 0xd
jae 0x1400014d4
movzx ecx, byte [rsp + 0x30]
jmp 0x1400014c0
mov byte [rsp + 0x3e], 0
mov esi, ebx
xor edx, edx
mov r14d, 2
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001b5a
mov dword [rbp - 0x80], 0x130
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001536
lea rdx, [rsp + 0x31]
lea rcx, [rbp - 0x54]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001533
lea rdx, [rbp - 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14000150d
mov esi, dword [rbp - 0x78]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140088a18], esi
test esi, esi
setne byte [0x140088a11]
test esi, esi
je 0x140001b73
mov dword [rsp + 0x30], 0x42c80000
mov dword [rsp + 0x34], 0x41c80000
lea rdx, [rsp + 0x30]
lea rcx, [0x1400497b0]
call fcn.14003f410
mov ecx, dword [0x140088a14]
test al, al
cmovne ecx, r15d
mov dword [0x140088a14], ecx
movss xmm1, dword [0x14004ec18]
xorps xmm0, xmm0
call fcn.140015b60
mov dword [rsp + 0x30], 0x42c80000
mov dword [rsp + 0x34], 0x41c80000
lea rdx, [rsp + 0x30]
lea rcx, str.Visual
call fcn.14003f410
mov ecx, dword [0x140088a14]
test al, al
cmovne ecx, r14d
mov dword [0x140088a14], ecx
movss xmm1, dword [0x14004ec18]
xorps xmm0, xmm0
call fcn.140015b60
mov dword [rsp + 0x30], 0x42c80000
mov dword [rsp + 0x34], 0x41c80000
lea rdx, [rsp + 0x30]
lea rcx, str.Misc
call fcn.14003f410
mov edx, dword [0x140088a14]
mov ecx, 3
test al, al
cmovne edx, ecx
mov dword [0x140088a14], edx
movss xmm1, dword [0x14004ec18]
xorps xmm0, xmm0
call fcn.140015b60
mov r8, qword [0x1400889e0]
mov rax, qword [r8 + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [r8 + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x140001670
mov qword [rsp + 0x30], 0
movss xmm1, dword [0x14004ecc0]
lea rcx, [rsp + 0x30]
call fcn.140015860
mov edx, dword [0x140088a14]
mov r8, qword [0x1400889e0]
test edx, edx
je 0x140001bda
cmp edx, 1
jne 0x14000186a
movdqa xmm0, xmmword [str._bIae__xmzDmoa]
movdqu xmmword [rsp + 0x30], xmm0
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
inc rcx
cmp rcx, 0xe
jb 0x1400016a0
mov byte [rsp + 0x3f], 0
mov rax, qword [r8 + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x1400016eb
mov rcx, qword [r8 + 0x4520]
test rcx, rcx
je 0x1400016eb
mov qword [rsp + 0x20], rbx
mov r9d, 0x200020
xor r8d, r8d
lea rdx, [rsp + 0x31]
call fcn.140044dd0
movdqa xmm0, xmmword [0x14004ed60]
movdqu xmmword [rsp + 0x30], xmm0
nop dword [rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rbx + 0x31], al
inc rbx
cmp rbx, 0xe
jb 0x140001700
mov byte [rsp + 0x3f], 0
lea rdx, [0x140088a13]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x140001741
cmp byte [0x140088a13], 0
je 0x14000173c
call fcn.1400031e0
jmp 0x140001741
call fcn.140003390
mov byte [rsp + 0x30], 0x57
mov al, 0x16
mov cl, 0x3e
mov dl, 0x3a
mov r8b, 0x77
mov r9b, 0x1b
mov r10b, 0x32
mov r11b, 0x30
movzx ebx, cl
mov dil, 0x23
xor esi, esi
xor al, 0x57
mov byte [rsp + 0x31], al
xor cl, 0x57
mov byte [rsp + 0x32], cl
xor dl, 0x57
mov byte [rsp + 0x33], dl
xor r8b, 0x57
mov byte [rsp + 0x34], r8b
xor r9b, 0x57
mov byte [rsp + 0x35], r9b
xor r10b, 0x57
mov byte [rsp + 0x36], r10b
xor r11b, 0x57
mov byte [rsp + 0x37], r11b
xor bl, 0x57
mov byte [rsp + 0x38], bl
xor dil, 0x57
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
lea rdx, [0x140088a1f]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x1400017d7
cmp byte [0x140088a1f], sil
je 0x1400017d2
call fcn.140002ea0
jmp 0x1400017d7
call fcn.140003040
mov byte [rsp + 0x30], 0x21
mov al, 0x60
mov cl, 0x48
mov dl, 0x4c
mov r8b, 1
mov r9b, 0x73
mov r10b, 0x40
mov r11b, 0x46
mov bl, 0x44
xor al, 0x21
mov byte [rsp + 0x31], al
xor cl, 0x21
mov byte [rsp + 0x32], cl
xor dl, 0x21
mov byte [rsp + 0x33], dl
xor r8b, 0x21
mov byte [rsp + 0x34], r8b
xor r9b, 0x21
mov byte [rsp + 0x35], r9b
xor r10b, 0x21
mov byte [rsp + 0x36], r10b
xor r11b, 0x21
mov byte [rsp + 0x37], r11b
xor bl, 0x21
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x39], sil
lea rdx, [0x140088a10]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x140001bda
cmp byte [0x140088a10], sil
je 0x140001860
call fcn.140003540
jmp 0x140001bda
call fcn.1400036f0
jmp 0x140001bda
cmp edx, r14d
jne 0x1400019eb
mov byte [rsp + 0x30], 0x68
mov al, 0x20
mov cl, 1
mov dl, 0xf
xor r8b, r8b
mov r9b, 0x48
mov r10b, 0x2e
mov r11b, 0x27
mov bl, 0x3e
xor edi, edi
xor al, 0x68
mov byte [rsp + 0x31], al
xor cl, 0x68
mov byte [rsp + 0x32], cl
xor dl, 0x68
mov byte [rsp + 0x33], dl
xor r8b, 0x68
mov byte [rsp + 0x34], r8b
xor r9b, 0x68
mov byte [rsp + 0x35], r9b
xor r10b, 0x68
mov byte [rsp + 0x36], r10b
xor r11b, 0x68
mov byte [rsp + 0x37], r11b
xor bl, 0x68
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x39], dil
lea rdx, [0x140088a20]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x1400018fc
cmp byte [0x140088a20], dil
je 0x1400018f7
call fcn.1400027a0
jmp 0x1400018fc
call fcn.140002960
mov byte [rsp + 0x30], 0x30
mov al, 0x6a
mov cl, 0x5f
movzx edx, cl
mov r8b, 0x5d
xor al, 0x30
mov byte [rsp + 0x31], al
xor cl, 0x30
mov byte [rsp + 0x32], cl
xor dl, 0x30
mov byte [rsp + 0x33], dl
xor r8b, 0x30
mov byte [rsp + 0x34], r8b
mov byte [rsp + 0x35], dil
lea rdx, [0x140088a21]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x140001957
cmp byte [0x140088a21], dil
je 0x140001952
call fcn.1400038a0
jmp 0x140001957
call fcn.140003a60
mov byte [rsp + 0x30], 0x34
mov al, 0x76
mov cl, 0x58
mov dl, 0x55
mov r8b, 0x57
mov r9b, 0x5f
mov r10b, 0x67
movzx r11d, r9b
mov bl, 0x4d
xor al, 0x34
mov byte [rsp + 0x31], al
xor cl, 0x34
mov byte [rsp + 0x32], cl
xor dl, 0x34
mov byte [rsp + 0x33], dl
xor r8b, 0x34
mov byte [rsp + 0x34], r8b
xor r9b, 0x34
mov byte [rsp + 0x35], r9b
xor r10b, 0x34
mov byte [rsp + 0x36], r10b
xor r11b, 0x34
mov byte [rsp + 0x37], r11b
xor bl, 0x34
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x39], dil
lea rdx, [0x140088a1e]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x140001bda
cmp byte [0x140088a1e], dil
je 0x1400019e1
call fcn.140002440
jmp 0x140001bda
call fcn.1400025f0
jmp 0x140001bda
cmp edx, 3
jne 0x140001bda
movdqa xmm0, xmmword [0x14004f210]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x41
nop dword [rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rbx + 0x31], al
inc rbx
cmp rbx, 0x10
jb 0x140001a10
mov byte [rsp + 0x41], 0
lea rdx, [0x140088a1d]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x140001a51
cmp byte [0x140088a1d], 0
je 0x140001a4c
call fcn.140002b20
jmp 0x140001a51
call fcn.140002ce0
mov byte [rsp + 0x30], 0x12
mov al, 0x40
mov cl, 0x77
mov dl, 0x61
mov r8b, 0x62
mov r9b, 0x73
mov r10b, 0x65
mov r11b, 0x7c
xor ebx, ebx
xor al, 0x12
mov byte [rsp + 0x31], al
xor cl, 0x12
mov byte [rsp + 0x32], cl
xor dl, 0x12
mov byte [rsp + 0x33], dl
xor r8b, 0x12
mov byte [rsp + 0x34], r8b
xor r9b, 0x12
mov byte [rsp + 0x35], r9b
xor r10b, 0x12
mov byte [rsp + 0x36], r10b
xor r11b, 0x12
mov byte [rsp + 0x37], r11b
mov byte [rsp + 0x38], bl
lea rdx, [0x140088a12]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x140001ac6
mov ecx, dword [0x140088a18]
call fcn.140003c20
mov byte [rsp + 0x30], 0x29
mov al, 0x6d
mov cl, 0x5b
mov dl, 0x46
mov r8b, 0x59
mov r9b, 9
mov r10b, 0x61
mov r11b, 0x48
mov bl, 0x4a
mov dil, 0x42
xor esi, esi
xor al, 0x29
mov byte [rsp + 0x31], al
xor cl, 0x29
mov byte [rsp + 0x32], cl
xor dl, 0x29
mov byte [rsp + 0x33], dl
xor r8b, 0x29
mov byte [rsp + 0x34], r8b
xor r9b, 0x29
mov byte [rsp + 0x35], r9b
xor r10b, 0x29
mov byte [rsp + 0x36], r10b
xor r11b, 0x29
mov byte [rsp + 0x37], r11b
xor bl, 0x29
mov byte [rsp + 0x38], bl
xor dil, 0x29
mov byte [rsp + 0x39], dil
mov byte [rsp + 0x3a], sil
lea rdx, [0x140088a1c]
lea rcx, [rsp + 0x31]
call fcn.140040aa0
test al, al
je 0x140001bda
mov ecx, dword [0x140088a18]
call fcn.140003dc0
jmp 0x140001bda
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140088a18], ebx
mov byte [0x140088a11], bl
movdqa xmm0, xmmword [0x14004f220]
movdqu xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x14004f240]
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x50], 0x492c787e
mov dword [rsp + 0x54], 0x6d607961
mov dword [rsp + 0x58], 0x7e6378
nop word [rax + rax]
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rbx + 0x31], al
movzx eax, byte [rsp + 0x30]
xor byte [rsp + rbx + 0x32], al
add rbx, r14
cmp rbx, 0x2a
jb 0x140001bb0
mov byte [rsp + 0x5b], 0
lea rcx, [rsp + 0x31]
call fcn.14003ec30
call fcn.140014330
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140001c20
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004782c
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140047580
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret