Function at 0x49f3d0
Capabilities:
Create process on windows
Get common file path
Log keystrokes

Disassembly:
mov r11, rsp
sub rsp, 0xa48
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x20], rdi
mov qword [r11 - 0x28], r12
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x40], r15
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x9f0], rax
mov r15, r8
mov dword [rsp + 0x80], edx
mov rbp, rcx
test rcx, rcx
je 0x49f9c8
lea r8, [r11 - 0x9c4]
lea rdx, [0x004ed2e8]
call fcn.004aaa80
cmp eax, 0xffffffff
je 0x49f9c8
mov edx, 2
mov ecx, 0x104
call fcn.004b1040
mov rbx, rax
mov edx, 7
mov qword [rsp + 0x78], rdx
xor r12d, r12d
mov r8, r12
mov qword [rsp + 0x70], r12
mov word [rsp + 0x60], r8w
xor eax, eax
mov rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
jbe 0x49f4ae
call fcn.004a5c60
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
cmp rdx, rsi
jae 0x49f4c7
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.00401f80
mov rdx, qword [rsp + 0x78]
jmp 0x49f4e6
test rsi, rsi
jne 0x49f4e6
mov qword [rsp + 0x70], r12
lea rax, [rsp + 0x60]
cmp rdx, 8
cmovae rax, qword [rsp + 0x60]
mov word [rax], r12w
jmp 0x49f527
test rsi, rsi
je 0x49f527
lea rcx, [rsp + 0x60]
cmp rdx, 8
cmovae rcx, qword [rsp + 0x60]
lea rdi, [rsi + rsi]
add rdx, rdx
mov r9, rdi
mov r8, rbp
call fcn.004a7900
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
mov word [rdi + rax], r12w
mov qword [rsp + 0xb0], 7
mov qword [rsp + 0xa8], r12
mov word [rsp + 0x98], 0
mov r8d, 4
lea rdx, str.__t_n_r
lea rcx, [rsp + 0x90]
call fcn.00402780
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x1a0]
call fcn.004a2400
nop
cmp qword [rsp + 0x78], 8
jb 0x49f58c
mov rcx, qword [rsp + 0x60]
call fcn.004a6f90
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], r12
mov word [rsp + 0x60], 0
test rbx, rbx
je 0x49f9ac
lea r8, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 8
cmovae r8, qword [rsp + 0x1a8]
lea r9, [0x004f7f84]
mov edx, 0x104
mov rcx, rbx
call fcn.0049e6f0
test eax, eax
je 0x49f9a3
lea r13, [rsp + 0x1d0]
mov edi, 1
mov dword [rsp + 0x50], edi
mov r14d, r12d
mov dx, 0x2e
mov rcx, rbx
call fcn.004aa950
test rax, rax
je 0x49f663
lea rdx, str..lnk
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x49f663
mov dword [rsp + 0x40], edi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x104
lea r9, [rsp + 0x1d0]
mov r8d, 0x200
mov rdx, rbx
mov rcx, rbx
call fcn.0049e450
test eax, eax
cmovne r14d, edi
mov rsi, r12
mov dx, SafeArrayAllocDescriptor
mov rcx, rbx
call fcn.004aa950
mov rbp, rax
lea rdi, [rsp + 0x5f0]
test rax, rax
je 0x49f6e8
mov edx, r12d
mov rcx, rbx
cmp word [rbx], dx
je 0x49f6be
nop
test dl, 1
jne 0x49f69b
cmp word [rcx], 0x20
je 0x49f6bb
movzx eax, word [rcx]
cmp ax, 0x22
jne 0x49f6a9
add edx, 1
jmp 0x49f6b0
mov word [rdi], ax
add rdi, 2
add rcx, 2
cmp word [rcx], si
je 0x49f6be
jmp 0x49f690
mov rsi, rcx
mov word [rdi], 0
lea r12, [rsp + 0x5f0]
test rsi, rsi
je 0x49f6eb
mov word [rsi], 0
mov dx, 0x5c
mov rcx, rbx
call fcn.004a8f70
mov word [rsi], SafeArrayAllocDescriptor
jmp 0x49f6f7
mov r12, rbx
mov dx, 0x5c
mov rcx, rbx
call fcn.004a8f70
test rax, rax
je 0x49f759
test rbp, rbp
je 0x49f732
cmp rbp, rax
jae 0x49f732
sub rax, rbp
sub rax, 2
sar rax, 1
mov edi, eax
lea rdx, [rbp + 2]
mov r8d, eax
lea rcx, [rsp + 0x1d0]
call fcn.004a90b0
mov word [rsp + rdi*2 + 0x1d0], 0
jmp 0x49f77f
sub rax, rbx
sar rax, 1
mov edi, eax
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x1d0]
call fcn.004a90b0
mov word [rsp + rdi*2 + 0x1d0], 0
jmp 0x49f77f
lea rdx, [rsp + 0x1d0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x49f77c
mov word [rsp + 0x1d6], 0
jmp 0x49f77f
xor r13d, r13d
xor ebp, ebp
test rsi, rsi
je 0x49f78c
add rsi, 2
jmp 0x49f78e
xor esi, esi
test r15, r15
je 0x49f7db
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rbp, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
mov r8d, 1
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, r15
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0xc0]
call fcn.004a8900
mov dword [rsp + 0xc0], 0x70
mov dword [rsp + 0xc4], 0x440
xor r15d, r15d
mov qword [rsp + 0xc8], r15
lea rax, str.open
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], r12
mov qword [rsp + 0xe0], rsi
mov qword [rsp + 0xe8], r13
mov dword [rsp + 0xf0], 1
lea rcx, [rsp + 0xc0]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
test eax, eax
je 0x49f862
mov rdi, qword [rsp + 0x128]
jmp 0x49f908
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x130]
call fcn.004a8900
mov dword [rsp + 0x130], 0x68
test r14d, r14d
je 0x49f89a
or dword [rsp + 0x16c], 1
movzx eax, word [rsp + 0x50]
mov word [rsp + 0x170], ax
lea rdx, [rsp + 0x1d0]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x49f8bc
mov word [rsp + 0x1d6], r15w
jmp 0x49f8bf
mov r13, r15
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov esi, eax
mov rdi, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rdi, rdi
je 0x49f932
cmp dword [rsp + 0x80], r15d
je 0x49f929
test esi, esi
je 0x49f929
mov edx, 0x1388
mov rcx, rdi
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x49f97e
test rbp, rbp
je 0x49f97e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
lea r8d, [rsi + 1]
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbp
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, eax
xor r8d, r8d
mov ecx, edi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call fcn.004ab2d0
nop
cmp qword [rsp + 0x1c0], 8
jb 0x49f99f
mov rcx, qword [rsp + 0x1a8]
call fcn.004a6f90
mov eax, esi
jmp 0x49f9ca
mov rcx, rbx
call fcn.004ab2d0
nop
cmp qword [rsp + 0x1c0], 8
jb 0x49f9c4
mov rcx, qword [rsp + 0x1a8]
call fcn.004a6f90
xor eax, eax
jmp 0x49f9ca
xor eax, eax
mov rcx, qword [rsp + 0x9f0]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0xa40]
mov rbp, qword [rsp + 0xa38]
mov rsi, qword [rsp + 0xa30]
mov rdi, qword [rsp + 0xa28]
mov r12, qword [rsp + 0xa20]
mov r13, qword [rsp + 0xa18]
mov r14, qword [rsp + 0xa10]
mov r15, qword [rsp + 0xa08]
add rsp, 0xa48
ret