Function at 0x14000187f
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push rbp
push rdi
push rbx
sub rsp, 0x190
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x130], rcx
lea rax, [rbp + 0xcf]
mov qword [rbp + 0xf0], rax
nop
nop
lea rdx, [rbp + 0xcf]
lea rax, [rbp + 0xa0]
mov r8, rdx
lea rdx, str.GERMAN
mov rcx, rax
call method.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string_std.allocator_wchar_t____wchar_t_const__std::allocator_wchar_t__const_
lea rax, [rbp + 0xa0]
mov rcx, rax
call sym.toggleKeyboardLayout_std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t____const_
lea rax, [rbp + 0xa0]
mov rcx, rax
call sym.std::__cxx11::basic_string_wchar_t__std::char_traits_wchar_t___std::allocator_wchar_t___::basic_string__
lea rax, [rbp + 0xcf]
mov rcx, rax
call method.std::__new_allocator_wchar_t_.__new_allocator__
nop
lea rdx, [rbp + 0x30]
mov eax, 0
mov ecx, 0xd
mov rdi, rdx
rep stosq qword [rdi], rax
mov dword [rbp + 0x30], 0x68
lea rax, [rbp + 0x10]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
lea rax, str.notepad.exe
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_CreateProcessA]
call rax
test eax, eax
sete al
test al, al
jne 0x140001c1c
mov dword [rbp + 0xdc], 2
lea rdx, [rbp + 0xdc]
lea rax, [rbp + 0xd0]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1ll___.duration_int__void__int_const_
lea rax, [rbp + 0xd0]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1ll____std::chrono::duration_long_long__std::ratio_1ll__1ll____const_
lea rax, str.Unbenannt___Editor
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_FindWindowA]
call rax
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x1400019f3
mov rax, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001c1d
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetForegroundWindow]
call rax
mov dword [rbp - 0x20], 1
mov word [rbp - 0x16], 0
mov dword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.begin___const
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x100]
mov rcx, rax
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___.end___const
mov qword [rbp - 0x30], rax
jmp 0x140001bb0
lea rax, [rbp - 0x28]
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____.operator___const
movzx eax, byte [rax]
mov byte [rbp + 0xff], al
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_SetForegroundWindow]
call rax
movsx eax, byte [rbp + 0xff]
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_VkKeyScanA]
call rax
mov word [rbp + 0xfc], ax
movzx eax, word [rbp + 0xfc]
mov byte [rbp + 0xfb], al
movzx eax, word [rbp + 0xfc]
sar ax, 8
mov byte [rbp + 0xfa], al
movzx eax, byte [rbp + 0xfa]
and eax, 1
test eax, eax
je 0x140001af0
mov word [rbp - 0x18], 0x10
mov dword [rbp - 0x14], 0
lea rax, [rbp - 0x20]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
movzx eax, byte [rbp + 0xfb]
mov word [rbp - 0x18], ax
mov dword [rbp - 0x14], 0
lea rax, [rbp - 0x20]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
mov dword [rbp - 0x14], 2
lea rax, [rbp - 0x20]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
movzx eax, byte [rbp + 0xfa]
and eax, 1
test eax, eax
je 0x140001b75
mov word [rbp - 0x18], 0x10
mov dword [rbp - 0x14], 2
lea rax, [rbp - 0x20]
mov r8d, 0x28
mov rdx, rax
mov ecx, 1
mov rax, qword [sym.imp.USER32.dll_SendInput]
call rax
mov dword [rbp + 0xec], 0x64
lea rdx, [rbp + 0xec]
lea rax, [rbp + 0xe0]
mov rcx, rax
call method.std::chrono::duration_long_long__std::ratio_1ll__1000ll___.duration_int__void__int_const_
lea rax, [rbp + 0xe0]
mov rcx, rax
call method.void_std::this_thread::sleep_for_long_long__std.ratio_1ll__1000ll____std::chrono::duration_long_long__std::ratio_1ll__1000ll____const_
lea rax, [rbp - 0x28]
mov rcx, rax
call method.__gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char_____.operator__
lea rdx, [rbp - 0x30]
lea rax, [rbp - 0x28]
mov rcx, rax
call method.bool___gnu_cxx::operator__char_const__std::__cxx11::basic_string_char__std::char_traits_char___std.allocator_char________gnu_cxx::__normal_iterator_char_const__std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char______con
test al, al
jne 0x140001a5b
mov rax, qword [rbp + 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001c1d
nop
add rsp, 0x190
pop rbx
pop rdi
pop rbp
ret