Function at 0x140020990
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via polling

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x210
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x188], 0xfffffffffffffffe
cmp byte [0x1402098f0], 0
jne 0x1400210a7
cmp byte [0x140209c70], 0
je 0x1400210a7
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rbp + 0x170], xmm0
movaps xmmword [rbp + 0x160], xmm0
mov rdi, qword [rcx + 0xb0]
cmp qword [rcx + 0xb8], 0x10
jb 0x1400209fc
mov rbx, qword [rsi + 0xa0]
jmp 0x140020a03
lea rbx, [rsi + 0xa0]
test rdi, rdi
js 0x1400210ba
cmp rdi, 0xf
ja 0x140020a5e
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], 0xf
movups xmm0, xmmword [rbx]
movaps xmmword [rbp + 0x160], xmm0
mov r14d, 0xf
cmp qword [0x14020a338], rdi
jne 0x140020adb
mov rbx, qword [0x14020a340]
cmp rbx, 0x10
jb 0x140020aeb
mov rcx, qword [0x14020a328]
jmp 0x140020af2
mov qword [rbp + 0x178], 0xf
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x140020aa1
lea rcx, [r14 + 0x28]
call fcn.14010bc98
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140020aad
lea rcx, [r14 + 1]
call fcn.14010bc98
mov rcx, rax
mov qword [rbp + 0x160], rcx
mov qword [rbp + 0x170], rdi
mov qword [rbp + 0x178], r14
lea r8, [rdi + 1]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
cmp qword [0x14020a338], rdi
je 0x140020a41
mov r15, qword [rbp + 0x160]
mov rbx, qword [0x14020a340]
jmp 0x140020b14
lea rcx, [0x14020a328]
cmp r14, 0x10
mov r15, qword [rbp + 0x160]
lea rdx, [rbp + 0x160]
cmovae rdx, r15
mov r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140020b6f
mov byte [0x14020a34f], 0
cmp r14, 0x10
lea r9, [rbp + 0x160]
cmovae r9, r15
cmp rbx, rdi
jae 0x140020b40
lea rcx, [0x14020a328]
mov rdx, rdi
call fcn.140018360
jmp 0x140020b6f
cmp rbx, 0x10
jb 0x140020b4f
mov rbx, qword [0x14020a328]
jmp 0x140020b56
lea rbx, [0x14020a328]
mov qword [0x14020a338], rdi
mov rcx, rbx
mov rdx, r9
mov r8, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
mov qword [rbp - 0x48], 0
mov qword [rbp - 0x40], 0xc
mov qword [rbp - 0x38], 0xf
movabs rax, 0x657267656b6f6d73
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x48], 0x6564616e
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 9
mov qword [rbp - 0x18], 0xf
movabs rax, 0x6e61626873616c66
mov qword [rbp - 0x30], rax
mov byte [rbp - 0x28], 0x67
mov qword [rbp - 8], 0
mov qword [rbp], 9
mov qword [rbp + 8], 0xf
movabs rax, 0x64616e6572676568
mov qword [rbp - 0x10], rax
mov byte [rbp - 8], 0x65
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x28], 0xf
mov dword [rbp + 0x10], 0x6f6c6f6d
mov dword [rbp + 0x13], 0x766f746f
mov byte [rbp + 0x17], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], 5
mov qword [rbp + 0x48], 0xf
mov byte [rbp + 0x34], 0x79
mov dword [rbp + 0x30], 0x6f636564
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0xa
mov qword [rbp + 0x68], 0xf
movabs rax, 0x616e657267636e69
mov qword [rbp + 0x50], rax
mov word [rbp + 0x58], 0x6564
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], 3
mov qword [rbp + 0x88], 0xf
mov word [rbp + 0x70], 0x7761
mov byte [rbp + 0x72], 0x70
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], 5
mov qword [rbp + 0xa8], 0xf
mov dword [rbp + 0x90], 0x30677373
mov byte [rbp + 0x94], 0x38
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], 3
mov qword [rbp + 0xc8], 0xf
mov word [rbp + 0xb0], 0x7561
mov byte [rbp + 0xb2], 0x67
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], 5
mov qword [rbp + 0xe8], 0xf
mov dword [rbp + 0xd0], 0x35356773
mov byte [rbp + 0xd4], 0x36
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], 5
mov qword [rbp + 0x108], 0xf
mov dword [rbp + 0xf0], 0x66696e6b
mov byte [rbp + 0xf4], 0x65
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], 2
mov qword [rbp + 0x128], 0xf
mov word [rbp + 0x110], 0x3463
lea rax, [rbp + 0x130]
movaps xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], 0
mov qword [rbp + 0x150], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x158], rax
lea rcx, [rbp + 0x130]
lea r8, [rbp + 0x158]
lea r9, [rbp + 0x150]
mov edx, 0xc
call fcn.140016360
mov edi, 0x160
jmp 0x140020de6
call fcn.14010bb34
mov qword [rbp + rdi - 0x40], 0
mov qword [rbp + rdi - 0x38], 0xf
mov byte [rbp + rdi - 0x50], 0
add rdi, 0xffffffffffffffe0
cmp rdi, 0xffffffffffffffe0
je 0x140020e24
mov rax, qword [rbp + rdi - 0x38]
cmp rax, 0x10
jb 0x140020dc5
mov rcx, qword [rbp + rdi - 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140020dc0
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140021026
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x140020dc0
mov rdi, qword [rbp + 0x130]
mov r15, qword [rbp + 0x138]
cmp rdi, r15
je 0x140020e99
cmp qword [rbp + 0x178], 0x10
jb 0x140020e4a
mov rbx, qword [rbp + 0x160]
jmp 0x140020e51
lea rbx, [rbp + 0x160]
mov r14, qword [rbp + 0x170]
mov r12, rdi
jmp 0x140020e78
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140020e90
add r12, 0x20
cmp r12, r15
je 0x140020e99
cmp qword [r12 + 0x10], r14
jne 0x140020e6f
cmp qword [r12 + 0x18], 0x10
mov rcx, r12
jb 0x140020e60
mov rcx, qword [r12]
jmp 0x140020e60
cmp r12, r15
jne 0x140020fb8
mov rcx, qword [0x140208f88]
mov eax, dword [0x140208f90]
test rcx, rcx
je 0x140020ede
test eax, eax
je 0x140020ede
mov edx, 0x12f8
add rdx, qword [rsi + 0x48]
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x50]
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, qword [0x140208f88]
mov eax, dword [0x140208f90]
test rcx, rcx
je 0x140020f0c
test eax, eax
je 0x140020f0c
mov edx, 0x1744
add rdx, qword [rbp - 0x50]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x158]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [rbp + 0x158], 0
je 0x140020f1c
mov byte [0x14020a34f], 0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [0x14017a304], 0
jne 0x140020f63
mov edi, eax
mov ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140020f63
mov eax, edi
sub eax, dword [0x14020a348]
cmp eax, 0x1f4
jb 0x140020f63
movzx eax, byte [0x14020a34f]
xor al, 1
mov byte [0x14020a34f], al
mov dword [0x14020a348], edi
jmp 0x140020f6a
movzx eax, byte [0x14020a34f]
test al, al
je 0x140020fb1
mov dword [rbp + 0x150], 0x2d
mov rcx, qword [0x140208f88]
test rcx, rcx
je 0x140020fb1
cmp dword [0x140208f90], 0
je 0x140020fb1
mov edx, 0x6cc
add rdx, qword [rsi]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x150]
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdi, qword [rbp + 0x130]
test rdi, rdi
je 0x140021066
mov rsi, qword [rbp + 0x138]
cmp rdi, rsi
jne 0x140020ffb
jmp 0x140021033
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14010bb34
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
add rdi, 0x20
cmp rdi, rsi
je 0x14002102c
mov rax, qword [rdi + 0x18]
cmp rax, 0x10
jb 0x140020fdf
mov rcx, qword [rdi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140020fda
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x140020fd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov rdi, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x140]
sub rdx, rdi
cmp rdx, 0x1000
jb 0x14002105e
mov rax, qword [rdi - 8]
add rdi, 0xfffffffffffffff8
sub rdi, rax
cmp rdi, 0x20
jae 0x140021026
add rdx, 0x27
mov rdi, rax
mov rcx, rdi
call fcn.14010bb34
mov rax, qword [rbp + 0x178]
cmp rax, 0x10
jb 0x1400210a7
mov rcx, qword [rbp + 0x160]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400210a2
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140021026
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.14010bb34
nop
add rsp, 0x210
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.140015e90
int3