Function at 0x1400617d0
Capabilities:
Create process on windows
Log keystrokes via polling

Disassembly:
push rbp
push rbx
push rdi
push r12
push r15
lea rbp, [rsp - 0x50]
sub rsp, 0x150
mov rax, qword [0x1400e0038]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rbx, r9
mov rdi, r8
mov r15, rcx
cmp edx, 0x2b
jne 0x1400618ec
cmp r8, 0x419
jne 0x14006186d
mov ecx, dword [r9 + 0x30]
xor r12d, r12d
mov eax, dword [r9 + 0x28]
add ecx, 0xffffffdd
add eax, ecx
mov dword [rsp + 0x40], 3
mov ecx, dword [r9 + 0x34]
cdq
sub eax, edx
mov qword [rsp + 0x38], r12
sar eax, 1
add ecx, 0xffffffda
mov r8d, eax
mov dword [rsp + 0x30], r12d
mov eax, dword [r9 + 0x2c]
mov r9, qword [r15 + 0x58]
add eax, ecx
mov rcx, qword [rbx + 0x20]
cdq
sub eax, edx
mov dword [rsp + 0x28], r12d
sar eax, 1
mov edx, eax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_DrawIconEx]
lea eax, [r12 + 1]
jmp 0x140061e2f
cmp rdi, 0x420
jne 0x140061e2d
mov eax, dword [r9 + 0x30]
xor r12d, r12d
sub eax, dword [r9 + 0x28]
add eax, 0xa
mov dword [rsp + 0x40], 3
cdq
mov qword [rsp + 0x38], r12
sub eax, edx
mov dword [rsp + 0x30], r12d
sar eax, 1
lea r8d, [r12 + 5]
mov edx, eax
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], 8
cmp dword [rcx + 0x1c], r12d
je 0x1400618d4
mov r9, qword [rcx + 0x68]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.dll_DrawIconEx]
mov eax, 1
jmp 0x140061e2f
mov r9, qword [rcx + 0x60]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.USER32.dll_DrawIconEx]
mov eax, 1
jmp 0x140061e2f
cmp edx, 0xf
jne 0x140061a5e
mov rcx, qword [rcx + 8]
lea rdx, [rbp - 0x20]
xorps xmm0, xmm0
mov qword [rsp + 0x148], r13
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp + 0x20], rax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
call qword [sym.imp.USER32.dll_BeginPaint]
mov rcx, qword [r15 + 0x80]
mov r13, rax
cmp dword [rcx - 0x10], 0
je 0x140061a3e
mov rcx, qword [r15 + 8]
mov edx, 0x3ee
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x140], r14
call qword [sym.imp.USER32.dll_GetDlgItem]
xorps xmm0, xmm0
lea rdx, [rbp - 0x30]
mov rcx, rax
movups xmmword [rbp - 0x30], xmm0
call qword [sym.imp.USER32.dll_GetWindowRect]
mov rcx, qword [r15 + 8]
lea r8, [rsp + 0x50]
xor r12d, r12d
xor edx, edx
mov qword [rsp + 0x50], r12
lea r9d, [r12 + 1]
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov rax, qword [rsp + 0x50]
mov rcx, r13
mov esi, dword [rbp - 0x30]
mov edi, dword [rbp - 0x24]
sub esi, eax
mov ebx, dword [rbp - 0x28]
mov rdx, qword [r15 + 0x70]
sub ebx, eax
sub edi, dword [rsp + 0x54]
call qword [sym.imp.GDI32.dll_SelectObject]
lea edx, [r12 + 1]
mov rcx, r13
mov r14, rax
call qword [sym.imp.GDI32.dll_SetBkMode]
lea ecx, [rdi + 6]
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x64], ecx
mov rcx, qword [r15 + 0x80]
sub rcx, 0x18
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x6c], 0xf
call fcn.140064000
add rax, 0x18
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], rax
mov rdx, r13
call fcn.1400631d0
mov rdx, r14
mov rcx, r13
lea eax, [rax*8 + 6]
mov dword [r15 + 0x78], eax
call qword [sym.imp.GDI32.dll_SelectObject]
cmp dword [0x1400e0cbc], r12d
mov r14, qword [rsp + 0x140]
mov rsi, qword [rsp + 0x188]
je 0x140061a3e
mov rcx, r15
call fcn.140062850
mov dword [0x1400e0cbc], r12d
mov rcx, qword [r15 + 8]
lea rdx, [rbp - 0x20]
call qword [sym.imp.USER32.dll_EndPaint]
mov r13, qword [rsp + 0x148]
mov eax, 1
jmp 0x140061e2f
cmp edx, 0x138
jne 0x140061bd4
mov rcx, qword [rcx + 8]
mov edx, 0x3f4
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061ba8
mov rcx, qword [r15 + 8]
mov edx, 0x3f5
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061ba8
mov rcx, qword [r15 + 8]
mov edx, 0x402
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061ba8
mov rcx, qword [r15 + 8]
mov edx, 0x3f6
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061ba8
mov rcx, qword [r15 + 8]
mov edx, 0x3f7
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061ba8
mov rcx, qword [r15 + 8]
mov edx, 0x3f9
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
jne 0x140061b22
mov edx, 1
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetBkMode]
mov edx, 0xe3b32f
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, 5
call qword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x140061e2f
mov rcx, qword [r15 + 8]
mov edx, 0x3f8
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061b8a
mov rcx, qword [r15 + 8]
mov edx, 0x3fa
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061b8a
mov rcx, qword [r15 + 8]
mov edx, 0x403
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061b8a
mov rcx, qword [r15 + 8]
mov edx, 0x3ff
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061b8a
mov rcx, qword [r15 + 8]
mov edx, 0x400
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
jne 0x140061e2d
mov edx, 0x808080
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, 0xf
call qword [sym.imp.USER32.dll_GetSysColorBrush]
jmp 0x140061e2f
mov edx, 1
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetBkMode]
mov edx, 0x808080
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, 5
call qword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x140061e2f
cmp edx, 0x133
jne 0x140061cda
mov rcx, qword [rcx + 8]
mov edx, 0x41d
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
jne 0x140061c1a
cmp dword [r15 + 0x28], 0
jne 0x140061e2d
mov edx, 0x808080
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetTextColor]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x140061e2f
mov rcx, qword [r15 + 8]
mov edx, 0x3eb
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
jne 0x140061c54
cmp dword [r15 + 0x20], 0
jne 0x140061e2d
mov edx, 0x808080
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetTextColor]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x140061e2f
mov rcx, qword [r15 + 8]
mov edx, 0x3f8
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061cbc
mov rcx, qword [r15 + 8]
mov edx, 0x3fa
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061cbc
mov rcx, qword [r15 + 8]
mov edx, 0x403
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061cbc
mov rcx, qword [r15 + 8]
mov edx, 0x3ff
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
je 0x140061cbc
mov rcx, qword [r15 + 8]
mov edx, 0x400
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rbx, rax
jne 0x140061e2d
mov edx, 1
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, 5
call qword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x140061e2f
cmp edx, 0x4e
jne 0x140061ddd
cmp qword [r9 + 8], 0x3f2
jne 0x140061e2d
mov eax, dword [r9 + 0x10]
cmp eax, 0xfffffffd
jne 0x140061db9
mov rcx, qword [rcx + 8]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x44], rax
mov dword [rbp - 0x3c], eax
mov edx, 0x3f2
mov eax, dword [r9 + 0x18]
mov dword [rsp + 0x74], eax
mov eax, dword [r9 + 0x1c]
mov dword [rsp + 0x78], eax
movups xmmword [rsp + 0x7c], xmm0
mov dword [rsp + 0x70], 4
movups xmmword [rbp - 0x74], xmm0
movups xmmword [rbp - 0x64], xmm0
movups xmmword [rbp - 0x54], xmm0
call qword [sym.imp.USER32.dll_GetDlgItem]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov rcx, rax
mov edx, 0x104b
call qword [sym.imp.USER32.dll_SendMessageW]
mov rdx, qword [rbp - 0x68]
test rdx, rdx
je 0x140061e2d
lea rcx, [rsp + 0x58]
call fcn.140063cc0
mov rbx, qword [rsp + 0x58]
lea rdx, str.open
mov rcx, qword [r15 + 8]
xor r12d, r12d
mov r8, rbx
mov dword [rsp + 0x28], 1
xor r9d, r9d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rdx, [rbx - 0x18]
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061e2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140061e2d
cmp eax, 0xffffff65
jne 0x140061e2d
mov ecx, 0x43
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x140061e2d
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
jmp 0x140061e2d
cmp edx, 0x7b
jne 0x140061e12
mov rcx, qword [rcx + 8]
mov edx, 0x3f2
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp rax, rdi
jne 0x140061e2d
mov rcx, rbx
movzx r8d, bx
shr rcx, 0x10
mov rdx, rax
movzx r9d, cx
mov rcx, r15
call fcn.140061e50
jmp 0x140061e2d
cmp edx, 0x113
jne 0x140061e2d
cmp rdi, 0x64
jne 0x140061e2d
mov rcx, qword [rcx + 8]
mov rdx, rdi
call qword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.1400809d0
add rsp, 0x150
pop r15
pop r12
pop rdi
pop rbx
pop rbp
ret