Function at 0x140028290
Capabilities:
Log keystrokes via polling
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov qword [rbp - 0x39], 0xfffffffffffffffe
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov rbx, r9
mov esi, edx
mov dword [rbp - 0x41], edx
cmp qword [r8 + 0x10], 0
jne 0x1400282cf
mov ecx, 0x5c
jmp 0x1400282dd
cmp qword [r8 + 0x18], 8
jb 0x1400282d9
mov r8, qword [r8]
movzx ecx, word [r8]
call qword [sym.imp.USER32.dll_VkKeyScanW]
movzx edi, al
mov r9, rbx
lea r8, [rbp - 0x41]
mov edx, edi
call fcn.140028f80
mov qword [rbp + 0x27], 7
xor r14d, r14d
mov qword [rbp + 0x1f], r14
mov word [rbp + 0xf], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp + 0xf]
call fcn.140006b90
nop
cmp qword [rbp + 0x1f], r14
jne 0x140028417
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCTFDirectSwitchHotkeys
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028410
mov ebx, r14d
nop word [rax + rax]
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], r14
mov word [rbp - 0x31], r14w
lea r8d, [rbx + 0x3e8]
lea rdx, str._08d
lea rcx, [rbp - 0x31]
call fcn.140061ab0
lea rdx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rdx, qword [rbp - 0x31]
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400283da
mov rcx, qword [rbp - 0x41]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 0x19], 8
jb 0x1400283d1
mov rcx, qword [rbp - 0x31]
call fcn.1400bd20c
inc ebx
cmp ebx, 0x64
jge 0x1400283ff
jmp 0x140028360
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0xf]
call fcn.140006b90
nop
cmp qword [rbp - 0x19], 8
jb 0x1400283ff
mov rcx, qword [rbp - 0x31]
call fcn.1400bd20c
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbp + 0x1f], 0
jne 0x140028417
xor bl, bl
jmp 0x140028752
mov qword [rbp + 7], 7
mov qword [rbp - 1], r14
mov word [rbp - 0x11], r14w
lea r9, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae r9, qword [rbp + 0xf]
lea r8, str.SOFTWAREMicrosoftCTFDirectSwitchHotkeys
lea rdx, [0x1401261a8]
lea rcx, [rbp - 0x11]
call fcn.140061ab0
lea rdx, [rbp - 0x11]
mov rcx, 0xffffffff80000001
call fcn.1400ba1c0
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rdx, qword [rbp - 0x11]
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028686
mov qword [rbp - 0x19], 7
mov qword [rbp - 0x21], r14
mov word [rbp - 0x31], r14w
lea r8d, [rax + 0x26]
lea rdx, str.0055AAB0_EACB_46DB_9BB4_1B97FC046D02
lea rcx, [rbp - 0x31]
call fcn.140006900
nop
mov eax, dword [rbp - 0x21]
add eax, eax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.CLSID
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, 0x26
lea rdx, str.89E1D5C2_A068_44B6_B820_F8406C8A4706
lea rcx, [rbp - 0x31]
call fcn.140006900
mov eax, dword [rbp - 0x21]
add eax, eax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Profile
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, 8
lea rdx, str.00000804
lea rcx, [rbp - 0x31]
call fcn.140006900
mov eax, dword [rbp - 0x21]
add eax, eax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.LangId
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, 0x26
lea rdx, str.00F89CD8_AB41_4E07_90CC_6D5866963C93
lea rcx, [rbp - 0x31]
call fcn.140006900
mov eax, dword [rbp - 0x21]
add eax, eax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.PreservedKeyId
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, edi
lea rdx, str._08x
lea rcx, [rbp - 0x31]
call fcn.140061ab0
mov eax, dword [rbp - 0x21]
add eax, eax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.VirtualKey
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov r8d, esi
lea rdx, str._08x
lea rcx, [rbp - 0x31]
call fcn.140061ab0
mov eax, dword [rbp - 0x21]
add eax, eax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 8
cmovae rcx, qword [rbp - 0x31]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Modifiers
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp qword [rbp - 0x19], 8
jb 0x14002867f
mov rcx, qword [rbp - 0x31]
call fcn.1400bd20c
mov bl, 1
jmp 0x140028731
mov ecx, 0x800
call fcn.1400bbc88
mov rdi, rax
mov ecx, 0x800
call fcn.1400bbc88
mov rbx, rax
test rdi, rdi
je 0x140028722
test rax, rax
je 0x14002871a
xor edx, edx
mov r8d, 0x800
mov rcx, rdi
call fcn.1400c2130
lea rax, [0x140127458]
mov qword [rsp + 0x20], rax
lea r9, str.RC::RCInputManagerBase::RegisterMyTsfHotKey
lea r8, str._s__:__s
mov edx, 0x400
mov rcx, rdi
call fcn.140007140
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call fcn.1400c2130
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea r9, str.SOFTWAREMicrosoftCTFDirectSwitchHotkeys
mov r8, rdi
mov edx, 0x400
mov rcx, rbx
call fcn.140007140
mov rcx, rbx
call fcn.140015100
mov rcx, rdi
call fcn.1400bd2dc
test rbx, rbx
je 0x14002872f
mov rcx, rbx
call fcn.1400bd2dc
xor bl, bl
cmp qword [rbp + 7], 8
jb 0x140028741
mov rcx, qword [rbp - 0x11]
call fcn.1400bd20c
mov qword [rbp + 7], 7
mov qword [rbp - 1], r14
mov word [rbp - 0x11], r14w
cmp qword [rbp + 0x27], 8
jb 0x140028762
mov rcx, qword [rbp + 0xf]
call fcn.1400bd20c
movzx eax, bl
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret