Function at 0x140007db0
Capabilities:
Log keystrokes via polling
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r12d, r9d
mov rsi, rcx
mov r15, qword [0x1400f6380]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [r8 + 8]
mov bpl, 1
test rax, rax
je 0x140007f3a
mov rbx, r8
mov r14, rdx
add rbx, 0x10
jmp 0x140007e10
mov rax, qword [rbx]
add rbx, 8
test rax, rax
je 0x140007f3a
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x140007e00
lea rdi, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rdi, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x140007e00
movzx ecx, word [rdi + 2]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x140007e00
movzx ecx, word [rdi + 4]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x66
jne 0x140007e00
movzx ecx, word [rdi + 6]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140007e00
movzx ecx, word [rdi + 8]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x140007e00
movzx ecx, word [rdi + 0xa]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6d
jne 0x140007e00
movzx ecx, word [rdi + 0xc]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x140007e00
movzx ecx, word [rdi + 0xe]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x140007e00
movzx ecx, word [rdi + 0x10]
test cx, cx
je 0x140007e00
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x140007e00
cmp word [rdi + 0x12], 0
jne 0x140007e00
test r12b, 1
je 0x140007f38
mov rax, qword [rbx]
mov qword [rbx - 8], rax
add rbx, 8
test rax, rax
jne 0x140007f24
add dword [r14], 0xffffffff
xor ebp, ebp
test r12b, 2
jne 0x140007f54
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x14000805b
test bpl, bpl
jne 0x140007ff6
mov dword [rsp + 0x44], 4
lea rdi, [rsp + 0x44]
mov qword [rsp + 0x30], rdi
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140007fec
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000001
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140007fec
mov dil, 1
jmp 0x140007ff8
cmp dword [rsp + 0x40], 1
mov dil, 1
jne 0x140007ff8
xor edi, edi
lea rcx, [0x1400f6cfc]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140008032
mov al, byte [rax]
test al, al
movzx ecx, dil
mov edi, 1
cmove edi, ecx
test r12b, 1
je 0x140008032
test al, al
je 0x140008032
lea rcx, str.MOZ_SAFE_MODE_RESTART
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov dil, 1
mov byte [rsi], dil
mov byte [rsi + 1], 1
mov rax, qword [rsp + 0x48]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x1400080ac
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140007f54
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x140007f54
lea rcx, str.MOZ_DISABLE_SAFE_MODE_KEY
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140007f5d
cmp byte [rax], 0
setne al
test bpl, al
je 0x140007f5d
jmp 0x140007ff6
call fcn.140072349
int3