Function at 0x140008250
Capabilities:
Log keystrokes via polling
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r12d, r9d
mov rsi, rcx
mov r15, qword [0x1400f7448]
mov rax, qword [r15]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [r8 + 8]
mov bpl, 1
test rax, rax
je 0x1400083da
mov rbx, r8
mov r14, rdx
add rbx, 0x10
jmp 0x1400082b0
mov rax, qword [rbx]
add rbx, 8
test rax, rax
je 0x1400083da
movzx ecx, word [rax]
or ecx, 2
cmp cx, 0x2f
jne 0x1400082a0
lea rdi, [rax + 2]
lea rcx, [rax + 4]
xor edx, edx
cmp word [rax + 2], 0x2d
sete dl
cmove rdi, rcx
movzx ecx, word [rax + rdx*2 + 2]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x73
jne 0x1400082a0
movzx ecx, word [rdi + 2]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x61
jne 0x1400082a0
movzx ecx, word [rdi + 4]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x66
jne 0x1400082a0
movzx ecx, word [rdi + 6]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400082a0
movzx ecx, word [rdi + 8]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x2d
jne 0x1400082a0
movzx ecx, word [rdi + 0xa]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6d
jne 0x1400082a0
movzx ecx, word [rdi + 0xc]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x6f
jne 0x1400082a0
movzx ecx, word [rdi + 0xe]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x64
jne 0x1400082a0
movzx ecx, word [rdi + 0x10]
test cx, cx
je 0x1400082a0
call sub.api_ms_win_crt_string_l1_1_0.dll_towlower
cmp ax, 0x65
jne 0x1400082a0
cmp word [rdi + 0x12], 0
jne 0x1400082a0
test r12b, 1
je 0x1400083d8
mov rax, qword [rbx]
mov qword [rbx - 8], rax
add rbx, 8
test rax, rax
jne 0x1400083c4
add dword [r14], 0xffffffff
xor ebp, ebp
test r12b, 2
jne 0x1400083f4
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400084fb
test bpl, bpl
jne 0x140008496
mov dword [rsp + 0x44], 4
lea rdi, [rsp + 0x44]
mov qword [rsp + 0x30], rdi
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000002
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000848c
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdx, str.SOFTWAREPoliciesMozillaFirefox
lea r8, str.DisableSafeMode
mov rcx, 0xffffffff80000001
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14000848c
mov dil, 1
jmp 0x140008498
cmp dword [rsp + 0x40], 1
mov dil, 1
jne 0x140008498
xor edi, edi
lea rcx, [0x1400f7f58]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x1400084d2
mov al, byte [rax]
test al, al
movzx ecx, dil
mov edi, 1
cmove edi, ecx
test r12b, 1
je 0x1400084d2
test al, al
je 0x1400084d2
lea rcx, str.MOZ_SAFE_MODE_RESTART
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov dil, 1
mov byte [rsi], dil
mov byte [rsi + 1], 1
mov rax, qword [rsp + 0x48]
xor rax, rsp
mov rcx, qword [r15]
cmp rcx, rax
jne 0x14000854c
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400083f4
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400083f4
lea rcx, str.MOZ_DISABLE_SAFE_MODE_KEY
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x1400083fd
cmp byte [rax], 0
setne al
test bpl, al
je 0x1400083fd
jmp 0x140008496
call fcn.1400763e0
int3