Function at 0x140195dd0
Capabilities:
Delete registry value
Log keystrokes

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x490
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor esi, esi
mov rbx, rcx
mov rdi, rdx
mov dword [rsp + 0x30], esi
movzx ecx, word [rdx + 0x10]
cmp ecx, dword [rbx + 0xd4]
jne 0x14019609b
mov eax, dword [rdx + 0x20]
cmp eax, 5
jne 0x140195e3b
cmp dword [rbx + 0xcc], 1
je 0x140196089
lea edx, [rsi + 6]
mov rcx, rbx
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp eax, 6
jne 0x140195e9a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc8]
test al, al
jne 0x140195e6e
mov rax, qword [rbx + 0xc0]
cmp byte [rax + 0x1f], sil
jne 0x140195e6e
cmp byte [rax + 0x1d], sil
je 0x140195e6e
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.140195aa0
cmp dword [rbx + 0xcc], 7
je 0x140196089
mov edx, 7
mov rcx, rbx
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp eax, 1
je 0x140195ea4
cmp eax, 7
jne 0x140195ec3
mov edx, 8
mov rcx, rbx
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp eax, 9
jne 0x140195f9c
mov r8, qword [rbx + 0xc0]
mov rcx, r8
call fcn.1400fa050
test al, al
je 0x140196023
mov rcx, r8
call fcn.1400fa1f0
test al, al
jne 0x140195f5e
mov rax, qword [rbx + 0xc0]
cmp byte [rax + 0x1e], sil
je 0x140195f43
mov rcx, rax
call fcn.140111940
mov rcx, rbx
test al, al
je 0x140195f27
mov edx, 0xa
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
mov edx, 4
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp dword [rax + 0x108], 1
jne 0x140195f55
cmp byte [rax + 0x10c], sil
je 0x140195f5e
call fcn.14017b0c0
test al, al
je 0x140195f7d
mov edx, 0xa
mov rcx, rbx
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
mov edx, 4
mov rcx, rbx
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp eax, 0xb
jne 0x140196042
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc8]
test al, al
jne 0x140195fd3
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x120]
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
mov rax, qword [rbx + 0xc0]
cmp byte [rax + 0x1e], sil
je 0x140196023
mov rcx, rbx
cmp byte [rax + 0x26c], sil
je 0x140196008
mov edx, 0xc
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
mov rax, qword [rbx]
call qword [rax + 0x120]
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
mov edx, 0xb
mov rcx, rbx
call fcn.140193610
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp eax, 4
jne 0x140196068
mov rcx, rbx
mov byte [rbx + 0xca], sil
call fcn.140195830
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp eax, 2
jne 0x140196089
mov rcx, rbx
mov byte [rbx + 0xca], 1
call fcn.140195830
mov rcx, qword [rbx + 0x158]
mov rax, qword [rcx]
call qword [rax + 0x68]
mov rcx, qword [rbx + 0xe8]
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1401966c1
cmp ecx, dword [rbx + 0xd8]
jne 0x14019614f
mov eax, 0x203
cmp word [rdx + 8], ax
jne 0x1401966c1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc8]
test al, al
jne 0x1401960d7
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xb0]
jmp 0x1401966c1
cmp dword [rbx + 0xa8], 1
jne 0x1401960ed
mov rcx, rbx
call fcn.14020b9f0
jmp 0x1401966c1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [rdi]
je 0x1401966c1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rcx, qword [rdi]
xor edx, edx
mov ebx, eax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
cmp ebx, eax
je 0x1401966c1
mov r8d, 1
mov edx, eax
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, qword [rdi]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
mov edx, esi
mov ecx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1401966c1
cmp ecx, dword [rbx + 0xdc]
jne 0x140196170
mov rcx, qword [rbx + 0x178]
call fcn.14013c790
mov rcx, rbx
call fcn.1401926a0
jmp 0x1401966c1
mov qword [rsp + 0x4c0], rbp
cmp ecx, 0x14
jg 0x140196354
je 0x1401962ae
dec ecx
je 0x1401961f0
dec ecx
je 0x1401961c6
cmp ecx, 0xf
jne 0x1401962a1
cmp dword [rbx + 0xcc], 0xa
je 0x1401966b5
mov rcx, qword [rbx + 0xc0]
call fcn.1400f20b0
test al, al
jne 0x1401966b5
mov qword [rdi + 0x18], 1
jmp 0x1401966b9
mov rdx, qword [rdx]
call fcn.140195a20
mov rcx, qword [rbx + 0xf0]
test rcx, rcx
je 0x1401961e0
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rdx, rdi
mov rcx, rbx
call fcn.14020ba30
jmp 0x1401966b9
mov rcx, qword [rbx + 0xc0]
cmp byte [rcx + 0x1e], sil
je 0x140196203
cmp byte [rcx + 0x1a], sil
jne 0x140196268
cmp byte [rcx + 0x1f], sil
je 0x140196224
lea rdx, [rsp + 0x38]
call fcn.1401910e0
mov esi, 1
cmp dword [rax + 0xc], 0
jle 0x140196224
movzx ebp, sil
jmp 0x140196227
xor bpl, bpl
test sil, 1
je 0x14019623e
cmp dword [rsp + 0x40], 0
jle 0x14019623e
mov rcx, qword [rsp + 0x38]
call fcn.1402bd0e0
test bpl, bpl
jne 0x140196268
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.1401958d0
test al, al
jne 0x140196268
mov rcx, qword [rdi]
xor r9d, r9d
mov r8d, 0x1f4
lea edx, [r9 + 1]
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, qword [rbx + 0xc0]
call fcn.1400f20b0
test al, al
jne 0x140196288
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0xc8]
test al, al
je 0x14019629e
mov rcx, qword [rdi]
xor r9d, r9d
mov r8d, 0xd05
lea edx, [r9 + 2]
call qword [sym.imp.USER32.dll_SetTimer]
mov rdx, rdi
mov rcx, rbx
call fcn.14020ba30
jmp 0x1401966b9
mov rsi, qword [rdx + 0x20]
mov rcx, qword [rdi]
lea rdx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetClientRect]
cmp byte [rbx + 0xc9], 0
mov rdx, rsi
je 0x1401962d5
mov rcx, qword [rbx + 0x1c8]
jmp 0x1401962dc
mov rcx, qword [rbx + 0x1c0]
call fcn.14014a720
mov eax, dword [rsp + 0x54]
mov ecx, 0xf
add eax, 0xffffffcf
mov dword [rsp + 0x4c], eax
call qword [sym.imp.USER32.dll_GetSysColorBrush]
lea rdx, [rsp + 0x48]
mov r8, rax
mov rcx, rsi
call qword [sym.imp.USER32.dll_FillRect]
mov rdx, qword [rbx + 0x198]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
mov r8d, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x48]
dec r8d
xor r9d, r9d
mov rcx, rsi
mov dword [rsp + 0x4c], r8d
call qword [sym.imp.GDI32.dll_MoveToEx]
mov r8d, dword [rsp + 0x4c]
mov edx, dword [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_LineTo]
mov qword [rdi + 0x18], 1
jmp 0x1401966b9
sub ecx, 0x16
je 0x140196692
sub ecx, 0xfb
je 0x14019651a
cmp ecx, 2
jne 0x1401962a1
mov rax, qword [rdx + 0x20]
cmp rax, 1
jne 0x1401963a2
mov rdx, qword [rdx]
mov rcx, rbx
call fcn.1401958d0
test al, al
je 0x1401966b9
mov rcx, qword [rdi]
mov edx, 1
call qword [sym.imp.USER32.dll_KillTimer]
jmp 0x1401966b9
cmp rax, 2
jne 0x1401966b9
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
mov rbp, rax
call qword [sym.imp.USER32.dll_OpenInputDesktop]
lea rcx, [rsp + 0x272]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x270], si
mov rdi, rax
call fcn.1402c5760
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], si
call fcn.1402c5760
test rbp, rbp
je 0x140196503
test rdi, rdi
je 0x1401964fa
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x270]
mov r9d, 0x208
mov edx, 2
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x1401964fa
lea rax, [rsp + 0x30]
lea r8, [rsp + 0x60]
mov r9d, 0x208
mov edx, 2
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x1401964fa
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x270]
call fcn.1402bcf6c
test eax, eax
je 0x1401964fa
mov rcx, qword [rbx + 0xc0]
call fcn.1400f20b0
test al, al
je 0x1401964f1
lea rdx, str.Default
lea rcx, [rsp + 0x60]
call fcn.1402bcf6c
test eax, eax
je 0x1401964f1
mov eax, dword [0x140433394]
inc eax
mov dword [0x140433394], eax
cmp eax, 2
jl 0x1401964f1
call fcn.14013b0f0
test al, al
je 0x1401964f1
mov rcx, qword [rbx + 0xf8]
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
mov dword [rsp + 0x20], esi
call fcn.1402dc608
test rax, rax
je 0x1401964f1
mov rcx, rax
call fcn.1401b4000
mov rcx, rbp
call qword [sym.imp.USER32.dll_SwitchDesktop]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x1401966b9
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1401966b9
cmp dword [rbx + 0xcc], 1
jne 0x1401962a1
mov ecx, dword [rdx + 0x20]
sub ecx, 0x8000
je 0x1401965f7
dec ecx
je 0x140196555
dec ecx
jne 0x1401962a1
mov rcx, qword [rbx + 0xc0]
mov dl, 1
call fcn.1400f4e90
jmp 0x14019667e
mov rax, qword [rbx + 0xc0]
mov dword [rax + 0x108], esi
mov eax, dword [0x140431ac0]
test al, 1
jne 0x14019659a
or eax, 1
lea rcx, [0x1403050b0]
mov qword [0x140431ad0], 0xffffffff80000002
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
call fcn.1402be804
lea rdx, [0x140352cb8]
lea rcx, [0x140431ac8]
call fcn.1400ece40
mov rdi, rax
test rax, rax
je 0x1401965dc
mov rcx, qword [rax + 8]
lea rdx, str.EarlyWarning
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
mov rax, qword [rbx + 0xc0]
mov rcx, rbx
mov dword [rax + 0x10], 1
call fcn.140195550
jmp 0x1401966b9
mov rax, qword [rbx + 0xc0]
mov dword [rax + 0x108], esi
mov eax, dword [0x140431ac0]
test al, 1
jne 0x14019663c
or eax, 1
lea rcx, [0x1403050b0]
mov qword [0x140431ad0], 0xffffffff80000002
mov dword [0x140431ac0], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x140431ac8], rax
call fcn.1402be804
lea rdx, [0x140352cb8]
lea rcx, [0x140431ac8]
call fcn.1400ece40
mov rdi, rax
test rax, rax
je 0x14019667e
mov rcx, qword [rax + 8]
lea rdx, str.EarlyWarning
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [r8]
mov rax, qword [rbx + 0xc0]
mov rcx, rbx
mov dword [rax + 0x10], esi
call fcn.140195550
jmp 0x1401966b9
cmp qword [rdx + 0x20], rsi
je 0x1401962a1
cmp dword [rbx + 0xcc], 0xa
mov rcx, rbx
je 0x1401962a4
mov rax, qword [rbx]
call qword [rax + 0x120]
mov qword [rdi + 0x18], rsi
mov rbp, qword [rsp + 0x4c0]
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0x490
pop rdi
pop rsi
pop rbx
ret