Function at 0x1400325b0
Capabilities:
Check os version
Create thread
Log keystrokes via application hook

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rsp + 0xe0], rbx
mov r15, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140032617
lea r8, str.Common.cpp
lea edx, [r15 + 0x76]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov qword [0x1403ff438], rsi
call fcn.14005ec00
test eax, eax
jne 0x140032633
lea r8, str.Common.cpp
lea edx, [rax + 0x7c]
jmp 0x1400325ee
mov eax, dword [0x1403ff444]
test eax, eax
jne 0x14003265a
mov dword [0x1403ff440], 0x114
lea rcx, [0x1403ff440]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x1403ff444]
xor r14d, r14d
cmp eax, 6
jne 0x14003266f
cmp dword [0x1403ff448], r14d
lea eax, [r14 + 1]
je 0x140032672
mov eax, r14d
mov dword [reloc.DSOUND.dll_DirectSoundCreate], eax
lea rbx, [rsi + 0x278]
mov rcx, rbx
call fcn.1400e5fa0
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.1400e5cb0
nop
lea rcx, [rbx + 0x1d8]
mov rdx, rax
call fcn.1400157c0
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
or r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400326c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rbp + 0x77], r14d
mov rax, qword [0x1403df148]
test eax, eax
jg 0x1400326ef
lea r8, str.DriverPropertyClient.cpp
mov edx, 0x61
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x14003273a
movups xmm0, xmmword [0x1403468c0]
movaps xmmword [rbp - 9], xmm0
test rax, rax
jle 0x140032ec4
mov rcx, qword [0x1403df140]
lea rax, [rbx + 0x1d0]
lea rdx, [rbp + 0x77]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rbp - 9]
mov rcx, qword [rcx]
call fcn.14005f420
mov rcx, rbx
call fcn.1400e6060
mov rcx, rbx
call fcn.1400e62c0
mov dword [rbp + 0x7f], r14d
mov rax, qword [0x1403df148]
test eax, eax
jg 0x14003276a
lea r8, str.DriverPropertyClient.cpp
mov edx, 0x61
jmp 0x1400325ee
movups xmm0, xmmword [str._alsC]
movaps xmmword [rbp + 7], xmm0
test rax, rax
jle 0x140032ebe
mov rcx, qword [0x1403df140]
lea rdi, [rsi + 0x6c]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1f4
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8d, [r9 + 0x19]
lea rdx, [rbp + 7]
mov rcx, qword [rcx]
call fcn.14005f420
test eax, eax
je 0x1400325fa
test dword [rsi + 0x184], 0x400
je 0x1400327d1
call fcn.1400e6cc0
mov dword [rsi + 0x1d48], eax
lea rdx, [rsi + 0x274]
call fcn.140033200
test eax, eax
je 0x1400325fa
test dword [rsi + 0x274], 0x200000
je 0x1400327ff
mov dword [rsi + 0x1d38], 1
or dword [rsi + 0x70], 3
lea rcx, [rsi + 0x540]
lea r9, [rsi + 0x274]
mov rdx, rdi
call fcn.14000e140
mov ecx, 0x80
call fcn.1400f8110
mov qword [rbp - 0x31], rax
test rax, rax
je 0x140032835
mov rcx, rax
call fcn.1400482f0
mov rcx, rax
jmp 0x140032838
mov rcx, r14
mov qword [rsi + 0x538], rcx
test rcx, rcx
je 0x1400325fa
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x20]
test eax, eax
je 0x1400325fa
lea rcx, [r15 + 0xe8]
mov rax, qword [rcx]
lea r8, [rsi + 0x550]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 0x10000076
call qword [rax + 0x10]
mov rdx, rsi
lea rcx, [rsi + 0x558]
call fcn.140085990
test eax, eax
je 0x1400325fa
mov rdx, rsi
lea rcx, [rsi + 0x1bc8]
call fcn.1400a6e60
test eax, eax
je 0x1400325fa
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x1400328bd
mov rax, qword [rcx]
call qword [rax + 0xb0]
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140032e9c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rbx, str.CplExecuted
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140015a40
test al, al
jne 0x140032910
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400328f6
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.1400105e0
nop
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140032ea7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rbx, [0x140345b70]
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.140015a40
test al, al
jne 0x14003296a
mov rax, r12
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140032950
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.1400105e0
nop
movzx eax, word [rsi + 0x44c]
movzx ecx, word [rsi + 0x44e]
movzx r9d, word [rsi + 0x448]
movzx r8d, word [rsi + 0x44a]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.__X_X__X_X
lea rcx, [rbp - 0x31]
call fcn.14000dfa0
mov rdi, qword [rbp - 0x31]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.14001cfc0
xor r9d, r9d
mov rbx, qword [rbp - 0x39]
mov r8, rbx
lea rdx, str.General
lea rcx, [0x140400ce0]
call fcn.1401076a0
test eax, eax
jne 0x140032a2f
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x1400329e7
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, rsi
lea rcx, [rsi + 0x1bc8]
call fcn.1400a6e60
test eax, eax
je 0x140032e5b
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x140032a13
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov r9d, 1
mov r8, rbx
lea rdx, str.General
lea rcx, [0x140400ce0]
call fcn.140107c34
mov eax, dword [rsi + 0x34]
test al, 4
je 0x140032a3e
call fcn.140033310
mov eax, dword [rsi + 0x34]
bt eax, 0x18
jae 0x140032a4c
mov rcx, rsi
call fcn.140036020
test dword [rsi + 0x1bc], 0x1000
je 0x140032a60
mov rcx, rsi
call fcn.140036160
test byte [rsi + 0x34], 0x20
je 0x140032a6e
mov rcx, rsi
call fcn.140033500
test dword [rsi + 0x5c], 0x1000
je 0x140032a7f
mov rcx, rsi
call fcn.140033610
mov eax, dword [rsi + 0x34]
test al, 0x40
je 0x140032ade
mov rcx, qword [rsi + 0x1d40]
test rcx, rcx
jne 0x140032aac
lea r8, str.Common.cpp
mov edx, 0x7c3
lea rcx, str._VCpl__RETURN_TRUE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x140032abd
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x140032abd
mov qword [rsi + 0x1d40], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1400343b0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rsi + 0x1d40], rax
mov eax, dword [rsi + 0x34]
bt eax, 0x11
jae 0x140032aec
mov rcx, rsi
call fcn.140035ae0
mov rbx, qword [rsi + 0x1bd8]
test rbx, rbx
je 0x140032b7a
nop dword [rax]
mov rdx, rbx
test rbx, rbx
je 0x140032eb2
mov rbx, qword [rbx]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x140032b32
cmp dword [rdx + 0x168], 0
je 0x140032b32
test dword [rdx + 0x314], 0x40000
je 0x140032b32
call fcn.140035c80
test rbx, rbx
jne 0x140032b00
mov rbx, qword [rsi + 0x1bd8]
test rbx, rbx
je 0x140032b7a
mov rcx, rbx
test rbx, rbx
je 0x140032eb8
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140032b75
cmp dword [rcx + 0x168], 0
je 0x140032b75
test dword [rcx + 0x318], 0x4001000
je 0x140032b75
call fcn.140019fc0
test rbx, rbx
jne 0x140032b43
test byte [rsi + 0x34], 0x40
je 0x140032b86
test byte [rsi + 0x44], 2
jne 0x140032b96
test dword [rsi + 0x184], 0x400
je 0x140032ce4
cmp qword [0x1403e3210], 0
je 0x140032bbd
lea r8, str.BeepThread.cpp
mov edx, 0x2d
lea rcx, str._VCpl__RETURN_TRUE_ON_TRUE:_Line___d__File___s_n
call fcn.140055180
jmp 0x140032ce4
mov dword [rbp - 0x29], r14d
cmp qword [0x1403e3220], 0
jne 0x140032be2
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403e3220], rax
cmp qword [0x1403e3228], 0
jne 0x140032c03
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403e3228], rax
cmp qword [0x1403e3230], 0
jne 0x140032c24
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403e3230], rax
cmp qword [0x1403e3238], 0
jne 0x140032c45
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403e3238], rax
cmp qword [0x1403e3240], 0
jne 0x140032c66
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403e3240], rax
cmp qword [0x1403e3218], 0
jne 0x140032c8c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403e3218], rax
test rax, rax
je 0x140032ce4
call fcn.14010fd08
test rax, rax
je 0x140032cad
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xe8]
test rax, rax
je 0x140032cad
mov rax, qword [rax + 0x40]
jmp 0x140032cb0
mov rax, r14
mov qword [0x1403e3368], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r9, [0x1403e3210]
lea r8, [0x140031f80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1403e3210], rax
test byte [rsi + 0x11c], 3
je 0x140032daf
mov rbx, qword [rsi + 0x1bd8]
nop dword [rax + rax]
test rbx, rbx
je 0x140032daf
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x140032d00
cmp dword [rcx + 0x168], 0
jne 0x140032d00
cmp dword [rcx + 0x1d8], 4
jne 0x140032d00
mov rax, qword [0x1403ff438]
inc dword [rax + 0x1d60]
test dword [rcx + 0x30c], 0x40000
je 0x140032d00
mov edx, 2
call fcn.1400c0350
mov r15, rax
test rax, rax
je 0x140032d00
mov dword [rbp + 0x6f], r14d
mov r9d, 1
lea r8, [rbp + 0x6f]
lea rdx, [0x140341610]
mov rcx, rax
call fcn.14000f3a0
test byte [rbp + 0x6f], 0xc
mov ecx, r14d
setne cl
mov dword [rbp - 0x21], ecx
movups xmm0, xmmword [str._alsC]
movaps xmmword [rbp + 0x17], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 0x31]
lea rdx, [rbp + 0x17]
mov rcx, qword [r15 + 0x30]
call fcn.14005e2c0
test byte [rsi + 0x50], 4
je 0x140032de3
mov rax, qword [rsi + 0x1bd8]
test rax, rax
je 0x140032de3
mov rcx, rax
mov rax, qword [rax]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140032dbc
cmp dword [rcx + 0x1d8], 1
jne 0x140032dbc
xor r8d, r8d
xor edx, edx
call fcn.14001a900
mov eax, dword [rsi + 0x50]
test al, 0x20
je 0x140032df5
mov rcx, rsi
call fcn.140033720
mov eax, dword [rsi + 0x50]
test al, 0x40
je 0x140032e55
mov edx, dword [rsi + 0x56c]
test edx, edx
je 0x140032e33
mov eax, r14d
imul rcx, rax, 0xac
cmp dword [rcx + rsi + 0x6a4], 0x1a
jne 0x140032e2b
cmp dword [rcx + rsi + 0x6b4], 0xffffffff
jne 0x140032e2b
cmp dword [rcx + rsi + 0x6bc], 0
je 0x140032e36
inc r14d
cmp r14d, edx
jb 0x140032e03
mov r14d, r12d
movsxd rax, r14d
imul rcx, rax, 0xac
test byte [rcx + rsi + 0x620], 2
je 0x140032e55
mov ecx, 0x80000041
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov r14d, 1
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032e76
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140032e94
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r14d
jmp 0x1400325fc
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
nop
call fcn.1400f91a0
int3
call fcn.1400f91a0
nop
call fcn.1400f91a0
int3
call fcn.1400f91a0
int3