Function at 0x1400046f0
Capabilities:
Identify system language via api
Log keystrokes
Persist via run registry key

Disassembly:
mov rcx, qword [0x140025f98]
test rcx, rcx
je 0x14000470d
xor r9d, r9d
mov edx, 0x111
lea r8d, [r9 + 2]
jmp 0x140004930
ret
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x9e8]
sub rsp, 0xac0
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400240c0]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov r15, rcx
sub edx, 0x110
je 0x140005120
dec edx
jne 0x14000559d
movzx ecx, r8w
sub ecx, 2
je 0x140004f57
sub ecx, 0x3ef
je 0x1400049dc
dec ecx
jne 0x14000559d
mov edx, 0x3ee
mov rcx, r15
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x1400049ba
xor ecx, ecx
jmp 0x1400049bf
mov ecx, 1
call fcn.140004410
mov edx, 0x3f2
mov rcx, r15
call qword [sym.imp.USER32.dll_EndDialog]
mov eax, 1
jmp 0x14000559f
mov edx, 0x3ee
mov rcx, r15
call qword [sym.imp.USER32.dll_IsDlgButtonChecked]
cmp eax, 1
jne 0x1400049f3
xor ecx, ecx
jmp 0x1400049f8
mov ecx, 1
call fcn.140004410
xor r14d, r14d
mov word [rbp - 0x50], r14w
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rbp - 0x4e]
call fcn.140009b50
mov dword [rsp + 0x40], pe_nt_image_headers64
mov dword [rsp + 0x20], r14d
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x68]
call fcn.140006e70
nop
mov qword [rsp + 0x28], r14
lea rax, str.C:Program_FilesSynapticsSynTPSynTPLpr.exe
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x50]
lea rdx, [0x140018520]
lea rcx, [rsp + 0x70]
call fcn.140006930
lea rcx, [rbp - 0x50]
or r12, 0xffffffffffffffff
mov rax, r12
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140004a75
lea rax, [rax*2 - 0x18]
cmp rax, 0x200
jae 0x140004f51
mov word [rbp + rax - 0x50], r14w
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx ecx, ax
mov eax, 0x409
cmp cx, ax
jne 0x140004ada
lea rcx, [rbp - 0x50]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140004ab5
mov eax, 0x411
cmp cx, ax
jne 0x140004b15
lea rcx, [rbp - 0x50]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140004af0
movups xmm0, xmmword [str.tp4sc_JP.htm]
movsd xmm1, qword [0x140018b20]
movzx eax, word [0x140018b28]
jmp 0x140004eb3
mov eax, 0x410
cmp cx, ax
jne 0x140004b55
lea rcx, [rbp - 0x50]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140004b30
movups xmm0, xmmword [str.tp4sc_IT.htm]
movsd xmm1, qword [0x140018b40]
movzx eax, word [0x140018b48]
jmp 0x140004eb3
mov eax, 0x407
cmp cx, ax
jne 0x140004b95
lea rcx, [rbp - 0x50]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140004b70
movups xmm0, xmmword [str.tp4sc_GR.htm]
movsd xmm1, qword [0x140018b60]
movzx eax, word [0x140018b68]
jmp 0x140004eb3
mov eax, 0x40c
cmp cx, ax
jne 0x140004bd5
lea rcx, [rbp - 0x50]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x140004bb0
movups xmm0, xmmword [str.tp4sc_FR.htm]
movsd xmm1, qword [0x140018ba0]
movzx eax, word [0x140018ba8]
jmp 0x140004eb3
mov edx, 0x40a
movzx eax, cx
sub ax, dx
mov edx, 0xf3ff
test dx, ax
jne 0x140004c25
mov eax, 0x100a
cmp cx, ax
cmp ecx, eax
call fcn.1400097fc
nop
lea rdx, str.SynCom.SynAPI
lea rcx, [rsp + 0x50]
call fcn.1400056d0
lea rax, vtable.SynAPI.0
mov qword [rsp + 0x48], rax
lea r13, vtable.CDummySynAPI.0
mov qword [rsp + 0x58], r13
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x140004f9e
mov edx, 0x3f2
mov rcx, r15
call qword [sym.imp.USER32.dll_EndDialog]
nop
jmp 0x14000557c
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
je 0x140004fad
jmp 0x14000557c
lea rdx, str.SynCom.PointingDevice
lea rcx, [rsp + 0x70]
call fcn.140005830
lea rax, vtable.SynDevice.0
mov qword [rsp + 0x68], rax
lea rax, vtable.SynDevice.1.0
mov qword [rsp + 0x78], rax
lea rax, vtable.CDummySynDevice.0
mov qword [rbp - 0x78], rax
xor r14d, r14d
mov dword [rbp - 0x70], r14d
mov qword [rbp - 0x80], r14
or r12, 0xffffffffffffffff
mov dword [rsp + 0x60], r12d
nop word [rax + rax]
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x50]
test rax, rax
cmovne rcx, rax
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x1400050db
lea rcx, [rbp - 0x78]
mov rax, qword [rsp + 0x70]
test rax, rax
cmovne rcx, rax
mov rax, qword [rcx]
mov edx, dword [rsp + 0x60]
call qword [rax + 0x78]
test eax, eax
jne 0x140005000
mov dword [rsp + 0x44], r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005072
mov rax, qword [rcx]
lea r8, [rsp + 0x44]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x44], 5
je 0x140005097
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x40], r14d
test rcx, rcx
je 0x140005000
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x40], 4
jne 0x140005000
mov eax, r14d
mov dword [rsp + 0x40], eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400050bc
mov rax, qword [rcx]
lea r8, [rsp + 0x40]
mov edx, 0x1000010e
call qword [rax + 0x18]
mov eax, dword [rsp + 0x40]
test al, 0x20
je 0x1400050cf
mov ecx, 1
call fcn.140004410
jmp 0x140005000
xor ecx, ecx
call fcn.140004410
jmp 0x140005000
mov edx, 0x3f2
mov rcx, r15
call qword [sym.imp.USER32.dll_EndDialog]
nop
lea rcx, [rsp + 0x68]
call fcn.140005a50
nop
mov qword [0x140025f98], rcx
mov ecx, 0x190
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.SynCom.SynAPI
lea rcx, [rsp + 0x50]
call fcn.1400056d0
lea rax, vtable.SynAPI.0
mov qword [rsp + 0x48], rax
lea r13, vtable.CDummySynAPI.0
mov qword [rsp + 0x58], r13
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x50]
test rax, rax
cmovne rcx, rax
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x14000557c
lea rdx, str.SynCom.PointingDevice
lea rcx, [rsp + 0x70]
call fcn.140005830
lea rax, vtable.SynDevice.0
mov qword [rsp + 0x68], rax
lea rax, vtable.SynDevice.1.0
mov qword [rsp + 0x78], rax
lea rax, vtable.CDummySynDevice.0
mov qword [rbp - 0x78], rax
xor r14d, r14d
mov dword [rbp - 0x70], r14d
mov qword [rbp - 0x80], r14
or r12, 0xffffffffffffffff
mov dword [rsp + 0x40], r12d
lea rcx, [rsp + 0x58]
mov rax, qword [rsp + 0x50]
test rax, rax
cmovne rcx, rax
mov rax, qword [rcx]
lea r9, [rsp + 0x40]
xor r8d, r8d
xor edx, edx
call qword [rax + 0x20]
test eax, eax
jne 0x14000529d
lea rcx, [rbp - 0x78]
mov rax, qword [rsp + 0x70]
test rax, rax
cmovne rcx, rax
mov rax, qword [rcx]
mov edx, dword [rsp + 0x40]
call qword [rax + 0x78]
test eax, eax
jne 0x1400051c2
mov dword [rsp + 0x44], r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140005234
mov rax, qword [rcx]
lea r8, [rsp + 0x44]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x44], 5
je 0x140005259
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x60], r14d
test rcx, rcx
je 0x1400051c2
mov rax, qword [rcx]
lea r8, [rsp + 0x60]
mov edx, 0x10000102
call qword [rax + 0x18]
cmp dword [rsp + 0x60], 4
jne 0x1400051c2
mov eax, r14d
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000527e
mov rax, qword [rcx]
lea r8, [rsp + 0x44]
mov edx, 0x1000010e
call qword [rax + 0x18]
mov eax, dword [rsp + 0x44]
test al, 0x20
je 0x140005291
mov ecx, 1
call fcn.140004410
jmp 0x1400051c2
xor ecx, ecx
call fcn.140004410
jmp 0x1400051c2
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rbx, rax
mov edx, 8
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
mov edx, 0xa
mov rcx, rbx
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
mov esi, eax
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.USER32.dll_ReleaseDC]
lea rdx, [rbp - 0x60]
mov rcx, r15
call qword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [rbp - 0x60]
sub eax, dword [rbp - 0x58]
add eax, edi
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov eax, dword [rbp - 0x5c]
sub eax, dword [rbp - 0x54]
add eax, esi
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov r9d, eax
xor edx, edx
mov rcx, r15
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call qword [sym.imp.USER32.dll_SetWindowPos]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov r8d, 1
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, r15
call qword [sym.imp.USER32.dll_SetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor r8d, r8d
mov edx, ebx
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r9d, 0x400
lea r8, [rbp + 0x1b0]
mov edx, 7
mov rcx, qword [0x140025f90]
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, r15
test eax, eax
je 0x140005568
lea rdx, [rbp + 0x1b0]
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x3eb
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
test rax, rax
je 0x140005565
mov r9d, 0x400
lea r8, [rbp + 0x1b0]
mov edx, 8
mov rcx, qword [0x140025f90]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140005565
lea rdx, [rbp + 0x1b0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, 0x3ec
mov rcx, r15
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rbx, rax
test rax, rax