Function at 0x10012da0
Capabilities:
Enumerate services
Log keystrokes via input method manager
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
movsd xmm0, qword [0x1002aa38]
sub esp, 0x34
ucomisd xmm0, qword [str.kHi]
push ebx
push esi
push edi
lahf
test ah, 0x44
jp 0x1001344d
cvttsd2si eax, qword [0x1002aa30]
push eax
sub esp, 0x18
mov ecx, esp
push 4
push str.paqo
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa58]
push 0
push 0x109265c5
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x10022848]
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
movsd qword [esp], xmm0
call esi
sub esp, 0x18
mov dword [ebp - 4], eax
mov ecx, esp
push 3
push 0x100225ec
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa50]
push 0
push 0x1575da11
call fcn.10014e70
movsd xmm0, qword [0x1002aa60]
push edx
push eax
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmIsUIMessageA
sub esp, 0x18
mov ebx, eax
mov ecx, esp
mov edi, edx
push 5
push str.otpay
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movsd qword [ebp - 0x1c], xmm0
movsd xmm0, qword [0x1002aa70]
call fcn.10014e70
push edx
push eax
call esi
add esp, 8
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [0x100228d0]
divsd xmm1, xmm0
movsd qword [ebp - 0x14], xmm1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsd xmm1, qword [ebp - 0x14]
sub esp, 0x18
divsd xmm1, xmm0
mov esi, esp
movsd xmm0, qword [0x1002aa28]
movsd qword [ebp - 0x14], xmm1
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCompositionStringW
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x14]
movsd qword [ebp - 0x2c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x24], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov edx, edi
mov ecx, ebx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0xc], xmm0
call fcn.10014f20
mulsd xmm0, qword [0x100227f0]
movsd qword [ebp - 0x14], xmm0
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm1, qword [ebp - 0x14]
divsd xmm1, xmm0
push 0x156c8fef
sub esp, 0x18
mov esi, esp
movsd xmm0, qword [0x1002aa68]
divsd xmm1, qword [ebp - 0x1c]
mulsd xmm1, qword [ebp - 0xc]
divsd xmm1, qword [ebp - 0x24]
movsd qword [ebp - 0x14], xmm1
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0x115f2d8b
push 0
push 0x3fbae778
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
movd xmm0, dword [ebp - 4]
cvtdq2pd xmm0, xmm0
movd xmm1, eax
cvttsd2si eax, qword [0x1002aa30]
cvtdq2pd xmm1, xmm1
push eax
sub esp, 0x18
mov ecx, esp
push 4
mulsd xmm1, qword [0x100228d8]
push str.paqo
mulsd xmm1, xmm0
movsd xmm0, qword [0x10022ac0]
subsd xmm0, xmm1
addsd xmm0, qword [ebp - 0x14]
addsd xmm0, qword [ebp - 0x2c]
movsd qword [0x1002aa50], xmm0
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa58]
push 0
push 0x109265c5
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x10022848]
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
movsd qword [esp], xmm0
call esi
sub esp, 0x18
mov dword [ebp - 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
push 3
push 0x100225ec
call fcn.1000cf20
movsd xmm0, qword [0x1002aa50]
push 0
push 0x1575da11
call fcn.10014e70
movsd xmm0, qword [0x1002aa60]
push edx
push eax
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmIsUIMessageA
sub esp, 0x18
mov ebx, eax
mov ecx, esp
mov edi, edx
push 5
push str.otpay
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movsd qword [ebp - 0x2c], xmm0
movsd xmm0, qword [0x1002aa70]
call fcn.10014e70
push edx
push eax
call esi
add esp, 8
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [0x100228d0]
divsd xmm1, xmm0
movsd qword [ebp - 0x14], xmm1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsd xmm1, qword [ebp - 0x14]
sub esp, 0x18
divsd xmm1, xmm0
mov esi, esp
movsd xmm0, qword [0x1002aa28]
movsd qword [ebp - 0x14], xmm1
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCompositionStringW
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x14]
movsd qword [ebp - 0x34], xmm0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov edx, edi
mov ecx, ebx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x24], xmm0
call fcn.10014f20
mulsd xmm0, qword [0x100227f0]
movsd qword [ebp - 0x14], xmm0
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm1, qword [ebp - 0x14]
divsd xmm1, xmm0
push 0x156c8fef
sub esp, 0x18
mov esi, esp
movsd xmm0, qword [0x1002aa68]
divsd xmm1, qword [ebp - 0x2c]
mulsd xmm1, qword [ebp - 0x24]
divsd xmm1, qword [ebp - 0x1c]
movsd qword [ebp - 0x14], xmm1
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0x115f2d8b
push 0
push 0x3fbae778
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
movd xmm1, dword [ebp - 4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvttsd2si eax, qword [0x1002aa30]
cvtdq2pd xmm0, xmm0
push eax
sub esp, 0x18
mov ecx, esp
push 4
mulsd xmm0, qword [0x100228d8]
push str.paqo
mulsd xmm0, xmm1
movsd xmm1, qword [0x100228e8]
subsd xmm1, xmm0
addsd xmm1, qword [ebp - 0x14]
addsd xmm1, qword [ebp - 0x34]
movsd qword [0x1002aa60], xmm1
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa58]
push 0
push 0x109265c5
sub esp, 0x18
mov esi, esp
call fcn.10014e70
push edx
push eax
push esi
call fcn.10011280
movsd xmm0, qword [0x10022848]
add esp, 4
mov esi, dword [sym.imp.ADVAPI32.dll_ImpersonateNamedPipeClient]
movsd qword [esp], xmm0
call esi
sub esp, 0x18
mov dword [ebp - 4], eax
mov ecx, esp
push 3
push 0x100225ec
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
movsd xmm0, qword [0x1002aa50]
push 0
push 0x1575da11
call fcn.10014e70
movsd xmm0, qword [0x1002aa60]
push edx
push eax
call fcn.10014e70
push edx
push eax
call sub.IMM32.dll_ImmIsUIMessageA
sub esp, 0x18
mov ebx, eax
mov ecx, esp
mov edi, edx
push 5
push str.otpay
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.1000cf20
call dword [sym.imp.ADVAPI32.dll_EnumServicesStatusW]
movsd qword [ebp - 0x34], xmm0
movsd xmm0, qword [0x1002aa70]
call fcn.10014e70
push edx
push eax
call esi
add esp, 8
mov ecx, eax
call fcn.10014f20
movsd xmm1, qword [0x100228d0]
divsd xmm1, xmm0
movsd qword [ebp - 0x14], xmm1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movsd xmm1, qword [ebp - 0x14]
sub esp, 0x18
divsd xmm1, xmm0
mov esi, esp
movsd xmm0, qword [0x1002aa28]
movsd qword [ebp - 0x14], xmm1
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
call sub.IMM32.dll_ImmGetCompositionStringW
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [ebp - 0x14]
movsd qword [ebp - 0x1c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x24], xmm0
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
mov edx, edi
mov ecx, ebx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x2c], xmm0
call fcn.10014f20
mulsd xmm0, qword [0x100227f0]
movsd qword [ebp - 0x14], xmm0
call sub.IMM32.dll_ImmGetCompositionStringW
movsd xmm1, qword [ebp - 0x14]
divsd xmm1, xmm0
push 0x156c8fef
sub esp, 0x18
mov esi, esp
movsd xmm0, qword [0x1002aa68]
divsd xmm1, qword [ebp - 0x34]
mulsd xmm1, qword [ebp - 0x2c]
divsd xmm1, qword [ebp - 0x24]
movsd qword [ebp - 0x14], xmm1
call fcn.10014e70
push edx
push eax
push esi
call fcn.100111f0
add esp, 0xc
push 0x115f2d8b
push 0
push 0x3fbae778
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigW]
movd xmm1, dword [ebp - 4]
cvtdq2pd xmm1, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100228d8]
mulsd xmm0, xmm1
movsd xmm1, qword [0x10022808]
subsd xmm1, xmm0
addsd xmm1, qword [ebp - 0x14]
addsd xmm1, qword [ebp - 0x1c]
movsd qword [0x1002aa68], xmm1
push 0
push 0x10022410
push 0x10022600
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret