Function at 0x10000404c
Capabilities:
Check mutex on windows
Delete registry key
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x180
mov rax, qword [0x10001e110]
xor rax, rsp
mov qword [rsp + 0x170], rax
xor r9d, r9d
mov rbx, r8
mov rbp, rcx
lea esi, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov edx, esi
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r9d, [rsi + 0x63]
lea r8, [rsp + 0xa0]
lea edx, [rsi + 0x65]
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
xor r15d, r15d
mov r14d, esi
mov r12d, r15d
mov r13d, r15d
lea edi, [rsi + 3]
cmp rbx, r15
je 0x100004352
cmp word [rbx], 0x2d
je 0x1000040d7
cmp word [rbx], 0x2f
jne 0x100004352
movabs rax, 0x20002d002f
mov rcx, rbx
mov qword [rsp + 0x98], rax
jmp 0x100004283
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x1000022b0]
or r9d, 0xffffffff
mov r8, rbx
mov edx, esi
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x100004126
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
or ecx, 0xffffffff
lea rax, [0x1000022c0]
mov r8, rbx
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov ecx, 0x7f
mov edx, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov r8, rbx
mov edx, esi
cmp eax, 2
lea rax, [0x1000022d8]
cmove r14d, r15d
or ecx, 0xffffffff
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov ecx, 3
cmp eax, 2
lea rax, [0x1000022f0]
mov r8, rbx
cmove r12d, ecx
or ecx, 0xffffffff
mov edx, esi
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov r8, rbx
cmp eax, 2
lea rax, [0x100002300]
mov edx, esi
cmove r12d, edi
or ecx, 0xffffffff
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov ecx, 2
cmp eax, ecx
lea rax, [0x100002310]
mov r8, rbx
cmove r12d, ecx
or ecx, 0xffffffff
mov edx, esi
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov ecx, 2
cmp eax, ecx
jne 0x100004252
call fcn.100017f2c
mov qword [0x10001ecd0], rax
call fcn.100017f2c
mov edx, 0xff00ff
mov rcx, rax
mov qword [0x10001ecd8], rax
mov rax, qword [rax]
call qword [rax + 0x18]
call fcn.100017f2c
mov edx, 0xffff00
mov rcx, rax
mov qword [0x10001ecc8], rax
mov rax, qword [rax]
call qword [rax + 0x18]
or ecx, 0xffffffff
lea rax, [0x100002320]
mov r8, rbx
mov dword [rsp + 0x28], ecx
mov r9d, ecx
mov ecx, 0x7f
mov edx, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
mov ecx, 2
cmp eax, ecx
je 0x1000042a2
xor ecx, ecx
lea rdx, [rsp + 0x98]
call qword [sym.imp.msvcrt.dll_wcstok]
mov rbx, rax
cmp rax, r15
jne 0x1000040f1
jmp 0x100004360
mov r8d, esi
mov edx, 0x1736
xor ecx, ecx
call sub.ntdll.dll_WinSqmIncrementDWORD
cmp qword [0x10001ee68], r15
jne 0x1000042c6
lea rcx, [rsp + 0x70]
call fcn.100014860
jmp 0x1000042c9
mov eax, r15d
cmp eax, r15d
jl 0x10000464f
mov qword [rsp + 0x40], r15
lea rax, [rsp + 0x58]
lea rdx, [0x100002190]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r15d
je 0x100004347
mov rcx, qword [0x10001e120]
lea rdx, [0x10001e120]
cmp rcx, rdx
je 0x100004347
test byte [rcx + 0x1c], dil
je 0x100004347
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020e8]
mov edx, 0xa
mov r9d, eax
call fcn.100003978
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.100003c80
cmp eax, r15d
jne 0x10000464f
lea rax, [rsp + 0x60]
lea rdx, [0x100002190]
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x1000043b9
lea rdx, [0x100002190]
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov r13d, esi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x100002340]
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rdi, rax
cmp rax, r15
jne 0x1000043da
or eax, 0xffffffff
jmp 0x100004651
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10000441c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0xa0]
lea rcx, [0x1000020f8]
call qword [sym.imp.USER32.dll_FindWindowW]
cmp rax, r15
je 0x10000464f
mov rcx, rax
call qword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x10000464f
lea rax, [0x100001c70]
lea rbx, [0x10001ece0]
mov byte [0x10001ecf8], sil
mov qword [0x10001ecf0], r15
mov qword [0x10001ece0], r15
mov byte [0x10001ecf9], r15b
mov qword [0x10001ed00], rax
mov qword [0x10001e120], rbx
mov word [0x10001ecfa], r15w
mov dword [0x10001ecfc], r15d
lea rsi, [0x10001ed00]
mov r8, qword [rsi]
lea rax, [rbx + 8]
lea rcx, [0x1000039b4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r15
mov r9d, 1
mov rdx, rbx
mov qword [rsp + 0x28], r15
add rsi, 8
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x10000446a
mov rcx, qword [0x10001e120]
lea rbx, [0x10001e120]
cmp rcx, rbx
je 0x1000044e4
test byte [rcx + 0x1c], 0x10
je 0x1000044e4
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020e8]
mov edx, 0xb
call fcn.100003954
lea r9, [0x10001eec0]
lea r8, [0x10001eec8]
lea rdx, [0x1000049a0]
lea rcx, [0x100001bc0]
call fcn.1000049dc
movabs rcx, 0x8000000000010000
cmp dword [0x10001eeec], r15d
je 0x100004555
mov al, byte [0x10001eef0]
cmp al, 4
jae 0x100004527
cmp al, r15b
jne 0x100004555
test qword [0x10001eed8], rcx
je 0x100004555
mov rdx, qword [0x10001eee0]
mov rax, rdx
and rax, rcx
cmp rax, rdx
jne 0x100004555
mov rcx, qword [0x10001eec0]
lea rdx, [0x100001bd0]
call fcn.100004984
mov esi, 1
mov edx, esi
lea ecx, [rsi + 0x63]
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea rcx, [0x100002388]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor ecx, ecx
mov qword [0x10001ed88], rbp
call qword [sym.imp.ole32.dll_CoInitialize]
cmp eax, r15d
jge 0x1000045c7
mov rcx, qword [0x10001e120]
cmp rcx, rbx
je 0x1000045b0
test byte [rcx + 0x1c], 4
je 0x1000045b0
mov rcx, qword [rcx + 0x10]
lea edx, [rsi + 0xb]
lea r8, [0x1000020e8]
mov r9d, eax
call fcn.100003978
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10000464f
lea rdx, [0x100000000]
mov r9b, sil
mov r8b, sil
mov ecx, 8
call sub.DUI70.dll_InitProcessPriv
cmp eax, r15d
mov ebx, eax
jl 0x100004606
mov ecx, 2
call sub.DUI70.dll_InitThread
cmp eax, r15d
mov ebx, eax
jge 0x10000467c
lea rcx, [0x100000000]
call sub.DUI70.dll_UnInitProcessPriv
mov rcx, qword [0x10001e120]
lea rdx, [0x10001e120]
cmp rcx, rdx
je 0x100004637
test byte [rcx + 0x1c], 4
je 0x100004637
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020e8]
mov edx, 0xd
mov r9d, ebx
call fcn.100003978
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1000192d0
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 8
mov dword [rsp + 0x54], 0xc000
call qword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
cmp eax, r15d
jne 0x1000046a2
call qword [sym.imp.COMCTL32.dll_InitCommonControls]
mov r8, qword [0x10001ed88]
xor r9d, r9d
lea rdx, [0x100003f94]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x80], esi
mov qword [rsp + 0x88], r15
mov rbp, rax
mov dword [rsp + 0x90], r15d
mov dword [rsp + 0x94], esi
call sub.gdiplus.dll_GdiplusStartup
cmp eax, r15d
je 0x100004736
mov rcx, qword [0x10001e120]
lea rdx, [0x10001e120]
cmp rcx, rdx
je 0x1000045b0
test byte [rcx + 0x1c], 4
je 0x1000045b0
mov rcx, qword [rcx + 0x10]
lea r8, [0x1000020e8]
mov edx, 0xe
mov r9d, eax
call fcn.100003978
jmp 0x1000045b0
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea ebx, [r9 + 0x47]
mov ecx, ebx
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea edx, [rbx - 0x2d]
xor r9d, r9d
mov r8, rbx
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
mov r8d, esi
mov edx, 0x1ab1
xor ecx, ecx
call sub.ntdll.dll_WinSqmIncrementDWORD
cmp dword [0x10001eeec], r15d
je 0x1000047bd
mov al, byte [0x10001eef0]
cmp al, 4
jae 0x100004785
cmp al, r15b
jne 0x1000047bd
movabs rbx, 0x8000000000010000
test qword [0x10001eed8], rbx
je 0x1000047bd
mov rdx, qword [0x10001eee0]
mov rax, rdx
and rax, rbx
cmp rax, rdx
jne 0x1000047bd
lea rdx, [0x100001be0]
mov rcx, qword [0x10001eec0]
call fcn.100004984
mov edx, r13d
mov ecx, r12d
call fcn.100004b0c
mov rsi, rax
cmp rax, r15
je 0x100004842
mov rax, qword [rax]
mov rcx, rsi
call qword [rax + 0x38]
mov r12d, dword [rsi + 0x34]
mov rax, qword [rsi]
cmp r12d, r15d
mov edx, 1
mov rcx, rsi
mov ebx, r15d
setne bl
call qword [rax + 0x28]
cmp ebx, r15d
je 0x100004842
cmp dword [0x10001eeec], r15d
je 0x1000047bd
mov al, byte [0x10001eef0]
cmp al, 4
jae 0x100004811
cmp al, r15b
jne 0x1000047bd
movabs rbx, 0x8000000000010000
test qword [0x10001eed8], rbx
je 0x1000047bd
mov rcx, qword [0x10001eee0]
mov rax, rcx
and rax, rbx
cmp rax, rcx
jne 0x1000047bd
lea rdx, [0x100001c40]
jmp 0x1000047b1
call fcn.100012370
cmp rbp, r15
je 0x100004855
mov rcx, rbp
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor edx, edx
xor r9d, r9d
xor r8d, r8d
lea ebx, [rdx + 0x47]
mov ecx, ebx
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
lea edx, [rbx - 0x2d]
xor r9d, r9d
mov r8, rbx
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, qword [rsp + 0x68]
call sub.gdiplus.dll_GdiplusShutdown
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14d, r15d
je 0x1000048a2
call fcn.100003d7c
mov rbx, qword [0x10001ee68]
cmp rbx, r15
je 0x1000048e9
mov rcx, rbx
call fcn.1000149a0
mov rcx, qword [rbx]
cmp rcx, r15
je 0x1000048c7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
cmp rcx, r15
je 0x1000048da
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx + 8], r15
mov rcx, rbx
call fcn.1000192ac
mov qword [0x10001ee68], r15
call sub.DUI70.dll_UnInitThread
lea rcx, [0x100000000]
call sub.DUI70.dll_UnInitProcessPriv
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [0x10001eec0]
call fcn.100004954
mov rbx, qword [0x10001e120]
lea rdi, [0x10001e120]
cmp rbx, rdi
je 0x100004943
jmp 0x100004937
mov rcx, qword [rbx + 8]
cmp rcx, r15
je 0x100004934
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rbx + 8], r15
mov rbx, qword [rbx]
cmp rbx, r15
jne 0x100004921
mov qword [0x10001e120], rdi
mov eax, 1
jmp 0x100004651