Function at 0x1400719b0
Capabilities:
Check os version
Log keystrokes via application hook

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbp, rdx
mov rbx, rcx
test rdx, rdx
jne 0x1400719d6
xor eax, eax
jmp 0x140071f59
mov qword [0x14022e6d8], rcx
call fcn.14008aaa0
test eax, eax
je 0x140071f59
mov eax, dword [0x14022e714]
test eax, eax
jne 0x140071a11
mov dword [0x14022e710], 0x114
lea rcx, [0x14022e710]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022e714]
xor esi, esi
cmp eax, 6
jne 0x140071a2c
cmp dword [0x14022e718], esi
jne 0x140071a2c
mov dword [reloc.DSOUND.dll_DirectSoundCreate], 1
jmp 0x140071a32
mov dword [reloc.DSOUND.dll_DirectSoundCreate], esi
lea rcx, [rbx + 0x278]
call fcn.1401197a0
test eax, eax
je 0x140071f59
mov dword [rsp + 0x98], esi
mov rcx, qword [0x14021cc50]
test ecx, ecx
jle 0x140071f57
lea rdx, [rsp + 0x50]
mov rax, qword [0x1401ac380]
mov qword [rdx], rax
mov rax, qword [0x1401ac388]
mov qword [rdx + 8], rax
test rcx, rcx
jle 0x140071f51
lea r12, [rbx + 0x6c]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1f4
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 0x19]
lea rdx, [rsp + 0x50]
mov rcx, qword [0x14021cc48]
mov rcx, qword [rcx]
call fcn.14008b3c0
test eax, eax
je 0x140071f57
bt dword [rbx + 0x184], 0xa
jae 0x140071adc
lea rcx, [rbx + 0x278]
call fcn.14011ae10
mov dword [rbx + 0x1d48], eax
lea rdi, [rbx + 0x274]
test rdi, rdi
je 0x140071f4d
mov rcx, rdi
call fcn.1400722e0
test eax, eax
je 0x140071f4d
bt dword [rdi], 0x15
jae 0x140071b10
mov dword [rbx + 0x1d38], 1
or dword [rbx + 0x70], 3
lea rcx, [rbx + 0x540]
mov r8, rdi
mov rdx, r12
call fcn.1401291b0
mov ecx, 0x80
call fcn.14013d028
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140071b43
mov rcx, rax
call fcn.14012cd30
mov rcx, rax
jmp 0x140071b46
mov rcx, rsi
mov qword [rbx + 0x538], rcx
test rcx, rcx
jne 0x140071b59
xor eax, eax
jmp 0x140071f59
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x140071f59
lea rcx, [rbp + 0xa8]
mov rax, qword [rcx]
lea r8, [rbx + 0x550]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov edx, 0x10000076
call qword [rax + 0x10]
test eax, eax
je 0x140071f59
mov rdx, rbx
lea rcx, [rbx + 0x558]
call fcn.1400b9900
test eax, eax
je 0x140071f59
mov rdx, rbx
lea rcx, [rbx + 0x1bc8]
call fcn.1400df520
test eax, eax
je 0x140071f59
mov rcx, qword [rbx + 0x538]
test rcx, rcx
je 0x140071bd6
mov rax, qword [rcx]
call qword [rax + 0xb0]
lea rdx, str.CplExecuted
lea rcx, [rsp + 0xa0]
call fcn.140002000
nop
lea rdx, [0x14019cf88]
lea rcx, [rsp + 0xa8]
call fcn.140002000
nop
movzx eax, word [rbx + 0x44c]
movzx ecx, word [rbx + 0x44e]
movzx r9d, word [rbx + 0x448]
movzx r8d, word [rbx + 0x44a]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.__X_X__X_X
lea rcx, [rsp + 0xa8]
call fcn.140001f50
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
call fcn.14003fed0
xor r9d, r9d
mov r8, qword [rsp + 0xa0]
lea rdx, str.General
lea rcx, [0x14022e890]
call fcn.14014ba50
test eax, eax
jne 0x140071d1e
mov rcx, qword [rbx + 0x538]
test rcx, rcx
je 0x140071c87
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, rbx
lea rcx, [rbx + 0x1bc8]
call fcn.1400df520
test eax, eax
jne 0x140071ce8
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x140071cc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x140071ce1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x140071f59
mov rcx, qword [rbx + 0x538]
test rcx, rcx
je 0x140071cfd
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov r9d, 1
mov r8, qword [rsp + 0xa0]
lea rdx, str.General
lea rcx, [0x14022e890]
call fcn.14014baf0
test byte [rbx + 0x34], 4
je 0x140071d2c
mov rcx, rbx
call fcn.1400724d0
test byte [rbx + 0x37], 1
je 0x140071d3a
mov rcx, rbx
call fcn.140077b00
bt dword [rbx + 0x1bc], 0xc
jae 0x140071d4c
mov rcx, rbx
call fcn.140077cc0
test byte [rbx + 0x34], 0x20
je 0x140071d5a
mov rcx, rbx
call fcn.140072580
bt dword [rbx + 0x5c], 0xc
jae 0x140071d69
mov rcx, rbx
call fcn.140072650
test byte [rbx + 0x34], 0x40
je 0x140071daa
mov rcx, qword [rbx + 0x1d40]
test rcx, rcx
je 0x140071d8c
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x140071d8c
mov qword [rbx + 0x1d40], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140073ed0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x1d40], rax
bt dword [rbx + 0x34], 0x11
jae 0x140071db9
mov rcx, rbx
call fcn.140076d80
mov rdi, qword [rbx + 0x1bd8]
test rdi, rdi
je 0x140071e01
mov rdx, rdi
test rdi, rdi
je 0x140071dfb
mov rdi, qword [rdi]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x140071df4
cmp dword [rdx + 0x168], 0
je 0x140071df4
bt dword [rdx + 0x314], 0x12
jae 0x140071df4
mov rcx, rbx
call fcn.1400771e0
test rdi, rdi
jne 0x140071dc5
jmp 0x140071e01
call fcn.14013d908
int3
mov rdi, qword [rbx + 0x1bd8]
test rdi, rdi
je 0x140071e51
nop
mov rcx, rdi
test rdi, rdi
je 0x140071e4b
mov rdi, qword [rdi]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140071e44
cmp dword [rcx + 0x168], 0
je 0x140071e44
mov eax, dword [rcx + 0x318]
bt eax, 0xc
jb 0x140071e3f
bt eax, 0x1a
jae 0x140071e44
call fcn.140060eb0
test rdi, rdi
jne 0x140071e10
jmp 0x140071e51
call fcn.14013d908
int3
test byte [rbx + 0x34], 0x40
je 0x140071e5d
test byte [rbx + 0x44], 2
jne 0x140071e67
bt dword [rbx + 0x184], 0xa
jae 0x140071e73
lea rcx, [0x14022f830]
call fcn.140071040
mov eax, dword [rbx + 0x11c]
test al, 1
jne 0x140071e81
test al, 2
je 0x140071e89
mov rcx, rbx
call fcn.1400727d0
test byte [rbx + 0x50], 4
je 0x140071e97
mov rcx, rbx
call fcn.140072920
test byte [rbx + 0x50], 0x20
je 0x140071ea5
mov rcx, rbx
call fcn.140072ca0
or edi, 0xffffffff
test byte [rbx + 0x50], 0x40
je 0x140071f00
mov ecx, dword [rbx + 0x56c]
test ecx, ecx
je 0x140071ede
lea rax, [rbx + 0x6b4]
nop
cmp dword [rax - 0x10], 0x1a
jne 0x140071ed1
cmp dword [rax], 0xffffffff
jne 0x140071ed1
cmp dword [rax + 8], 0
je 0x140071ee0
add esi, 1
add rax, 0xac
cmp esi, ecx
jb 0x140071ec0
mov esi, edi
movsxd rax, esi
imul rax, rax, 0xac
test byte [rax + rbx + 0x620], 2
je 0x140071f00
mov ecx, 0x80000041
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140071f24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x140071f46
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
jmp 0x140071f59
xor eax, eax
jmp 0x140071f59
call fcn.14013d908
int3
xor eax, eax
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret