Function at 0x1400bcc50
Capabilities:
Get file version info
Get keyboard layout
Get session user name
Log keystrokes via polling

Disassembly:
mov dword [rsp + 0x20], r9d
mov word [rsp + 0x18], r8w
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x2b8
mov byte [rsp + 0x40], 9
mov eax, dword [rsp + 0x2c8]
sub eax, 0x1ac1ee2e
cmp eax, dword [rsp + 0x2d8]
jle 0x1400bcc92
movzx eax, byte [section..data]
mov byte [rsp + 0x2e0], al
mov eax, dword [rsp + 0x2c0]
mov dword [rsp + 0x44], eax
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0x2e0]
add eax, ecx
mov byte [rsp + 0x40], al
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x90], eax
cmp dword [rsp + 0x90], 0
je 0x1400bcccf
jmp 0x1400bd420
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
nop
mov eax, dword [rsp + 0x44]
sub eax, 0x64f6c39b
cmp eax, dword [rsp + 0x2c0]
ja 0x1400bcd38
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0x2e0]
and eax, ecx
mov byte [rsp + 0x40], al
movzx eax, byte [rsp + 0x2e0]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x4c]
movzx r8d, word [rsp + 0x2d0]
mov edx, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
call fcn.1400bcc50
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x2d8], eax
jmp 0x1400bd367
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x48]
add ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x2c8]
mov edx, dword [rsp + 0x2d8]
sub edx, ecx
mov ecx, edx
cmp eax, ecx
jge 0x1400bcda0
mov byte [rsp + 0x20], 0x76
mov r9b, 0x59
mov r8d, 0xd3
mov dl, 0x86
mov ecx, 0xbd
call fcn.1400bb700
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x160]
lea rdx, [rsp + 0x44]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_GetLayeredWindowAttributes]
mov dword [rsp + 0x98], eax
jmp 0x1400bd309
mov eax, dword [rsp + 0x44]
sub eax, 0xee6e4e5f
cmp eax, dword [rsp + 0x2c0]
jbe 0x1400bd309
movzx eax, word [rsp + 0x2d0]
mov dword [rsp + 0x94], eax
cmp dword [rsp + 0x94], 0
je 0x1400bcdd4
jmp 0x1400bd0f6
mov eax, dword [rsp + 0x2c8]
mov ecx, dword [rsp + 0x54]
and ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x48]
mov edx, dword [rsp + 0x4c]
add edx, ecx
mov ecx, edx
cmp eax, ecx
jl 0x1400bce94
mov eax, dword [rsp + 0x44]
sub eax, 0x179b8663
cmp eax, dword [rsp + 0x2c0]
jbe 0x1400bce54
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
movabs rax, 0xcc4c9028ac17a10e
mov qword [rsp + 0x88], rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x70], rax
movabs rax, 0x9b069b7c0991b07
mov qword [rsp + 0x60], rax
jmp 0x1400bce94
mov byte [rsp + 0x20], 0xdb
xor r9d, r9d
mov r8, qword [rsp + 0x60]
mov dl, 0xc9
mov rcx, qword [rsp + 0x60]
call fcn.1400bb700
mov r9d, 0xe
mov r8d, 0xb
mov edx, 0xd3
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_DefDlgProcA]
mov qword [rsp + 0xe0], rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x58], eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
nop
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x78], al
cmp byte [rsp + 0x78], 0x48
je 0x1400bcf4f
cmp byte [rsp + 0x78], 0x6a
je 0x1400bceca
jmp 0x1400bcf72
movabs rax, 0xfa7e602e0a4b7f9e
cmp qword [rsp + 0x88], rax
jne 0x1400bcf39
movabs rax, 0x7a9902cc69830506
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x20], 0x46
mov r9b, 0xe2
mov r8, qword [rsp + 0x60]
mov dl, 0x8c
mov rcx, qword [rsp + 0x60]
call fcn.1400bb700
mov rax, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x54]
mov eax, dword [rax]
xor eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x2c0]
movzx ecx, al
mov eax, dword [rsp + 0x58]
shr eax, cl
mov dword [rsp + 0x44], eax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x50], al
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMessageWaitingIndicator]
nop
jmp 0x1400bcf72
mov rcx, qword [rsp + 0xe8]
call qword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [rsp + 0xc0], eax
mov rcx, qword [rsp + 0x88]
call fcn.1400bbe90
nop
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0xf0], rax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x9c], eax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
nop
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
je 0x1400bd026
cmp dword [rsp + 0x7c], 0x353bab5f
je 0x1400bcfe4
jmp 0x1400bd0bb
mov eax, dword [rsp + 0x2c8]
movzx ecx, al
mov eax, dword [rsp + 0x48]
shl eax, cl
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
mov eax, dword [rsp + 0x2c0]
mov ecx, dword [rsp + 0x58]
and ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x54]
sub ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
jmp 0x1400bd0bb
movsx eax, byte [rsp + 0x50]
movsx ecx, byte [rsp + 0x2e0]
add eax, ecx
movsx ecx, byte [rsp + 0x40]
movsx edx, byte [section..data]
add ecx, edx
cmp eax, ecx
je 0x1400bd07c
mov eax, dword [rsp + 0x2c0]
mov dword [rsp + 0xc4], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rax, [rsp + 0x88]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x100], rax
mov edx, 0x6d
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_ShowWindowAsync]
mov dword [rsp + 0x98], eax
mov eax, dword [rsp + 0x9c]
mov ecx, dword [rsp + 0x44]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x58], eax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax]
add eax, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x70]
mov dword [rcx], eax
movabs rax, 0x43ec6a8825f1c82e
mov rcx, qword [rsp + 0x60]
or rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
lea rdx, str.aria_Istanbul
mov rcx, qword [rsp + 0x108]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [rsp + 0x80], eax
jmp 0x1400bd216
movsx eax, byte [rsp + 0x2e0]
movsx ecx, byte [rsp + 0x40]
add eax, ecx
movsx ecx, byte [section..data]
cmp eax, ecx
jl 0x1400bd188
mov r9d, 1
mov r8d, 0x67
mov edx, 3
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_SetScrollPos]
mov dword [rsp + 0x54], eax
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0x2e0]
sub eax, ecx
mov byte [rsp + 0x40], al
mov byte [rsp + 0x20], 0x6c
mov r9b, 0x16
mov r8d, pe_nt_image_headers64
mov dl, 0x90
mov ecx, 0x43
call fcn.1400bb700
mov eax, dword [rsp + 0x2c0]
sub eax, 0x735131b1
mov dword [rsp + 0x44], eax
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.USER32.dll_GetDC]
mov qword [rsp + 0x110], rax
mov eax, dword [rsp + 0x2c8]
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x38], 0xf6
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x5f
mov dword [rsp + 0x20], 0x35
lea r9, str.ledge_sexology
mov r8d, 0x14
mov edx, 0x12
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.USER32.dll_TabbedTextOutA]
mov dword [rsp + 0xc8], eax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x2c8]
movzx r8d, word [rsp + 0x2d0]
mov edx, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x44]
call fcn.1400bcc50
mov eax, dword [rsp + 0x2c0]
add eax, 0xfb6fc6e1
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x2c0]
or eax, 0x334c83c5
mov dword [rsp + 0x44], eax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x48]
movzx r8d, word [rsp + 0x2d0]
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x2c0]
call fcn.1400bcc50
nop
mov eax, dword [rsp + 0x4c]
mov ecx, dword [rsp + 0x2d8]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0x2c8]
mov edx, dword [rsp + 0x48]
sar edx, cl
mov ecx, edx
cmp eax, ecx
jle 0x1400bd2c3
mov eax, dword [rsp + 0x2c0]
shl eax, 0x15
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x128]
mov r8d, 0x1e
mov edx, 0x75
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov dword [rsp + 0x80], eax
mov eax, dword [rsp + 0x2c0]
and eax, 0x23fe68f3
mov dword [rsp + 0x44], eax
mov ecx, 0xec
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
mov qword [rsp + 0x130], rax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x2c8]
movzx r8d, word [rsp + 0x2d0]
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
call fcn.1400bcc50
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x2e0], al
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0xa0], al
cmp byte [rsp + 0xa0], 0x40
je 0x1400bd323
jmp 0x1400bd338
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0x2e0]
add eax, ecx
mov byte [rsp + 0x40], al
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.USER32.dll_IsHungAppWindow]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x2c0], eax
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [rsp + 0x68], eax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x2c8]
movzx r8d, word [rsp + 0x2d0]
mov edx, dword [rsp + 0x2c8]
mov ecx, dword [rsp + 0x44]
call fcn.1400bcc50
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x48], eax
movzx eax, byte [rsp + 0x2e0]
mov byte [rsp + 0xa4], al
cmp byte [rsp + 0xa4], 0x54
je 0x1400bd3b7
jmp 0x1400bd409
mov r8d, 0x7b
lea rdx, [rsp + 0x1c0]
mov ecx, 0x8d
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [rsp + 0x4c], eax
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x20], al
mov r9d, dword [rsp + 0x2d8]
movzx r8d, word [rsp + 0x2d0]
mov edx, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x44]
call fcn.1400bcc50
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x2e0], al
jmp 0x1400bd41b
lea rcx, [rsp + 0x4c]
call qword [sym.imp.USER32.dll_GetClipCursor]
mov dword [rsp + 0xcc], eax
jmp 0x1400bd52d
mov edx, 0xf3
mov rcx, qword [rsp + 0x138]
call qword [sym.imp.ADVAPI32.dll_DecryptFileA]
mov dword [rsp + 0x80], eax
movsx eax, byte [section..data]
movsx ecx, byte [rsp + 0x2e0]
or eax, ecx
mov byte [rsp + 0x40], al
movsx eax, byte [rsp + 0x40]
movsx ecx, byte [rsp + 0x2e0]
shl eax, cl
movsx ecx, byte [section..data]
cmp eax, ecx
je 0x1400bd4c9
call qword [sym.imp.USER32.dll_GetClipboardViewer]
mov qword [rsp + 0xd8], rax
mov byte [rsp + 0x20], 4
mov r9b, 0xbb
mov r8d, 0xf3
mov dl, 0x8c
mov ecx, 0x5e
call fcn.1400bb700
movzx eax, byte [rsp + 0x40]
mov byte [rsp + 0x2e0], al
mov byte [rsp + 0x20], 0x1b
mov r9b, 0x58
mov r8d, 0xb5
mov dl, 0x72
mov ecx, 0xeb
call fcn.1400bb700
mov rcx, qword [rsp + 0x140]
call qword [sym.imp.USER32.dll_PaintDesktop]
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x2c0]
shr eax, 3
mov dword [rsp + 0x44], eax
mov byte [rsp + 0x20], 0xe0
mov r9b, 0x1c
mov r8d, 0xec
mov dl, 0x65
mov ecx, 0x9e
call fcn.1400bb700
mov eax, dword [rsp + 0x2d8]
mov dword [rsp + 0x2c8], eax
mov dword [rsp + 0x20], 0xba
mov r9d, 0x35
mov r8d, 0x5f
lea rdx, [rsp + 0x160]
mov rcx, qword [rsp + 0xb0]
call qword [sym.imp.USER32.dll_DlgDirListComboBoxA]
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov r8d, 0x15
mov edx, 0xfe
mov rcx, qword [rsp + 0x148]
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [rsp + 0xa8], eax
mov byte [rsp + 0x20], 0x8c
mov r9b, 0x1b
mov r8d, 0x5e
mov dl, 0x58
mov ecx, 0x59
call fcn.1400bb700
mov eax, dword [rsp + 0x2c0]
and eax, 0x5ef8149f
mov dword [rsp + 0x44], eax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [rsp + 0x68], eax
mov eax, 0xe8
mov word [rsp + 0x2d0], ax
mov eax, dword [rsp + 0x2c0]
xor eax, 0xc547d44a
mov dword [rsp + 0x44], eax
movsx eax, byte [section..data]
add rsp, 0x2b8
ret