Function at 0x14009d500
Capabilities:
Check mutex on windows
Log keystrokes via application hook

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x188]
sub rsp, 0x260
mov qword [rbp + 0xe8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rsi, r9
mov r12, rdx
mov rdi, rcx
call fcn.140004e20
mov rcx, rax
xor r13d, r13d
mov r8d, r13d
test rax, rax
setne r8b
test r8d, r8d
jne 0x14009d55f
mov ecx, 0x80004005
call fcn.140007d40
int3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
or r14, 0xffffffffffffffff
test rsi, rsi
je 0x14009d5b2
test rsi, 0xffffffffffff0000
jne 0x14009d5a3
movzx ebx, si
xor edx, edx
mov ecx, ebx
call fcn.140007c90
test rax, rax
je 0x14009d5c6
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140008550
jmp 0x14009d5c6
mov rax, r14
inc rax
cmp word [rsi + rax*2], 0
jne 0x14009d5a6
jmp 0x14009d5b5
mov eax, r13d
mov r8d, eax
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140008830
nop
lea rcx, [rsp + 0x68]
call fcn.1400a6b30
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.140007d60
add rax, 0x18
mov qword [rbp - 0x80], rax
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14009d5fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea r8, [0x1401654cc]
lea rdx, [0x140161ef0]
lea rcx, [rbp - 0x80]
call fcn.1400a7490
mov rbx, qword [rbp - 0x80]
cmp dword [rbx - 0x10], 0
jl 0x14009d6d2
lea rdx, str._USERSETTINGS
mov rcx, rbx
call fcn.14010e42c
test rax, rax
je 0x14009d6d2
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x14009d6d2
xor edx, edx
lea rcx, [rbp + 0xf8]
call fcn.1400ec950
nop
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPInstall
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xf8]
call fcn.1400ecac0
mov esi, 1
test eax, eax
je 0x14009d6c6
mov dword [rsp + 0x78], r13d
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
lea rdx, str.UnInstallRemoveUserSettings
lea rcx, [rbp + 0x100]
call fcn.1401069b0
cmp dword [rsp + 0x70], 0
je 0x14009d6c6
mov edx, esi
mov rcx, rdi
call fcn.1400a18b0
call fcn.1400fbeb0
nop
lea rcx, [rbp + 0xf8]
jmp 0x14009db81
mov rcx, rdi
call fcn.1400a23f0
xor edx, edx
lea rcx, [rbp + 0x128]
call fcn.1400ec950
nop
mov qword [rdi + 0xc70], r12
lea rax, [rbp - 0x78]
mov qword [rbp + 0xe0], rax
lea rax, [rbp + 8]
mov qword [rbp + 0xf0], rax
lea rax, [rbp - 0x38]
mov qword [rbp + 0xd8], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0xd0], rax
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r13
mov word [rbp - 0x78], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rbp - 0x78]
call fcn.140009080
nop
mov qword [rbp + 0x20], 7
mov qword [rbp + 0x18], r13
mov word [rbp + 8], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rbp + 8]
call fcn.140009080
nop
mov qword [rbp - 0x20], 7
mov qword [rbp - 0x28], r13
mov word [rbp - 0x38], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rbp - 0x38]
call fcn.140009080
nop
mov qword [rbp - 0x40], 7
mov qword [rbp - 0x48], r13
mov word [rbp - 0x58], r13w
xor r8d, r8d
lea rdx, [0x140150af4]
lea rcx, [rbp - 0x58]
call fcn.140009080
nop
mov qword [rbp + 0x98], 7
mov qword [rbp + 0x90], r13
mov word [rbp + 0x80], r13w
mov r8d, 0x15
lea rdx, str.SynTPEnhInstanceMutex
lea rcx, [rbp + 0x80]
call fcn.140009080
nop
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
lea rdx, [rbp + 0x80]
lea rcx, [rbp - 0x18]
call fcn.140102e00
cmp qword [rax + 0x18], 8
jb 0x14009d818
mov rax, qword [rax]
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov r15, rax
cmp qword [rbp], 8
jb 0x14009d838
mov rcx, qword [rbp - 0x18]
call fcn.14010a7dc
mov qword [rbp], 7
mov qword [rbp - 8], r13
mov word [rbp - 0x18], r13w
test r15, r15
jne 0x14009d856
mov esi, r13d
jmp 0x14009db7a
mov edx, 0x2710
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x14009db65
cmp eax, 0xffffffff
je 0x14009db65
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x60], r13d
xor edx, edx
lea rcx, str.SynTPEnhWndClass
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14009d8e5
lea r9, [rsp + 0x60]
mov r8, rsi
mov rdx, rax
mov rcx, rdi
call fcn.14009c490
lea rdx, [0x1401654e0]
mov rcx, rsi
call fcn.14010e42c
test rax, rax
jne 0x14009db65
xor r8d, r8d
mov edx, 0x1c1a
mov rcx, rdi
call fcn.14009d210
jmp 0x14009db65
mov edx, 0x67
mov rcx, qword [rdi + 0xc70]
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rdi + 0x1728], rax
mov dword [rbp + 0x30], r13d
lea rcx, [0x140097180]
mov qword [rbp + 0x38], rcx
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], r13
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x60], xmm0
lea rax, str.ScrollerooWindowClass
mov qword [rbp + 0x70], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x14009db65
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 0xfffffe70
mov dword [rsp + 0x20], 0xfffffe70
mov r9d, 0x80000000
lea r8, str.Touchpad_driver_backward_compatibility_window
lea rdx, str.ScrollerooWindowClass
mov ecx, 0x80
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
je 0x14009db65
lea rax, str.SynTPEnhWndClass
mov qword [rbp + 0x70], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x14009db65
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r13d
mov dword [rsp + 0x28], 0xfffffe70
mov dword [rsp + 0x20], 0xfffffe70
mov r9d, 0x80000000
lea r8, str.Touchpad_driver_helper_window
lea rdx, str.SynTPEnhWndClass
mov ecx, 0x80
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rdi + 0xa28], rax
test rax, rax
je 0x14009db65
lea r9, [rsp + 0x60]
mov r8, rsi
mov rdx, rax
mov rcx, rdi
call fcn.14009c490
test eax, eax
je 0x14009db65
cmp dword [rsp + 0x60], 0
jne 0x14009db65
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, str.SoftwareSynapticsSynTPEnh
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0x128]
call fcn.1400ecac0
test eax, eax
je 0x14009da87
lea r8, [rdi + 0x804]
mov qword [rsp + 0x20], r13
mov r9, r8
lea rdx, str.AddAppProfileByHotKey
lea rcx, [rbp + 0x130]
call fcn.1401069b0
cmp dword [rdi + 0x804], 0
je 0x14009daab
xor r9d, r9d
mov r8, qword [rdi + 0xc70]
lea rdx, [0x1400a2580]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x47f
mov rcx, qword [rdi + 0xa28]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14009db5d
nop
mov rcx, qword [rdi + 0xa50]
test rcx, rcx
je 0x14009db2a
lea rdx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x14009db2a
mov rcx, qword [rdi + 0xa58]
test rcx, rcx
je 0x14009db2a
lea rdx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x14009db44
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xa0]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14009daf0
mov esi, dword [rbp + 0xb0]
jmp 0x14009db7a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, r14d
lea rcx, [rbp + 0x128]
call fcn.1400eca60
nop
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14009db9c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret