Function at 0x140038320
Capabilities:
Log keystrokes via application hook
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.d:log
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.d:log
lea rcx, [0x1400e8ea0]
call fcn.140011dc0
mov rcx, rbx
call fcn.14003bd30
mov rdi, qword [0x1400e8e90]
cmp dword [rdi - 0x10], 0
je 0x1400383f1
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x14003839a
cmp rax, qword [rdi - 0x18]
jne 0x14003839a
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x1400383d7
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x1400383b6
call fcn.140015850
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
add rdx, rdx
mov r8, rdi
lea rcx, [rbx + 0x18]
mov r9, rdx
call fcn.14007f440
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.1400150a0
xor eax, eax
jmp 0x140038d88
cmp qword [rbx + 0xb68], 0
jle 0x140038407
lea rcx, [rbx + 0xb50]
call fcn.1400538b4
cmp dword [0x1400e8e24], 0
je 0x14003843a
lea rcx, [rbx + 0x7f8]
xor edi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
call fcn.14002f200
mov rcx, rbx
call fcn.140049920
xor eax, eax
jmp 0x140038d88
mov rcx, rbx
call fcn.14003be30
mov edx, dword [rbx + 0xa28]
shr edx, 9
and edx, 1
mov dword [rbx + 0xe98], edx
cmp dword [0x1400e8e18], 0
je 0x140038496
mov rcx, rbx
call fcn.140049670
cmp dword [0x1400e8df8], 0
jne 0x140038487
cmp dword [0x1400e8e0c], 0
jne 0x140038487
lea rcx, [0x1400e8c60]
call fcn.140036f60
test eax, eax
je 0x14003848f
mov rcx, rbx
call fcn.14003b670
xor eax, eax
jmp 0x140038d88
cmp dword [0x1400e8dc8], 0
jne 0x140038d7e
cmp dword [0x1400e8e30], 0
jne 0x140038d7e
cmp dword [0x1400e8dd0], 0
jne 0x140038d7e
cmp dword [0x1400e8dd8], 0
jne 0x140038d7e
cmp dword [0x1400e8ddc], 0
jne 0x140038d7e
cmp dword [0x1400e8de4], 0
jne 0x140038d7e
cmp dword [0x1400e8dec], 0
jne 0x140038d7e
cmp dword [0x1400e8df4], 0
jne 0x140038d7e
cmp dword [0x1400e8e00], 0
jne 0x140038d7e
cmp dword [0x1400e8dbc], 0
jne 0x140038d7e
cmp dword [0x1400e8df8], 0
jne 0x140038d7e
cmp dword [0x1400e8e0c], 0
jne 0x140038d7e
cmp dword [0x1400e8e14], 0
je 0x140038560
lea rcx, [rbx + 0x8f8]
lea rdx, [rsp + 0x50]
call fcn.14004f680
mov edx, 1
mov rcx, rax
call fcn.1400285f0
xor eax, eax
jmp 0x140038d88
mov dword [rbx + 0x600], 0x67
mov dword [rbx + 0x604], 0x66
cmp dword [0x1400e8e54], 0
je 0x140038609
lea rsi, [rbx + 0x7f8]
test rsi, rsi
je 0x140038602
call fcn.14004e660
lea rcx, [rsi + 0xb8]
call fcn.14002ef30
mov ebp, dword [rsi + 0x60]
xor edi, edi
test ebp, ebp
je 0x1400385f1
cmp edi, dword [rsi + 0x60]
jae 0x1400385e2
mov edx, edi
lea rcx, [rsi + 0x48]
call fcn.140053bc0
test rax, rax
je 0x1400385eb
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x1400385e2
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140004900
mov rcx, rax
call fcn.14004e0e0
mov rcx, rbx
call fcn.14004dc70
add edi, 1
cmp edi, ebp
jae 0x1400385f1
jmp 0x1400385a7
call fcn.140053538
int3
mov rax, qword [rsi + 0xb8]
lea rcx, [rsi + 0xb8]
call qword [rax + 0x28]
xor eax, eax
jmp 0x140038d88
cmp dword [0x1400e8e78], 0
je 0x14003861f
call fcn.140016240
test eax, eax
je 0x140038d88
cmp dword [0x1400e8e88], 0
je 0x14003863e
cmp dword [0x1400e7ad4], 0
je 0x14003863e
call fcn.140016240
test eax, eax
je 0x140038d88
mov esi, 1
cmp dword [0x1400e8da8], 0
je 0x14003867a
lea rdi, str.h0_v_
lea ebp, [rsi + 0x25]
mov rdx, qword [rdi]
test rdx, rdx
je 0x14003866a
lea rcx, [rbx + 0xb50]
call fcn.140053ae0
add rdi, 8
sub rbp, 1
jne 0x140038656
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8da4], 0
je 0x14003868b
mov rcx, rbx
call fcn.140040d90
cmp dword [0x1400e8e3c], 0
je 0x1400386bf
mov rcx, rbx
call fcn.140040e30
bt dword [rbx + 0x9ac], 0x1d
jae 0x1400386ae
mov rcx, rbx
call fcn.140041220
test byte [rbx + 0xa14], 0x80
je 0x1400386bf
mov rcx, rbx
call fcn.140046c00
cmp dword [0x1400e8e40], 0
je 0x1400386ce
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8dac], 0
je 0x1400386e9
xor edx, edx
mov rcx, rbx
call fcn.1400412b0
mov rcx, rbx
call fcn.140044130
cmp dword [0x1400e8db0], 0
je 0x140038704
mov edx, esi
mov rcx, rbx
call fcn.1400412b0
mov rcx, rbx
call fcn.1400441e0
cmp dword [0x1400e8db4], 0
je 0x14003871f
xor edx, edx
mov rcx, rbx
call fcn.1400412b0
mov rcx, rbx
call fcn.1400440a0
lea rcx, [0x1400e8c60]
call fcn.140036f00
test eax, eax
jne 0x14003873f
cmp dword [0x1400e8dc0], eax
jne 0x14003873f
cmp dword [0x1400e8e8c], eax
je 0x140038747
mov rcx, rbx
call fcn.14003b850
cmp dword [0x1400e8db8], 0
je 0x1400387b4
mov dword [rbx + 0xb48], esi
lea rdi, [0x1400e05f0]
mov ebp, SafeArrayGetDim
mov rdx, qword [rdi]
test rdx, rdx
je 0x140038776
lea rcx, [rbx + 0xb50]
call fcn.140053ae0
add rdi, 8
sub rbp, 1
jne 0x140038762
mov dword [rbx + 0xe64], esi
lea rcx, [rbx + 0x8f8]
lea rdx, [rsp + 0x60]
call fcn.14004f680
mov rdx, rax
lea rcx, [rbx + 0xba8]
call fcn.1400207c0
mov dword [rbx + 0xc90], esi
mov rcx, rbx
call fcn.140046240
cmp dword [0x1400e8e34], 0
je 0x1400387f6
lea rcx, [rbx + 0xd70]
call fcn.14004bc10
mov rax, qword [rbx + 0xda0]
test rax, rax
je 0x1400387e4
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x1400473e0]
call rax
mov rcx, rbx
call fcn.140047400
xor edx, edx
mov rcx, rbx
call fcn.140046030
xor edi, edi
cmp dword [0x1400e8e38], edi
je 0x140038a32
mov edx, esi
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
movzx r11d, word [rbx + 0x8fa]
cmp r11d, 0x1025
je 0x140038845
cmp r11d, 0x17aa
jne 0x14003884b
mov dword [0x1400e8a10], 0xff
mov dword [0x1400e8a14], 0x71
mov dword [rbx + 0xe40], esi
jmp 0x14003884b
mov dword [rbx + 0xe44], esi
cmp dword [rbx + 0xad8], edi
jne 0x14003898c
cmp dword [rbx + 0xadc], edi
jne 0x14003898c
cmp dword [rbx + 0xae0], edi
jne 0x14003898c
cmp dword [rbx + 0xae4], edi
jne 0x14003898c
mov ecx, dword [rbx + 0xaa0]
test ecx, ecx
je 0x1400388a8
movzx eax, byte [rbx + 0xaa1]
mov dword [0x1400e8a10], eax
movzx eax, cl
mov dword [0x1400e8a14], eax
mov rcx, rbx
call fcn.140046810
jmp 0x140038a0b
bt dword [rbx + 0xa24], 0xc
jae 0x1400388cb
mov dword [0x1400e8a10], 0xff
mov dword [0x1400e8a14], 2
jmp 0x140038a0b
movzx eax, word [rbx + 0x8f8]
shl r11d, 0x10
or eax, r11d
sub eax, 0x17aa215e
je 0x140038950
sub eax, 0x5a
je 0x140038920
sub eax, 0x17bd
jne 0x140038a0b
movzx eax, word [rbx + 0x8fc]
cmp ax, 0x4010
je 0x140038907
cmp ax, 0x4012
jne 0x140038a0b
mov dword [0x1400e8a10], 0xff
mov dword [0x1400e8a14], 0x71
jmp 0x140038a0b
movzx eax, word [rbx + 0x8fc]
cmp ax, 0x21bd
je 0x140038937
cmp ax, 0x21bf
jne 0x140038a0b
mov dword [0x1400e8a10], 0xff
mov dword [0x1400e8a14], 0x71
jmp 0x140038a0b
movzx eax, word [rbx + 0x8fc]
cmp ax, 0x21a3
je 0x140038973
cmp ax, 0x21a5
je 0x140038973
cmp ax, 0x21ba
je 0x140038973
cmp ax, 0x21bc
jne 0x140038a0b
mov dword [0x1400e8a10], 0xff
mov dword [0x1400e8a14], 0x71
jmp 0x140038a0b
mov dword [0x1400e8a38], edi
movzx eax, byte [rbx + 0xad9]
mov dword [0x1400e8a18], eax
movzx eax, byte [rbx + 0xad8]
mov dword [0x1400e8a28], eax
movzx eax, byte [rbx + 0xadd]
mov dword [0x1400e8a1c], eax
movzx eax, byte [rbx + 0xadc]
mov dword [0x1400e8a2c], eax
movzx ecx, byte [rbx + 0xae1]
mov dword [0x1400e8a20], ecx
movzx eax, byte [rbx + 0xae0]
mov dword [0x1400e8a30], eax
movzx edx, byte [rbx + 0xae5]
mov dword [0x1400e8a24], edx
movzx eax, byte [rbx + 0xae4]
mov dword [0x1400e8a34], eax
test ecx, ecx
jne 0x140038a0b
mov eax, edi
test edx, edx
cmovne eax, esi
mov dword [0x1400e8a38], eax
cmp qword [0x1400e7ad8], rdi
jne 0x140038a32
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140046340]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400e7ad8], rax
bt dword [rbx + 0x9ac], 0xf
jae 0x140038b25
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekHDAudio
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140038b0b
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0xa8], 2
jne 0x140038b0b
mov edx, esi
mov rcx, rbx
call fcn.140046e30
mov dword [rsp + 0xb8], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov rcx, qword [rbx + 0x40]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
nop
test rdi, rdi
je 0x140038b25
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.14003f350
cmp dword [0x1400e8da8], 0
je 0x140038b3e
mov rcx, rbx
call fcn.14003b0b0
lea rcx, [0x1400e8c60]
call fcn.140036f00
test eax, eax
jne 0x140038b56
cmp dword [0x1400e8dc0], eax
je 0x140038b5e
mov rcx, rbx
call fcn.14003b5b0
cmp dword [0x1400e8e48], 0
je 0x140038b75
mov dword [rbx + 0xe64], esi
mov rcx, rbx
call fcn.140047520
cmp dword [0x1400e8e4c], 0
jne 0x140038b90
cmp dword [0x1400e8e50], 0
jne 0x140038b90
cmp dword [0x1400e8e28], 0
je 0x140038b96
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8e7c], 0
je 0x140038bb9
mov qword [rbx + 0xb98], rbx
lea rdx, [rbx + 0xb90]
lea rcx, [rbx + 0x7f8]
call fcn.14002f440
cmp dword [0x1400e8e58], 0
je 0x140038be7
lea rcx, [rbx + 0xb50]
lea rdx, [0x1400b3428]
call fcn.140053ae0
mov dword [rbx + 0xe64], esi
lea rcx, [rbx + 0x7f8]
call fcn.14004c2d0
mov rcx, rbx
call fcn.14003ac60
cmp dword [0x1400e8e6c], 0
je 0x140038c04
lea rcx, [rbx + 0x7f8]
call fcn.1400201b0
cmp dword [rbx + 0xcb8], 0
je 0x140038c15
mov rcx, rbx
call fcn.14003a770
cmp dword [0x1400e8e60], 0
je 0x140038c62
mov rcx, rbx
call fcn.14003a9f0
lea rdi, [rbx + 0xea0]
cmp qword [rdi], 0
jne 0x140038c62
mov qword [rsp + 0x20], rdi
lea r9, [0x1400ba670]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1400ba690]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140038c62
mov edx, dword [rbx + 0x40]
call fcn.1400370c0
cmp dword [0x1400e8e80], 0
je 0x140038cc4
lea rcx, [rbx + 0x7f8]
call fcn.140030650
test rax, rax
je 0x140038c87
mov rdx, rax
mov rcx, rbx
call fcn.140047ff0
mov dword [rbx + 0xb48], esi
lea rdi, [0x1400e0680]
mov ebp, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
nop
nop
mov rdx, qword [rdi]
test rdx, rdx
je 0x140038cb4
lea rcx, [rbx + 0xb50]
call fcn.140053ae0
add rdi, 8
sub rbp, 1
jne 0x140038ca0
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8e08], 0
je 0x140038cff
lea rcx, [rbx + 0xb50]
lea rdx, [0x1400b3038]
call fcn.140053ae0
mov dword [rbx + 0xe64], esi
lea rcx, [rbx + 0x7f8]
call fcn.140030290
test rax, rax
je 0x140038cff
mov rcx, rax
call fcn.14004c080
cmp dword [0x1400e8e70], 0
je 0x140038d21
lea rcx, [rbx + 0xb50]
lea rdx, [0x1400b3038]
call fcn.140053ae0
mov dword [rbx + 0xe64], esi
cmp dword [rbx + 0xe64], 0
je 0x140038d44
mov qword [rbx + 0xb88], rbx
lea rcx, [rbx + 0x7f8]
lea rdx, [rbx + 0xb40]
call fcn.14002f440
mov rcx, rbx
call fcn.14003a560
cmp dword [0x1400e8e20], 0
je 0x140038d7a
cmp qword [0x1400e7bf8], 0
jne 0x140038d7a
xor r8d, r8d
lea rdx, [0x1400b21d8]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_RegisterPowerSettingNotification]
mov qword [0x1400e7bf8], rax
mov eax, esi
jmp 0x140038d88
mov rcx, rbx
call fcn.14003b670
xor eax, eax
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret