Function at 0x1400308a0
Capabilities:
Log keystrokes via application hook
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.d:log
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.d:log
lea rcx, [0x1400d4b40]
call fcn.1400109b0
xor esi, esi
cmp dword [0x1400d4ae4], esi
je 0x140030961
lea rcx, str._CVolCustom::Uninit_n
call fcn.140001030
cmp dword [0x1400d4ae4], esi
je 0x140030961
lea rcx, str.CVolCustom::S3HpProtect_Uninit_n
call fcn.140001030
cmp dword [rbx + 0x470], esi
je 0x140030961
mov rcx, qword [rbx + 0xe0]
test rcx, rcx
je 0x14003093f
mov rcx, qword [rcx + 0xd0]
test rcx, rcx
je 0x140030938
mov rax, qword [rcx]
lea rdx, [rbx + 0xc8]
call qword [rax + 0x20]
mov qword [rbx + 0xe0], rsi
mov qword [rbx + 0xe8], rsi
cmp dword [0x1400d48c0], esi
je 0x140030961
mov dword [0x1400d48c0], esi
lea rcx, [0x1400d3838]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
test byte [rbx + 0x9d4], 4
je 0x140030979
mov edx, 0x3ed
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_KillTimer]
cmp dword [0x1400d4ab4], esi
jne 0x1400309b9
cmp dword [0x1400d4aec], esi
jne 0x1400309b9
cmp dword [0x1400d4abc], esi
jne 0x1400309b9
cmp dword [0x1400d4ac4], esi
jne 0x1400309b9
cmp dword [0x1400d4ac8], esi
jne 0x1400309b9
cmp dword [0x1400d4ad0], esi
jne 0x1400309b9
cmp dword [0x1400d4ad8], esi
jne 0x1400309b9
cmp dword [0x1400d4ae0], esi
je 0x1400309c1
mov rcx, rbx
call fcn.140032810
mov rcx, rbx
call fcn.140034500
mov edx, dword [rbx + 0x9d0]
shr edx, 9
and edx, 1
mov dword [rbx + 0xe28], edx
mov edx, dword [rbx + 0x99c]
and edx, 1
cmp dword [0x1400d4aa8], esi
je 0x1400309f8
lea rcx, [rbx + 0xc18]
call fcn.140024d60
mov dword [rbx + 0x5f0], 0x67
mov dword [rbx + 0x5f4], 0x66
cmp dword [0x1400d4b10], esi
je 0x140030aa2
add rbx, 0x7e8
je 0x140030a9b
call fcn.1400424f0
lea rcx, [rbx + 0x80]
call fcn.140027410
mov ebp, dword [rbx + 0x60]
test ebp, ebp
je 0x140030a8a
nop
nop
cmp esi, dword [rbx + 0x60]
jae 0x140030a7b
mov edx, esi
lea rcx, [rbx + 0x48]
call fcn.1400463b0
test rax, rax
je 0x140030a84
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x140030a7b
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1400043c0
mov rcx, rax
call fcn.140041f70
mov rcx, rdi
call fcn.140041b20
add esi, 1
cmp esi, ebp
jae 0x140030a8a
jmp 0x140030a40
call fcn.140046214
int3
mov rax, qword [rbx + 0x80]
lea rcx, [rbx + 0x80]
call qword [rax + 0x28]
xor eax, eax
jmp 0x140031320
cmp dword [0x1400d4b34], esi
je 0x140030ab7
call fcn.140014a00
test eax, eax
je 0x140031320
mov rcx, rbx
call fcn.140034370
cmp dword [0x1400d4a90], esi
je 0x140030b3d
lea rcx, [rbx + 0x868]
call fcn.140027410
mov rbp, qword [rbx + 0x848]
mov edi, esi
test ebp, ebp
je 0x140030b30
cmp edi, dword [rbx + 0x848]
jae 0x140030b21
mov edx, edi
lea rcx, [rbx + 0x830]
call fcn.1400463b0
test rax, rax
je 0x140030b2a
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140030b21
mov eax, dword [rcx + 0xf4]
bt eax, 0x15
jb 0x140030b1c
bt eax, 0x16
jb 0x140030b1c
bt eax, 0x17
jae 0x140030b21
call fcn.1400049e0
add edi, 1
cmp edi, ebp
jae 0x140030b30
jmp 0x140030ae0
call fcn.140046214
int3
lea rcx, [rbx + 0x868]
mov rax, qword [rcx]
call qword [rax + 0x28]
cmp dword [0x1400d4af8], esi
je 0x140030b70
mov rcx, rbx
call fcn.140038650
bt dword [rbx + 0x954], 0x1d
jae 0x140030b5f
mov rcx, rbx
call fcn.140038900
test byte [rbx + 0x9bc], 0x80
je 0x140030b70
mov rcx, rbx
call fcn.14003df30
cmp dword [0x1400d4afc], esi
je 0x140030bc4
cmp qword [rbx + 0xaf8], rsi
jle 0x140030b8d
lea rcx, [rbx + 0xae0]
call fcn.140046d20
mov qword [rbx + 0xb18], rbx
mov rcx, qword [rbx + 0x7f0]
test rcx, rcx
je 0x140030bc4
mov rax, qword [rcx]
lea rdx, [rbx + 0xad0]
call qword [rax + 0x30]
test eax, eax
js 0x140030bc4
lea rcx, [rbx + 0x7f8]
lea rdx, [rbx + 0xad0]
call fcn.140046f44
cmp dword [0x1400d4a98], esi
je 0x140030bde
xor edx, edx
mov rcx, rbx
call fcn.140038990
mov rcx, rbx
call fcn.14003b780
cmp dword [0x1400d4a9c], esi
je 0x140030bfb
mov edx, 1
mov rcx, rbx
call fcn.140038990
mov rcx, rbx
call fcn.14003b830
cmp dword [0x1400d4aa0], esi
je 0x140030c74
xor edx, edx
mov rcx, rbx
call fcn.140038990
lea rcx, [rbx + 0x868]
call fcn.140027410
mov rbp, qword [rbx + 0x848]
mov edi, esi
test ebp, ebp
je 0x140030c67
cmp edi, dword [rbx + 0x848]
jae 0x140030c58
mov edx, edi
lea rcx, [rbx + 0x830]
call fcn.1400463b0
test rax, rax
je 0x140030c61
mov rcx, qword [rax + 0x10]
test rcx, rcx
je 0x140030c58
test byte [rcx + 0xf4], 0x40
je 0x140030c58
call fcn.14000ad10
add edi, 1
cmp edi, ebp
jae 0x140030c67
jmp 0x140030c26
call fcn.140046214
int3
lea rcx, [rbx + 0x868]
mov rax, qword [rcx]
call qword [rax + 0x28]
cmp dword [0x1400d4ab0], esi
jne 0x140030cac
cmp dword [0x1400d4ae8], esi
jne 0x140030cac
cmp dword [0x1400d4ac0], esi
jne 0x140030cac
cmp dword [0x1400d4ab8], esi
jne 0x140030cac
cmp dword [0x1400d4acc], esi
jne 0x140030cac
cmp dword [0x1400d4ad4], esi
jne 0x140030cac
cmp dword [0x1400d4adc], esi
je 0x140030cb4
mov rcx, rbx
call fcn.140033710
cmp dword [0x1400d4aac], esi
je 0x140030cc4
mov rcx, rbx
call fcn.14003eed0
cmp dword [0x1400d4aa4], esi
je 0x140030d9b
cmp qword [rbx + 0xaf8], rsi
jle 0x140030ce5
lea rcx, [rbx + 0xae0]
call fcn.140046d20
mov qword [rbx + 0xb18], rbx
mov dword [rbx + 0xad8], 1
lea rdi, [0x1400cc5f0]
mov ebp, SafeArrayGetDim
mov rdx, qword [rdi]
test rdx, rdx
je 0x140030d16
lea rcx, [rbx + 0xae0]
call fcn.140046f44
add rdi, 8
sub rbp, 1
jne 0x140030d02
mov rcx, qword [rbx + 0x7f0]
test rcx, rcx
je 0x140030d50
mov rax, qword [rcx]
lea rdx, [rbx + 0xad0]
call qword [rax + 0x30]
test eax, eax
js 0x140030d50
lea rcx, [rbx + 0x7f8]
lea rdx, [rbx + 0xad0]
call fcn.140046f44
lea rcx, [rbx + 0x8a0]
lea rdx, [rsp + 0x70]
call fcn.140043390
mov rdx, rax
lea rcx, [rbx + 0xb20]
call fcn.14001eb10
mov dword [rbx + 0xc08], 1
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rbx + 0x7e8]
call fcn.1400281b0
mov rdx, rax
lea rcx, [rbx + 0xb20]
call fcn.14001ec60
cmp dword [0x1400d4af0], esi
je 0x140030ddc
lea rcx, [rbx + 0xd00]
call fcn.140041150
mov rax, qword [rbx + 0xd30]
test rax, rax
je 0x140030dca
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x14003e670]
call rax
mov rcx, rbx
call fcn.14003e690
xor edx, edx
mov rcx, rbx
call fcn.14003d660
cmp dword [0x1400d4af4], esi
je 0x140030f56
mov edx, 1
lea ecx, [rdx + 0xf]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
movzx edx, word [rbx + 0x8a2]
cmp edx, 0x1025
je 0x140030e2d
cmp edx, 0x17aa
jne 0x140030e37
mov dword [0x1400d3a24], 0xff
mov dword [0x1400d3f78], 0x71
mov dword [rbx + 0xdd0], 1
jmp 0x140030e37
mov dword [rbx + 0xdd4], 1
mov ecx, dword [rbx + 0xa48]
test ecx, ecx
je 0x140030e64
movzx eax, byte [rbx + 0xa49]
mov dword [0x1400d3a24], eax
movzx eax, cl
mov dword [0x1400d3f78], eax
mov rcx, rbx
call fcn.14003db40
jmp 0x140030f2f
bt dword [rbx + 0x9cc], 0xc
jae 0x140030e87
mov dword [0x1400d3a24], 0xff
mov dword [0x1400d3f78], 2
jmp 0x140030f2f
movzx eax, word [rbx + 0x8a0]
shl edx, 0x10
or eax, edx
sub eax, 0x17aa215e
je 0x140030efc
sub eax, 0x5a
je 0x140030ed3
sub eax, 0x17bd
jne 0x140030f2f
movzx eax, word [rbx + 0x8a4]
cmp ax, 0x4010
je 0x140030ebd
cmp ax, 0x4012
jne 0x140030f2f
mov dword [0x1400d3a24], 0xff
mov dword [0x1400d3f78], 0x71
jmp 0x140030f2f
movzx eax, word [rbx + 0x8a4]
cmp ax, 0x21bd
je 0x140030ee6
cmp ax, 0x21bf
jne 0x140030f2f
mov dword [0x1400d3a24], 0xff
mov dword [0x1400d3f78], 0x71
jmp 0x140030f2f
movzx eax, word [rbx + 0x8a4]
cmp ax, 0x21a3
je 0x140030f1b
cmp ax, 0x21a5
je 0x140030f1b
cmp ax, 0x21ba
je 0x140030f1b
cmp ax, 0x21bc
jne 0x140030f2f
mov dword [0x1400d3a24], 0xff
mov dword [0x1400d3f78], 0x71
cmp qword [0x1400d3908], rsi
jne 0x140030f56
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14003d870]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400d3908], rax
bt dword [rbx + 0x954], 0xf
jae 0x140031044
mov rdi, rsi
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rsi
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekHDAudio
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003102a
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x88], rdi
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x70], 2
jne 0x14003102a
mov edx, 1
mov rcx, rbx
call fcn.14003e160
mov dword [rsp + 0x78], 1
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov rcx, qword [rbx + 0x40]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
nop
test rdi, rdi
je 0x140031044
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.140036f50
cmp dword [0x1400d4a94], 0
je 0x14003105d
mov rcx, rbx
call fcn.140032250
cmp dword [0x1400d4ab0], 0
jne 0x1400310a9
cmp dword [0x1400d4ae8], 0
jne 0x1400310a9
cmp dword [0x1400d4ac0], 0
jne 0x1400310a9
cmp dword [0x1400d4ab8], 0
jne 0x1400310a9
cmp dword [0x1400d4acc], 0
jne 0x1400310a9
cmp dword [0x1400d4ad4], 0
jne 0x1400310a9
cmp dword [0x1400d4adc], 0
jne 0x1400310a9
cmp dword [0x1400d4aac], 0
je 0x14003112a
mov rdi, rsi
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareRealtekSBCoexist
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, eax
test eax, eax
jne 0x1400310f6
mov ebp, esi
mov rdi, qword [rsp + 0x70]
test rdi, rdi
je 0x1400310f6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, rsi
test ebp, ebp
sete sil
test rdi, rdi
je 0x14003110a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x14003112a
lea rcx, [rbx + 0xc18]
call fcn.140022ef0
test eax, eax
je 0x14003112a
lea rcx, [rbx + 0xc18]
call fcn.1400245a0
cmp dword [0x1400d4b04], 0
je 0x140031188
cmp qword [rbx + 0xaf8], 0
jle 0x140031149
lea rcx, [rbx + 0xae0]
call fcn.140046d20
mov qword [rbx + 0xb18], rbx
mov rcx, qword [rbx + 0x7f0]
test rcx, rcx
je 0x140031180
mov rax, qword [rcx]
lea rdx, [rbx + 0xad0]
call qword [rax + 0x30]
test eax, eax
js 0x140031180
lea rcx, [rbx + 0x7f8]
lea rdx, [rbx + 0xad0]
call fcn.140046f44
mov rcx, rbx
call fcn.14003e7b0
cmp dword [0x1400d4b08], 0
jne 0x1400311a3
cmp dword [0x1400d4b0c], 0
jne 0x1400311a3
cmp dword [0x1400d4ae4], 0
je 0x1400311f0
cmp qword [rbx + 0xaf8], 0
jle 0x1400311b9
lea rcx, [rbx + 0xae0]
call fcn.140046d20
mov qword [rbx + 0xb18], rbx
mov rcx, qword [rbx + 0x7f0]
test rcx, rcx
je 0x1400311f0
mov rax, qword [rcx]
lea rdx, [rbx + 0xad0]
call qword [rax + 0x30]
test eax, eax
js 0x1400311f0
lea rcx, [rbx + 0x7f8]
lea rdx, [rbx + 0xad0]
call fcn.140046f44
mov rcx, rbx
call fcn.140032140
cmp dword [0x1400d4b28], 0
je 0x14003120d
lea rcx, [rbx + 0x7e8]
call fcn.14001e5d0
cmp dword [rbx + 0xc48], 0
je 0x14003121e
mov rcx, rbx
call fcn.1400319a0
cmp dword [0x1400d4b1c], 0
je 0x140031313
mov rdi, qword [rbx + 0x40]
lea rcx, str.SkypeControlAPIAttach
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rbx + 0xdf8], eax
lea rcx, str.SkypeControlAPIDiscover
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov dword [rbx + 0xdfc], eax
mov qword [rbx + 0xe20], rdi
mov rdx, rdi
lea rcx, str.CSkypeMgr::BroadCastSkypeControlAPIDiscoverMsgID__d_n
call fcn.140001030
xor r9d, r9d
mov r8, qword [rbx + 0xe20]
mov edx, dword [rbx + 0xdfc]
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x270f
lea rcx, str._tSet_Timer..._d_n
call fcn.140001030
xor r9d, r9d
mov edx, 0x270f
mov r8d, 0x3e8
mov rcx, qword [rbx + 0xe20]
call qword [sym.imp.USER32.dll_SetTimer]
lea rdi, [rbx + 0xe30]
cmp qword [rdi], 0
jne 0x140031313
mov qword [rsp + 0x20], rdi
lea r9, [0x1400a9a60]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1400a9a80]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rdi, qword [rdi]
test rdi, rdi
je 0x140031313
mov word [rsp + 0x70], 0
mov rax, qword [rdi]
lea r8, [rsp + 0x70]
mov edx, dword [rbx + 0x40]
mov rcx, rdi
call qword [rax + 0x38]
test eax, eax
jns 0x140031313
lea r8, [0x1400a9a60]
mov rdx, rdi
mov ecx, eax
call fcn.1400930e0
mov rcx, rbx
call fcn.140031810
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret