Function at 0x1400080f0
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings
Create thread
Log keystrokes via polling
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x5e0
mov r15, rdx
xor esi, esi
mov dword [rsp + 0x630], esi
lea rcx, [rsp + 0xe8]
call fcn.1400077f0
mov rbx, rax
lea rax, [0x140057cf0]
cmp rax, rbx
je 0x1400081ad
mov rdx, qword [0x140057d08]
cmp rdx, 0x10
jb 0x140008170
mov rcx, qword [0x140057cf0]
inc rdx
cmp rdx, 0x1000
jb 0x14000816b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400099d9
mov rcx, r8
call fcn.140017dc8
mov qword [0x140057d00], rsi
mov r14d, 0xf
mov qword [0x140057d08], r14
mov byte [0x140057cf0], sil
movups xmm0, xmmword [rbx]
movups xmmword [0x140057cf0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x140057d00], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], r14
mov byte [rbx], sil
jmp 0x1400081b3
mov r14d, 0xf
mov rdx, qword [rsp + 0x100]
cmp rdx, 0x10
jb 0x1400081f7
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400081f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099d9
call fcn.140017dc8
nop
mov al, 0x6d
mov dword [rsp + 0x50], 0x3e006d
mov dword [rsp + 0x54], 0x3e0034
mov dword [rsp + 0x58], 0x280039
mov dword [rsp + 0x5c], 0x310020
mov dword [rsp + 0x60], 0x18002e
mov dword [rsp + 0x64], 0x1f001f
mov dword [rsp + 0x68], 0x30008
mov dword [rsp + 0x6c], 0x2e0019
mov r13d, 2
mov dword [rsp + 0x70], 0x30002
mov dword [rsp + 0x74], 0x1f0019
mov dword [rsp + 0x78], 0x10002
mov dword [rsp + 0x7c], 0x8003e
mov dword [rsp + 0x80], 0x310019
mov dword [rsp + 0x84], 0x2002e
mov dword [rsp + 0x88], 0x190003
mov dword [rsp + 0x8c], 0x2001f
mov dword [rsp + 0x90], 0x310001
mov dword [rsp + 0x94], 0x24002e
mov dword [rsp + 0x98], 0x2e0031
mov dword [rsp + 0x9c], 0x30002
mov dword [rsp + 0xa0], 0x4000b
mov dword [rsp + 0xa4], 0xa
mov rcx, rsi
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x54], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x56], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x58], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x5a], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x5c], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x5e], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x60], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x62], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x64], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x66], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x68], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x6a], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x6c], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x6e], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x70], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x72], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x74], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x76], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x78], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x7a], ax
add rcx, 0x15
cmp rcx, 0x2a
jae 0x1400083b4
movzx eax, byte [rsp + 0x50]
jmp 0x1400082d0
mov word [rsp + 0xa6], si
mov cl, 0x53
mov word [rsp + 0x110], 0x53
movsx edi, cl
movzx eax, di
xor ax, 5
mov word [rsp + 0x112], ax
movzx eax, di
xor ax, 0x26
mov word [rsp + 0x114], ax
movzx ebx, di
xor bx, 0x3f
mov word [rsp + 0x116], bx
movzx r10d, di
xor r10w, 0x3d
mov word [rsp + 0x118], r10w
movzx r11d, di
xor r11w, 0x36
mov word [rsp + 0x11a], r11w
movzx edx, di
xor dx, 0x21
mov word [rsp + 0x11c], dx
movzx r9d, di
xor r9w, 0x32
mov word [rsp + 0x11e], r9w
movzx r8d, di
xor r8w, 0x31
mov word [rsp + 0x120], r8w
mov word [rsp + 0x122], bx
mov word [rsp + 0x124], r11w
movzx eax, di
xor ax, 0x17
mov word [rsp + 0x126], ax
mov word [rsp + 0x128], dx
movzx ecx, di
xor cx, 0x3a
mov word [rsp + 0x12a], cx
movzx eax, di
xor ax, 0x25
mov word [rsp + 0x12c], ax
mov word [rsp + 0x12e], r11w
mov word [rsp + 0x130], dx
movzx eax, di
xor ax, 0x11
mov word [rsp + 0x132], ax
mov word [rsp + 0x134], bx
movzx eax, di
xor ax, 0x3c
mov word [rsp + 0x136], ax
movzx eax, di
xor ax, 0x30
mov word [rsp + 0x138], ax
movzx eax, di
xor ax, 0x38
mov word [rsp + 0x13a], ax
mov word [rsp + 0x13c], bx
mov word [rsp + 0x13e], cx
movzx eax, di
xor ax, 0x20
mov word [rsp + 0x140], ax
movzx eax, di
xor ax, 0x27
mov word [rsp + 0x142], ax
xor di, 0x16
mov word [rsp + 0x144], di
mov word [rsp + 0x146], r10w
mov word [rsp + 0x148], r9w
mov word [rsp + 0x14a], r8w
mov word [rsp + 0x14c], bx
mov word [rsp + 0x14e], r11w
mov word [rsp + 0x150], si
mov dword [rsp + 0x630], esi
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
mov r9d, r13d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400089d5
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x630]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
xor r8d, r8d
lea rdx, [rsp + 0x112]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x1400087a7
mov cl, 9
mov word [rsp + 0xe8], 9
movsx r8d, cl
movzx eax, r8w
xor ax, 0x5b
mov word [rsp + 0xea], ax
movzx edx, r8w
xor dx, 0x6c
mov word [rsp + 0xec], dx
movzx eax, r8w
xor ax, 0x6e
mov word [rsp + 0xee], ax
movzx eax, r8w
xor ax, 0x60
mov word [rsp + 0xf0], ax
movzx eax, r8w
xor ax, 0x7a
mov word [rsp + 0xf2], ax
movzx eax, r8w
xor ax, 0x7d
mov word [rsp + 0xf4], ax
movzx eax, r8w
xor ax, 0x7b
mov word [rsp + 0xf6], ax
movzx eax, r8w
xor ax, 0x70
mov word [rsp + 0xf8], ax
movzx ecx, r8w
xor cx, 0x29
mov word [rsp + 0xfa], cx
movzx eax, r8w
xor ax, 0x7f
mov word [rsp + 0xfc], ax
movzx eax, r8w
xor ax, 0x68
mov word [rsp + 0xfe], ax
movzx eax, r8w
xor ax, 0x65
mov word [rsp + 0x100], ax
xor r8w, 0x7c
mov word [rsp + 0x102], r8w
mov word [rsp + 0x104], dx
mov word [rsp + 0x106], cx
mov word [rsp + 0x108], si
lea rdx, [rsp + 0xea]
lea rcx, [0x140058a40]
call fcn.14000fe80
lea rdx, [rsp + 0x112]
mov rcx, rax
call fcn.14000fe80
mov r9, rax
mov cl, 0x65
mov word [rsp + 0x30], 0x65
movsx r8d, cl
movzx edx, r8w
xor dx, 0x45
mov word [rsp + 0x32], dx
movzx ecx, r8w
xor cx, 0x16
mov word [rsp + 0x34], cx
mov word [rsp + 0x36], r8w
movzx eax, r8w
xor ax, 0x11
mov word [rsp + 0x38], ax
mov word [rsp + 0x3a], dx
mov word [rsp + 0x3c], ax
xor r8w, 0xa
mov word [rsp + 0x3e], r8w
mov word [rsp + 0x40], dx
mov word [rsp + 0x42], si
lea rdx, [rsp + 0x32]
mov rcx, r9
call fcn.14000fe80
mov edx, dword [rsp + 0x630]
mov rcx, rax
call fcn.140009a40
mov dl, 0x6d
mov word [rsp + 0x638], 0x6d
movsx edx, dl
movzx ecx, dx
xor cx, 0x43
mov word [rsp + 0x63a], cx
xor dx, 0x67
mov word [rsp + 0x63c], dx
mov word [rsp + 0x63e], si
lea rdx, [rsp + 0x63a]
mov rcx, rax
call fcn.14000fe80
lea r13d, [rbx + 5]
jmp 0x1400089b9
mov al, 0x64
mov dword [rsp + 0x50], 0x220064
mov r13d, 5
mov dword [rsp + 0x54], 0xd0005
mov dword [rsp + 0x58], 0x10008
mov dword [rsp + 0x5c], 0x440000
mov dword [rsp + 0x60], 0xb0010
mov dword [rsp + 0x64], 0x170044
mov dword [rsp + 0x68], 0x100001
mov dword [rsp + 0x6c], 0x160044
mov dword [rsp + 0x70], 0x30001
mov dword [rsp + 0x74], 0x17000d
mov dword [rsp + 0x78], 0x160010
mov dword [rsp + 0x7c], 0x44001d
mov dword [rsp + 0x80], 0x50012
mov dword [rsp + 0x84], 0x110008
mov dword [rsp + 0x88], 0x4a0001
mov dword [rsp + 0x8c], 0x210044
mov dword [rsp + 0x90], 0x160016
mov dword [rsp + 0x94], 0x16000b
mov dword [rsp + 0x98], 0x70044
mov dword [rsp + 0x9c], 0xb
mov dword [rsp + 0xa0], 0x5e0001
mov dword [rsp + 0xa4], 0x44
mov rcx, rsi
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x54], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x56], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x58], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x5a], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x5c], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x5e], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x60], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x62], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x64], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x66], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x68], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x6a], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x6c], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x6e], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x70], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x72], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x74], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x76], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x78], ax
movsx eax, byte [rsp + 0x50]
xor word [rsp + rcx*2 + 0x7a], ax
add rcx, 0x15
cmp rcx, 0x2a
jae 0x140008964
movzx eax, byte [rsp + 0x50]
jmp 0x140008880
mov word [rsp + 0xa6], si
lea rdx, [rsp + 0x52]
lea rcx, [0x140058be0]
call fcn.14000fe80
mov edx, ebx
mov rcx, rax
call fcn.140009bb0
mov cl, 0x28
mov word [rsp + 0x638], 0x28
xor cl, 0x22
movsx ecx, cl
mov word [rsp + 0x63a], cx
mov word [rsp + 0x63c], si
lea rdx, [rsp + 0x63a]
mov rcx, rax
call fcn.14000fe80
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 8
lea r12d, [rdi + 0x43]
jmp 0x140008b57
mov al, 0x6b
mov dword [rsp + 0x110], 0x2d006b
mov dword [rsp + 0x114], 0x2000a
mov dword [rsp + 0x118], 0xe0007
mov dword [rsp + 0x11c], 0x4b000f
mov r12d, 0x4b
mov dword [rsp + 0x120], 0x4001f
mov dword [rsp + 0x124], 0x4004b
mov dword [rsp + 0x128], 0xe001b
lea r13d, [r12 - 0x46]
mov dword [rsp + 0x12c], 0x4b0005
mov dword [rsp + 0x130], 0xe0019
mov dword [rsp + 0x134], 0x2000c
mov dword [rsp + 0x138], 0x1f0018
mov dword [rsp + 0x13c], 0x120019
mov dword [rsp + 0x140], r12d
mov dword [rsp + 0x144], 0x12000e
mov dword [rsp + 0x148], 0x4b0045
mov dword [rsp + 0x14c], 0x19002e
mov dword [rsp + 0x150], 0x40019
mov dword [rsp + 0x154], 0x4b0019
lea edi, [r12 - 0x43]
mov dword [rsp + 0x158], 0x40008
mov dword [rsp + 0x15c], 0xe000f
mov dword [rsp + 0x160], 0x4b0051
mov word [rsp + 0x164], si
mov rcx, rsi
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x112], ax
inc rcx
cmp rcx, 0x29
jae 0x140008afe
movzx eax, byte [rsp + 0x110]
jmp 0x140008ae0
mov word [rsp + 0x164], si
lea rdx, [rsp + 0x112]
lea rcx, [0x140058be0]
call fcn.14000fe80
mov edx, ebx
mov rcx, rax
call fcn.140009bb0
mov cl, 0x71
mov word [rsp + 0x638], 0x71
xor cl, 0x7b
movsx ecx, cl
mov word [rsp + 0x63a], cx
mov word [rsp + 0x63c], si
lea rdx, [rsp + 0x63a]
mov rcx, rax
call fcn.14000fe80
nop
jmp 0x140008b72
mov byte [0x14005a5e6], 0
mov rcx, rdi
call fcn.140017dd0
lea rcx, [0x140007980]
mov qword [rax], rcx
mov qword [rsp + 0x630], rax
lea rcx, [rsp + 0x178]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140013740]
xor edx, edx
xor ecx, ecx
call fcn.14001eaec
mov qword [rsp + 0x170], rax
test rax, rax
je 0x1400099c7
lea rcx, [rsp + 0x1c0]
call fcn.140009e20
nop
mov rdx, qword [r15]
lea rcx, [rsp + 0x1d0]
call fcn.14000f530
nop
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], r14
mov byte [rsp + 0xc8], 0
mov dword [rsp + 0x630], r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x248]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140008c5e
mov rax, qword [rsp + 0x218]
mov r8, qword [rax]
test r8, r8
je 0x140008c5e
mov rax, qword [rsp + 0x1f8]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x240]
cmovb r8, qword [rsp + 0x240]
sub r8, rdx
jmp 0x140008c9b
test cl, 4
jne 0x140008c91
mov rax, qword [rsp + 0x210]
mov r9, qword [rax]
test r9, r9
je 0x140008c91
mov rax, qword [rsp + 0x1f0]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x228]
movsxd r8, dword [rax]
sub r8, rdx
add r8, r9
jmp 0x140008c9b
mov rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x38]
test rdx, rdx
je 0x140008cb4
lea rcx, [rsp + 0xc8]
call fcn.14000dba0
mov ecx, dword [rsp + 0x248]
mov qword [rsp + 0xe8], rsi
mov r15, rsi
mov qword [rsp + 0xf8], rsi
mov rdi, r14
mov qword [rsp + 0x100], r14
mov byte [rsp + 0xe8], 0
mov dword [rsp + 0x630], 0x13
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x140008d2d
mov rax, qword [rsp + 0x218]
mov r8, qword [rax]
test r8, r8
je 0x140008d2d
mov rax, qword [rsp + 0x1f8]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x240]
cmovb r8, qword [rsp + 0x240]
sub r8, rdx
jmp 0x140008d6a
test cl, 4
jne 0x140008d60
mov rax, qword [rsp + 0x210]
mov rcx, qword [rax]
test rcx, rcx
je 0x140008d60
mov rax, qword [rsp + 0x1f0]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x228]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x140008d6a
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140008d8c
lea rcx, [rsp + 0xe8]
call fcn.14000dba0
mov rdi, qword [rsp + 0x100]
mov r15, qword [rsp + 0xf8]
mov dword [rsp + 0xa8], 0x65735534
mov dword [rsp + 0xac], 0x646f4d72
mov dword [rsp + 0xb0], 0x78652e65
mov word [rsp + 0xb4], 0x65
mov qword [rsp + 0x1a0], rsi
mov qword [rsp + 0x1b0], rsi
mov qword [rsp + 0x1b8], r14
mov byte [rsp + 0x1a0], 0
lea rax, [rsp + 0xa9]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140008de6
lea rdx, [rsp + 0xa9]
lea rcx, [rsp + 0x1a0]
call fcn.14000dba0
nop
mov qword [rsp + 0xa8], rsi
mov rcx, rsi
mov qword [rsp + 0xb8], rcx
mov rbx, r14
mov qword [rsp + 0xc0], rbx
mov byte [rsp + 0xa8], 0
mov dword [rsp + 0x630], r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x248]
mov eax, edx
and al, 0x22
cmp al, 2
je 0x140008e83
mov rax, qword [rsp + 0x218]
mov r8, qword [rax]
test r8, r8
je 0x140008e83
mov rax, qword [rsp + 0x1f8]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x240]
cmovb r8, qword [rsp + 0x240]
sub r8, rdx
jmp 0x140008ec0
test dl, 4
jne 0x140008eb6
mov rax, qword [rsp + 0x210]
mov r9, qword [rax]
test r9, r9
je 0x140008eb6
mov rax, qword [rsp + 0x1f0]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x228]
movsxd r8, dword [rax]
sub r8, rdx
add r8, r9
jmp 0x140008ec0
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140008ee2
lea rcx, [rsp + 0xa8]
call fcn.14000dba0
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
sub rcx, qword [rsp + 0x1b0]
mov qword [rsp + 0x20], rsi
mov r8, r15
mov rdx, rcx
lea rcx, [rsp + 0xc8]
call fcn.14000d9d0
mov rdx, rax
lea rcx, [rsp + 0x180]
call fcn.14000bd50
nop
cmp rbx, 0x10
jb 0x140008f50
lea rdx, [rbx + 1]
mov rcx, qword [rsp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099df
call fcn.140017dc8
nop
mov rdx, qword [rsp + 0x1b8]
cmp rdx, 0x10
jb 0x140008f94
inc rdx
mov rcx, qword [rsp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008f8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099e5
call fcn.140017dc8
nop
cmp rdi, 0x10
jb 0x140008fd1
lea rdx, [rdi + 1]
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fcb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099eb
call fcn.140017dc8
nop
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x140009014
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000900f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099f1
call fcn.140017dc8
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], r14
mov byte [rsp + 0xc8], 0
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
movdqa xmm0, xmmword [0x14004fa00]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x75207972
mov dword [rsp + 0x44], 0x7265646e
mov dword [rsp + 0x48], 0xa732520
mov byte [rsp + 0x4c], 0
lea rcx, [rsp + 0x31]
call fcn.140001470
lea rcx, [rsp + 0x3e0]
call fcn.140009e20
nop
mov dword [rsp + 0x630], 0x706f6359
mov dword [rsp + 0x634], 0x222079
lea rdx, [rsp + 0x631]
lea rcx, [rsp + 0x3f0]
call fcn.14000f530
lea rdx, [rsp + 0x180]
cmp qword [rsp + 0x198], 0x10
cmovae rdx, qword [rsp + 0x180]
mov rcx, rax
call fcn.14000f530
movdqa xmm0, xmmword [0x14004f870]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x20
lea rdx, [rsp + 0x31]
mov rcx, rax
call fcn.14000f530
movdqa xmm0, xmmword [0x14004fa50]
movdqu xmmword [rsp + 0xc8], xmm0
mov dword [rsp + 0xd8], 0x336d6574
mov dword [rsp + 0xdc], 0x72645c32
mov dword [rsp + 0xe0], 0x72657669
mov word [rsp + 0xe4], 0x5c73
mov byte [rsp + 0xe6], 0
lea rdx, [rsp + 0xc9]
mov rcx, rax
call fcn.14000f530
lea rbx, [0x140057cf0]
mov rdx, rbx
cmp qword [0x140057d08], 0x10
cmovae rdx, qword [0x140057cf0]
mov r8, qword [0x140057d00]
mov rcx, rax
call fcn.140012500
mov dword [rsp + 0xa8], 0x79732e11
mov dword [rsp + 0xac], 0x3e202273
mov dword [rsp + 0xb0], 0x4c554e20
mov byte [rsp + 0xb4], 0
lea rdx, [rsp + 0xa9]
mov rcx, rax
call fcn.14000f530
nop
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], rsi
mov r9, r14
mov qword [rsp + 0xe0], r14
mov byte [rsp + 0xc8], 0
mov dword [rsp + 0x630], 0x12b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x468]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000922c
mov rax, qword [rsp + 0x438]
mov r8, qword [rax]
test r8, r8
je 0x14000922c
mov rax, qword [rsp + 0x418]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x460]
cmovb r8, qword [rsp + 0x460]
sub r8, rdx
jmp 0x140009269
test cl, 4
jne 0x14000925f
mov rax, qword [rsp + 0x430]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000925f
mov rax, qword [rsp + 0x410]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x448]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x140009269
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140009283
lea rcx, [rsp + 0xc8]
call fcn.14000dba0
mov r9, qword [rsp + 0xe0]
lea rcx, [rsp + 0xc8]
cmp r9, 0x10
cmovae rcx, qword [rsp + 0xc8]
call fcn.140021734
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x1400092e0
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400092db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099f7
call fcn.140017dc8
lea rcx, [rsp + 0x4e0]
call fcn.140009e20
nop
lea rcx, [rsp + 0x2e0]
call fcn.140009e20
nop
movdqa xmm0, xmmword [0x14004fa70]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x32336d65
mov dword [rsp + 0x44], 0x6972645c
mov dword [rsp + 0x48], 0x73726576
mov word [rsp + 0x4c], 0x5c
lea rdx, [rsp + 0x31]
lea rcx, [rsp + 0x2f0]
call fcn.14000f530
mov rdx, rbx
cmp qword [0x140057d08], 0x10
cmovae rdx, qword [0x140057cf0]
mov rcx, rax
call fcn.14000f530
mov dword [rsp + 0x630], 0x79732e7b
mov word [rsp + 0x634], 0x73
lea rdx, [rsp + 0x631]
mov rcx, rax
call fcn.14000f530
nop
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], rsi
mov rcx, r14
mov qword [rsp + 0xe0], rcx
mov byte [rsp + 0xc8], 0
mov dword [rsp + 0x630], 0x4ab
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov edx, dword [rsp + 0x368]
mov eax, edx
and al, 0x22
cmp al, 2
je 0x1400093f9
mov rax, qword [rsp + 0x338]
mov r8, qword [rax]
test r8, r8
je 0x1400093f9
mov rax, qword [rsp + 0x318]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x360]
cmovb r8, qword [rsp + 0x360]
sub r8, rdx
jmp 0x140009436
test dl, 4
jne 0x14000942c
mov rax, qword [rsp + 0x330]
mov r9, qword [rax]
test r9, r9
je 0x14000942c
mov rax, qword [rsp + 0x310]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x348]
movsxd r8, dword [rax]
sub r8, rdx
add r8, r9
jmp 0x140009436
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x140009450
lea rcx, [rsp + 0xc8]
call fcn.14000dba0
mov rcx, qword [rsp + 0xe0]
lea rdx, [rsp + 0xc8]
cmp rcx, 0x10
cmovae rdx, qword [rsp + 0xc8]
mov dword [rsp + 0xa8], 0x69724416
mov dword [rsp + 0xac], 0x20726576
mov dword [rsp + 0xb0], 0xa0a7325
mov byte [rsp + 0xb4], 0
lea rcx, [rsp + 0xa9]
call fcn.140001470
nop
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x1400094df
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400094da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400099fd
call fcn.140017dc8
call fcn.140004140
test al, al
jne 0x140009644
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x638], rax
mov rdx, rbx
lea rcx, [rsp + 0xe8]
call fcn.14000bd50
mov rbx, rax
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd8], rsi
mov r9, r14
mov qword [rsp + 0xe0], r14
mov byte [rsp + 0xc8], 0
mov dword [rsp + 0x630], 0x12ab
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov ecx, dword [rsp + 0x368]
mov eax, ecx
and al, 0x22
cmp al, 2
je 0x14000958c
mov rax, qword [rsp + 0x338]
mov r8, qword [rax]
test r8, r8
je 0x14000958c
mov rax, qword [rsp + 0x318]
mov rdx, qword [rax]
cmp r8, qword [rsp + 0x360]
cmovb r8, qword [rsp + 0x360]
sub r8, rdx
jmp 0x1400095c9
test cl, 4
jne 0x1400095bf
mov rax, qword [rsp + 0x330]
mov rcx, qword [rax]
test rcx, rcx
je 0x1400095bf
mov rax, qword [rsp + 0x310]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x348]
movsxd r8, dword [rax]
sub r8, rdx
add r8, rcx
jmp 0x1400095c9
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
test rdx, rdx
je 0x1400095e3
lea rcx, [rsp + 0xc8]
call fcn.14000dba0
mov r9, qword [rsp + 0xe0]
lea rcx, [rsp + 0xc8]
cmp r9, 0x10
cmovae rcx, qword [rsp + 0xc8]
mov rdx, rbx
call fcn.140004c50
nop
mov rdx, qword [rsp + 0xe0]
cmp rdx, 0x10
jb 0x140009644
inc rdx
mov rcx, qword [rsp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000963f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a03
call fcn.140017dc8
call fcn.140004140
lea rcx, [rsp + 0x31]
test al, al
je 0x140009673
movdqa xmm0, xmmword [0x14004fa20]
mov dword [rsp + 0x40], 0x616f6c20
mov dword [rsp + 0x44], 0x5d646564
mov word [rsp + 0x48], 0xa
jmp 0x140009698
movdqa xmm0, xmmword [0x14004f860]
mov dword [rsp + 0x40], 0x20746f6e
mov dword [rsp + 0x44], 0x64616f6c
mov dword [rsp + 0x48], 0xa5d6465
mov byte [rsp + 0x4c], 0
movdqu xmmword [rsp + 0x30], xmm0
call fcn.140001470
lea rdx, [0x140057d10]
lea rcx, [rsp + 0xe8]
call fcn.14000bd50
mov rdx, rax
call fcn.1400044b0
mov eax, dword [0x14005a700]
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0x630], rsi
lea rax, [rsp + 0x630]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftInput
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0x630]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009775
mov dword [rsp + 0x30], 0x2b5
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x638], rax
mov dword [rsp + 0x28], 8
lea rax, [rsp + 0x638]
mov qword [rsp + 0x20], rax
mov r9d, 0xb
xor r8d, r8d
lea rdx, str.IsThatFreddyFadBear
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x630]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140009788
lea rdx, str.Registry_error_n
lea rcx, [0x1400588c0]
call fcn.14000f530
mov rax, qword [rsp + 0xb0]
mov qword [0x14005a5e8], rax
call fcn.140004210
mov dword [0x14005a6fc], eax
movdqa xmm0, xmmword [0x14004f8a0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x6f742030
mov dword [rsp + 0x44], 0x61747320
mov dword [rsp + 0x48], 0xa7472
lea rcx, [rsp + 0x31]
call fcn.140001470
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14000980d
mov qword [rsp + 0x630], 0xa
nop
lea rcx, [rsp + 0x630]
call fcn.14000fce0
mov ecx, 0x79
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1400097f0
mov dword [rsp + 0x630], 0x736c6335
mov byte [rsp + 0x634], 0
lea rcx, [rsp + 0x631]
call fcn.140021734
movdqa xmm0, xmmword [0x14004f8c0]
movdqu xmmword [rsp + 0xe8], xmm0
movdqa xmm1, xmmword [0x14004f880]
movdqu xmmword [rsp + 0xf8], xmm1
mov word [rsp + 0x108], 0xa
lea rcx, [rsp + 0xe9]
call fcn.140001470
movdqa xmm0, xmmword [0x14004f9f0]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xa2167
lea rcx, [rsp + 0x31]
call fcn.140001470
movdqa xmm0, xmmword [0x14004fa40]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x65736142
mov dword [rsp + 0x44], 0x20746120
mov dword [rsp + 0x48], 0xa0a7025
mov byte [rsp + 0x4c], 0
mov rdx, qword [0x14005a5e8]
lea rcx, [rsp + 0x31]
call fcn.140001470
call fcn.140007230
cmp dword [rsp + 0x178], 0
je 0x140009a09
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x178], eax
je 0x140009a14
movaps xmm0, xmmword [rsp + 0x170]
movdqa xmmword [rsp + 0x30], xmm0
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140017334
test eax, eax
jne 0x140009a1d
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x170], xmm0
lea rcx, [rsp + 0x2e0]
call fcn.140007050
nop
lea rcx, [rsp + 0x4e0]
call fcn.140007050
nop
lea rcx, [rsp + 0x3e0]
call fcn.140007050
nop
mov rdx, qword [rsp + 0x198]
cmp rdx, 0x10
jb 0x140009982
inc rdx
mov rcx, qword [rsp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000997d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009a28
call fcn.140017dc8
mov qword [rsp + 0x190], rsi
mov qword [rsp + 0x198], r14
mov byte [rsp + 0x180], 0
lea rcx, [rsp + 0x1c0]
call fcn.140007050
nop
cmp dword [rsp + 0x178], 0
jne 0x140009a2e
xor eax, eax
add rsp, 0x5e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov dword [rsp + 0x178], esi
mov ecx, 6
call fcn.140014a4c
nop
call fcn.140023650
nop
call fcn.140023650
nop
call fcn.140023650
nop
call fcn.140023650
nop
call fcn.140023650
nop
call fcn.140023650
nop
call fcn.140023650
int3
call fcn.140023650
int3
mov ecx, 1
call fcn.140014a4c
int3
mov ecx, r13d
call fcn.140014a4c
int3
mov ecx, 2
call fcn.140014a4c
nop
call fcn.140023650
nop
call fcn.140021870
int3