Function at 0x140038460
Capabilities:
Log keystrokes via application hook
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x70
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rbx, rcx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.d:log
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.d:log
lea rcx, [0x1400e8ec8]
call fcn.140011ed0
mov rcx, rbx
call fcn.14003be90
mov rdi, qword [0x1400e8eb8]
cmp dword [rdi - 0x10], 0
je 0x140038531
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rdi - 8], 0
jl 0x1400384da
cmp rax, qword [rdi - 0x18]
jne 0x1400384da
lea rbx, [rdi - 0x18]
lock add dword [rdi - 8], 1
jmp 0x140038517
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rdi - 0x10]
call qword [rax]
mov rbx, rax
test rax, rax
jne 0x1400384f6
call fcn.140011890
int3
mov eax, dword [rdi - 0x10]
mov dword [rbx + 8], eax
mov eax, dword [rdi - 0x10]
add eax, 1
movsxd rdx, eax
add rdx, rdx
mov r8, rdi
lea rcx, [rbx + 0x18]
mov r9, rdx
call fcn.14007f790
lea rax, [rbx + 0x18]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.1400151a0
xor eax, eax
jmp 0x140038eec
cmp qword [rbx + 0xb68], 0
jle 0x140038547
lea rcx, [rbx + 0xb50]
call fcn.140053748
cmp dword [0x1400e8e44], 0
je 0x14003857a
lea rcx, [rbx + 0x7f8]
xor edi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 2]
call fcn.14002f300
mov rcx, rbx
call fcn.140049c80
xor eax, eax
jmp 0x140038eec
mov rcx, rbx
call fcn.14003bf90
mov edx, dword [rbx + 0xa28]
shr edx, 9
and edx, 1
mov dword [rbx + 0xe98], edx
cmp dword [0x1400e8e38], 0
je 0x1400385d6
mov rcx, rbx
call fcn.1400499d0
cmp dword [0x1400e8e18], 0
jne 0x1400385c7
cmp dword [0x1400e8e2c], 0
jne 0x1400385c7
lea rcx, [0x1400e8c80]
call fcn.1400370a0
test eax, eax
je 0x1400385cf
mov rcx, rbx
call fcn.14003b7d0
xor eax, eax
jmp 0x140038eec
cmp dword [0x1400e8de8], 0
jne 0x140038ee2
cmp dword [0x1400e8e50], 0
jne 0x140038ee2
cmp dword [0x1400e8df0], 0
jne 0x140038ee2
cmp dword [0x1400e8df8], 0
jne 0x140038ee2
cmp dword [0x1400e8dfc], 0
jne 0x140038ee2
cmp dword [0x1400e8e04], 0
jne 0x140038ee2
cmp dword [0x1400e8e0c], 0
jne 0x140038ee2
cmp dword [0x1400e8e14], 0
jne 0x140038ee2
cmp dword [0x1400e8e20], 0
jne 0x140038ee2
cmp dword [0x1400e8ddc], 0
jne 0x140038ee2
cmp dword [0x1400e8e18], 0
jne 0x140038ee2
cmp dword [0x1400e8e2c], 0
jne 0x140038ee2
cmp dword [0x1400e8e34], 0
je 0x1400386a0
lea rcx, [rbx + 0x8f8]
lea rdx, [rsp + 0x50]
call fcn.14004f9e0
mov edx, 1
mov rcx, rax
call fcn.140028710
xor eax, eax
jmp 0x140038eec
mov dword [rbx + 0x600], 0x67
mov dword [rbx + 0x604], 0x66
cmp dword [0x1400e8e78], 0
je 0x140038749
lea rsi, [rbx + 0x7f8]
test rsi, rsi
je 0x140038742
call fcn.14004e9c0
lea rcx, [rsi + 0xb8]
call fcn.14002f030
mov ebp, dword [rsi + 0x60]
xor edi, edi
test ebp, ebp
je 0x140038731
cmp edi, dword [rsi + 0x60]
jae 0x140038722
mov edx, edi
lea rcx, [rsi + 0x48]
call fcn.140053840
test rax, rax
je 0x14003872b
mov rbx, qword [rax + 0x10]
test rbx, rbx
je 0x140038722
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140004900
mov rcx, rax
call fcn.14004e440
mov rcx, rbx
call fcn.14004dfd0
add edi, 1
cmp edi, ebp
jae 0x140038731
jmp 0x1400386e7
call fcn.140054698
int3
mov rax, qword [rsi + 0xb8]
lea rcx, [rsi + 0xb8]
call qword [rax + 0x28]
xor eax, eax
jmp 0x140038eec
cmp dword [0x1400e8e9c], 0
je 0x14003875f
call fcn.140016360
test eax, eax
je 0x140038eec
cmp dword [0x1400e8eac], 0
je 0x14003877e
cmp dword [0x1400e7af4], 0
je 0x14003877e
call fcn.140016360
test eax, eax
je 0x140038eec
mov esi, 1
cmp dword [0x1400e8dc8], 0
je 0x1400387ba
lea rdi, str.h0_v_
lea ebp, [rsi + 0x25]
mov rdx, qword [rdi]
test rdx, rdx
je 0x1400387aa
lea rcx, [rbx + 0xb50]
call fcn.14005398c
add rdi, 8
sub rbp, 1
jne 0x140038796
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8dc4], 0
je 0x1400387cb
mov rcx, rbx
call fcn.1400410f0
cmp dword [0x1400e8e5c], 0
je 0x1400387ff
mov rcx, rbx
call fcn.140041190
bt dword [rbx + 0x9ac], 0x1d
jae 0x1400387ee
mov rcx, rbx
call fcn.140041570
test byte [rbx + 0xa14], 0x80
je 0x1400387ff
mov rcx, rbx
call fcn.140046f60
cmp dword [0x1400e8e64], 0
je 0x14003882c
mov dword [rbx + 0xe64], esi
mov rdx, qword [0x1400e06f0]
test rdx, rdx
je 0x140038826
lea rcx, [rbx + 0xb50]
call fcn.14005398c
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8e60], 0
je 0x14003883b
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8dcc], 0
je 0x140038856
xor edx, edx
mov rcx, rbx
call fcn.140041600
mov rcx, rbx
call fcn.140044480
cmp dword [0x1400e8dd0], 0
je 0x140038871
mov edx, esi
mov rcx, rbx
call fcn.140041600
mov rcx, rbx
call fcn.140044530
cmp dword [0x1400e8dd4], 0
je 0x14003888c
xor edx, edx
mov rcx, rbx
call fcn.140041600
mov rcx, rbx
call fcn.1400443f0
lea rcx, [0x1400e8c80]
call fcn.140037040
test eax, eax
jne 0x1400388ac
cmp dword [0x1400e8de0], eax
jne 0x1400388ac
cmp dword [0x1400e8eb0], eax
je 0x1400388b4
mov rcx, rbx
call fcn.14003b9b0
cmp dword [0x1400e8dd8], 0
je 0x140038922
mov dword [rbx + 0xb48], esi
lea rdi, [0x1400e0600]
mov ebp, SafeArrayGetDim
nop
mov rdx, qword [rdi]
test rdx, rdx
je 0x1400388e4
lea rcx, [rbx + 0xb50]
call fcn.14005398c
add rdi, 8
sub rbp, 1
jne 0x1400388d0
mov dword [rbx + 0xe64], esi
lea rcx, [rbx + 0x8f8]
lea rdx, [rsp + 0x60]
call fcn.14004f9e0
mov rdx, rax
lea rcx, [rbx + 0xba8]
call fcn.1400208e0
mov dword [rbx + 0xc90], esi
mov rcx, rbx
call fcn.140046590
cmp dword [0x1400e8e54], 0
je 0x140038964
lea rcx, [rbx + 0xd70]
call fcn.14004bf70
mov rax, qword [rbx + 0xda0]
test rax, rax
je 0x140038952
xor r8d, r8d
mov rdx, rbx
lea rcx, [0x140047740]
call rax
mov rcx, rbx
call fcn.140047760
xor edx, edx
mov rcx, rbx
call fcn.140046380
xor edi, edi
cmp dword [0x1400e8e58], edi
je 0x140038b9d
mov edx, esi
lea ecx, [rdi + 0x10]
call qword [sym.imp.USER32.dll_ChangeWindowMessageFilter]
movzx r11d, word [rbx + 0x8fa]
cmp r11d, 0x1025
je 0x1400389b3
cmp r11d, 0x17aa
jne 0x1400389b9
mov dword [0x1400e8a30], 0xff
mov dword [0x1400e8a34], 0x71
mov dword [rbx + 0xe40], esi
jmp 0x1400389b9
mov dword [rbx + 0xe44], esi
cmp dword [rbx + 0xad8], edi
jne 0x140038af7
cmp dword [rbx + 0xadc], edi
jne 0x140038af7
cmp dword [rbx + 0xae0], edi
jne 0x140038af7
cmp dword [rbx + 0xae4], edi
jne 0x140038af7
mov ecx, dword [rbx + 0xaa0]
test ecx, ecx
je 0x140038a16
movzx eax, byte [rbx + 0xaa1]
mov dword [0x1400e8a30], eax
movzx eax, cl
mov dword [0x1400e8a34], eax
mov rcx, rbx
call fcn.140046b70
jmp 0x140038b76
bt dword [rbx + 0xa24], 0xc
jae 0x140038a39
mov dword [0x1400e8a30], 0xff
mov dword [0x1400e8a34], 2
jmp 0x140038b76
movzx eax, word [rbx + 0x8f8]
shl r11d, 0x10
or eax, r11d
sub eax, 0x17aa215e
je 0x140038abe
sub eax, 0x5a
je 0x140038a8e
sub eax, 0x17bd
jne 0x140038b76
movzx eax, word [rbx + 0x8fc]
cmp ax, 0x4010
je 0x140038a75
cmp ax, 0x4012
jne 0x140038b76
mov dword [0x1400e8a30], 0xff
mov dword [0x1400e8a34], 0x71
jmp 0x140038b76
movzx eax, word [rbx + 0x8fc]
cmp ax, 0x21bd
je 0x140038aa5
cmp ax, 0x21bf
jne 0x140038b76
mov dword [0x1400e8a30], 0xff
mov dword [0x1400e8a34], 0x71
jmp 0x140038b76
movzx eax, word [rbx + 0x8fc]
cmp ax, 0x21a3
je 0x140038ae1
cmp ax, 0x21a5
je 0x140038ae1
cmp ax, 0x21ba
je 0x140038ae1
cmp ax, 0x21bc
jne 0x140038b76
mov dword [0x1400e8a30], 0xff
mov dword [0x1400e8a34], 0x71
jmp 0x140038b76
mov dword [0x1400e8a58], edi
movzx eax, byte [rbx + 0xad9]
mov dword [0x1400e8a38], eax
movzx eax, byte [rbx + 0xad8]
mov dword [0x1400e8a48], eax
movzx eax, byte [rbx + 0xadd]
mov dword [0x1400e8a3c], eax
movzx eax, byte [rbx + 0xadc]
mov dword [0x1400e8a4c], eax
movzx ecx, byte [rbx + 0xae1]
mov dword [0x1400e8a40], ecx
movzx eax, byte [rbx + 0xae0]
mov dword [0x1400e8a50], eax
movzx edx, byte [rbx + 0xae5]
mov dword [0x1400e8a44], edx
movzx eax, byte [rbx + 0xae4]
mov dword [0x1400e8a54], eax
test ecx, ecx
jne 0x140038b76
mov eax, edi
test edx, edx
cmovne eax, esi
mov dword [0x1400e8a58], eax
cmp qword [0x1400e7af8], rdi
jne 0x140038b9d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140046690]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400e7af8], rax
bt dword [rbx + 0x9ac], 0xf
jae 0x140038c90
mov dword [rsp + 0xa8], edi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARERealtekHDAudio
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140038c76
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0xa8], 2
jne 0x140038c76
mov edx, esi
mov rcx, rbx
call fcn.140047190
mov dword [rsp + 0xb8], esi
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Logoff
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
mov rcx, qword [rbx + 0x40]
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
nop
test rdi, rdi
je 0x140038c90
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rbx
call fcn.14003f6c0
cmp dword [0x1400e8dc8], 0
je 0x140038ca9
mov rcx, rbx
call fcn.14003b210
lea rcx, [0x1400e8c80]
call fcn.140037040
test eax, eax
jne 0x140038cc1
cmp dword [0x1400e8de0], eax
je 0x140038cc9
mov rcx, rbx
call fcn.14003b710
cmp dword [0x1400e8e6c], 0
je 0x140038ce0
mov dword [rbx + 0xe64], esi
mov rcx, rbx
call fcn.140047880
cmp dword [0x1400e8e70], 0
jne 0x140038cfb
cmp dword [0x1400e8e74], 0
jne 0x140038cfb
cmp dword [0x1400e8e48], 0
je 0x140038d01
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8ea0], 0
je 0x140038d24
mov qword [rbx + 0xb98], rbx
lea rdx, [rbx + 0xb90]
lea rcx, [rbx + 0x7f8]
call fcn.14002f540
cmp dword [0x1400e8e7c], 0
je 0x140038d52
lea rcx, [rbx + 0xb50]
lea rdx, [0x1400b3428]
call fcn.14005398c
mov dword [rbx + 0xe64], esi
lea rcx, [rbx + 0x7f8]
call fcn.14004c630
mov rcx, rbx
call fcn.14003adc0
cmp dword [0x1400e8e90], 0
je 0x140038d6f
lea rcx, [rbx + 0x7f8]
call fcn.1400202d0
cmp dword [rbx + 0xcb8], 0
je 0x140038d80
mov rcx, rbx
call fcn.14003a8d0
cmp dword [0x1400e8e84], 0
je 0x140038dcd
mov rcx, rbx
call fcn.14003ab50
lea rdi, [rbx + 0xea0]
cmp qword [rdi], 0
jne 0x140038dcd
mov qword [rsp + 0x20], rdi
lea r9, [0x1400ba760]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1400ba780]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140038dcd
mov edx, dword [rbx + 0x40]
call fcn.140037200
cmp dword [0x1400e8ea4], 0
je 0x140038e28
lea rcx, [rbx + 0x7f8]
call fcn.140030750
test rax, rax
je 0x140038df2
mov rdx, rax
mov rcx, rbx
call fcn.140048350
mov dword [rbx + 0xb48], esi
lea rdi, [0x1400e0690]
mov ebp, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov rdx, qword [rdi]
test rdx, rdx
je 0x140038e18
lea rcx, [rbx + 0xb50]
call fcn.14005398c
add rdi, 8
sub rbp, 1
jne 0x140038e04
mov dword [rbx + 0xe64], esi
cmp dword [0x1400e8e28], 0
je 0x140038e63
lea rcx, [rbx + 0xb50]
lea rdx, [0x1400b3038]
call fcn.14005398c
mov dword [rbx + 0xe64], esi
lea rcx, [rbx + 0x7f8]
call fcn.140030390
test rax, rax
je 0x140038e63
mov rcx, rax
call fcn.14004c3e0
cmp dword [0x1400e8e94], 0
je 0x140038e85
lea rcx, [rbx + 0xb50]
lea rdx, [0x1400b3038]
call fcn.14005398c
mov dword [rbx + 0xe64], esi
cmp dword [rbx + 0xe64], 0
je 0x140038ea8
mov qword [rbx + 0xb88], rbx
lea rcx, [rbx + 0x7f8]
lea rdx, [rbx + 0xb40]
call fcn.14002f540
mov rcx, rbx
call fcn.14003a6c0
cmp dword [0x1400e8e40], 0
je 0x140038ede
cmp qword [0x1400e7c18], 0
jne 0x140038ede
xor r8d, r8d
lea rdx, [0x1400b21d8]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_RegisterPowerSettingNotification]
mov qword [0x1400e7c18], rax
mov eax, esi
jmp 0x140038eec
mov rcx, rbx
call fcn.14003b7d0
xor eax, eax
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret