Function at 0x1400305b0
Capabilities:
Create thread
Log keystrokes via application hook

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov r15, rdx
mov rsi, rcx
test rdx, rdx
jne 0x140030605
lea r8, str.c:userschunyung_source_repos_rtkngui_rtknguicommon.cpp
lea edx, [r15 + 0x76]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
xor eax, eax
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [0x1403db8c8], rsi
call fcn.14005cb40
test eax, eax
jne 0x140030621
lea r8, str.c:userschunyung_source_repos_rtkngui_rtknguicommon.cpp
lea edx, [rax + 0x7c]
jmp 0x1400305e5
call fcn.1400339f0
mov dword [reloc.DSOUND.dll_DirectSoundCreate], eax
lea rbx, [rsi + 0x278]
mov rcx, rbx
call fcn.1400e2c00
lea rdx, [rbp - 0x19]
mov rcx, rbx
call fcn.1400e2900
nop
lea rcx, [rbx + 0x1d8]
mov rdx, rax
call fcn.140014890
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov r12, 0xffffffffffffffff
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003067d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor r14d, r14d
mov dword [rbp + 0x77], r14d
mov rax, qword [0x1403bee48]
test eax, eax
jg 0x1400306a8
lea r8, str.c:userschunyung_source_repos_rtkngui_rtknguidriverpropertyclient.cpp
lea edx, [r14 + 0x61]
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
jmp 0x1400306f3
movups xmm0, xmmword [0x1403292e0]
movaps xmmword [rbp - 9], xmm0
test rax, rax
jle 0x140030e4e
mov rcx, qword [0x1403bee40]
lea rax, [rbx + 0x1d0]
lea rdx, [rbp + 0x77]
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 4]
lea rdx, [rbp - 9]
mov rcx, qword [rcx]
call fcn.14005d300
mov rcx, rbx
call fcn.1400e2cc0
mov rcx, rbx
call fcn.1400e2f10
mov dword [rbp + 0x7f], r14d
mov rax, qword [0x1403bee48]
test eax, eax
jg 0x140030723
lea r8, str.c:userschunyung_source_repos_rtkngui_rtknguidriverpropertyclient.cpp
mov edx, 0x61
jmp 0x1400305e5
movups xmm0, xmmword [str._alsC]
movaps xmmword [rbp + 7], xmm0
test rax, rax
jle 0x140030e48
mov rcx, qword [0x1403bee40]
lea rdi, [rsi + 0x6c]
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1f4
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8d, [r9 + 0x19]
lea rdx, [rbp + 7]
mov rcx, qword [rcx]
call fcn.14005d300
test eax, eax
je 0x1400305f1
test dword [rsi + 0x184], 0x400
je 0x14003078a
call fcn.1400e3930
mov dword [rsi + 0x1d48], eax
lea rdx, [rsi + 0x274]
call fcn.1400311a0
test eax, eax
je 0x1400305f1
test dword [rsi + 0x274], 0x200000
je 0x1400307b8
mov dword [rsi + 0x1d38], 1
or dword [rsi + 0x70], 3
lea rcx, [rsi + 0x540]
lea r9, [rsi + 0x274]
mov rdx, rdi
call fcn.14000df10
mov ecx, 0x80
call fcn.1400f48fc
mov qword [rbp - 0x31], rax
test rax, rax
je 0x1400307ee
mov rcx, rax
call fcn.140046130
mov rcx, rax
jmp 0x1400307f1
mov rcx, r14
mov qword [rsi + 0x538], rcx
test rcx, rcx
je 0x1400305f1
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + 0x20]
test eax, eax
je 0x1400305f1
lea rcx, [r15 + 0xe8]
mov rax, qword [rcx]
lea r8, [rsi + 0x550]
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov edx, 0x10000076
call qword [rax + 0x10]
lea rcx, [rsi + 0x558]
mov rdx, rsi
call fcn.140082cc0
test eax, eax
je 0x1400305f1
mov rdx, rsi
lea rcx, [rsi + 0x1bc8]
call fcn.1400a4160
test eax, eax
je 0x1400305f1
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x140030876
mov rax, qword [rcx]
call qword [rax + 0xb0]
call fcn.1400f5f94
mov rcx, rax
test rax, rax
je 0x140030e54
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rbx, str.CplExecuted
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140014ab0
test al, al
jne 0x1400308ca
mov rax, r12
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x1400308b0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140010390
nop
call fcn.1400f5f94
mov rcx, rax
test rax, rax
je 0x140030e5f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rbx, [0x140328530]
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.140014ab0
test al, al
jne 0x14003091d
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x140030903
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x31]
call fcn.140010390
nop
movzx eax, word [rsi + 0x44c]
movzx ecx, word [rsi + 0x44e]
movzx r9d, word [rsi + 0x448]
movzx r8d, word [rsi + 0x44a]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.__X_X__X_X
lea rcx, [rbp - 0x31]
call fcn.14000dd70
mov rdi, qword [rbp - 0x31]
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rbp - 0x39]
call fcn.14001bf50
xor r9d, r9d
mov rbx, qword [rbp - 0x39]
mov r8, rbx
lea rdx, str.General
lea rcx, [0x1403dd120]
call fcn.140102880
test eax, eax
jne 0x1400309e2
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x14003099a
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, rsi
lea rcx, [rsi + 0x1bc8]
call fcn.1400a4160
test eax, eax
je 0x140030e07
mov rcx, qword [rsi + 0x538]
test rcx, rcx
je 0x1400309c6
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov r9d, 1
mov r8, rbx
lea rdx, str.General
lea rcx, [0x1403dd120]
call fcn.140102e14
mov eax, dword [rsi + 0x34]
test al, 4
je 0x1400309f1
call fcn.1400313b0
mov eax, dword [rsi + 0x34]
bt eax, 0x18
jae 0x1400309ff
mov rcx, rsi
call fcn.140034090
test dword [rsi + 0x1bc], 0x1000
je 0x140030a13
mov rcx, rsi
call fcn.1400341d0
test byte [rsi + 0x34], 0x20
je 0x140030a21
mov rcx, rsi
call fcn.140031460
test dword [rsi + 0x5c], 0x1000
je 0x140030a32
mov rcx, rsi
call fcn.140031560
mov eax, dword [rsi + 0x34]
test al, 0x40
je 0x140030a91
mov rcx, qword [rsi + 0x1d40]
test rcx, rcx
jne 0x140030a5f
lea r8, str.c:userschunyung_source_repos_rtkngui_rtknguicommon.cpp
mov edx, 0x7c3
lea rcx, str._VCpl__RETURN_TRUE_ON_FALSE:_Line___d__File___s_n
call fcn.140052e90
jmp 0x140030a70
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x140030a70
mov qword [rsi + 0x1d40], r14
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140032310]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rsi + 0x1d40], rax
mov eax, dword [rsi + 0x34]
bt eax, 0x11
jae 0x140030a9f
mov rcx, rsi
call fcn.140033b30
mov rbx, qword [rsi + 0x1bd8]
test rbx, rbx
je 0x140030b2a
nop dword [rax + rax]
mov rdx, rbx
test rbx, rbx
je 0x140030e6a
mov rbx, qword [rbx]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x140030ae2
cmp dword [rdx + 0x168], 0
je 0x140030ae2
test dword [rdx + 0x314], 0x40000
je 0x140030ae2
call fcn.140033cd0
test rbx, rbx
jne 0x140030ab0
mov rbx, qword [rsi + 0x1bd8]
test rbx, rbx
je 0x140030b2a
mov rcx, rbx
test rbx, rbx
je 0x140030e70
mov rbx, qword [rbx]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140030b25
cmp dword [rcx + 0x168], 0
je 0x140030b25
test dword [rcx + 0x318], 0x4001000
je 0x140030b25
call fcn.140018fc0
test rbx, rbx
jne 0x140030af3
test byte [rsi + 0x34], 0x40
je 0x140030b36
test byte [rsi + 0x44], 2
jne 0x140030b46
test dword [rsi + 0x184], 0x400
je 0x140030c94
cmp qword [0x1403c2f10], 0
je 0x140030b6d
lea r8, str.c:userschunyung_source_repos_rtkngui_rtkngui_beepthread.cpp
mov edx, 0x2d
lea rcx, str._VCpl__RETURN_TRUE_ON_TRUE:_Line___d__File___s_n
call fcn.140052e90
jmp 0x140030c94
mov dword [rbp - 0x29], r14d
cmp qword [0x1403c2f20], 0
jne 0x140030b92
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403c2f20], rax
cmp qword [0x1403c2f28], 0
jne 0x140030bb3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403c2f28], rax
cmp qword [0x1403c2f30], 0
jne 0x140030bd4
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403c2f30], rax
cmp qword [0x1403c2f38], 0
jne 0x140030bf5
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403c2f38], rax
cmp qword [0x1403c2f40], 0
jne 0x140030c16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403c2f40], rax
cmp qword [0x1403c2f18], 0
jne 0x140030c3c
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [0x1403c2f18], rax
test rax, rax
je 0x140030c94
call fcn.14010a950
test rax, rax
je 0x140030c5d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0xe8]
test rax, rax
je 0x140030c5d
mov rax, qword [rax + 0x40]
jmp 0x140030c60
mov rax, r14
mov qword [0x1403c3068], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r9, [0x1403c2f10]
lea r8, [0x14002ff80]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1403c2f10], rax
test byte [rsi + 0x11c], 3
je 0x140030d5f
mov rbx, qword [rsi + 0x1bd8]
nop dword [rax + rax]
test rbx, rbx
je 0x140030d5f
mov rcx, qword [rbx + 0x10]
mov rbx, qword [rbx]
test rcx, rcx
je 0x140030cb0
cmp dword [rcx + 0x168], 0
jne 0x140030cb0
cmp dword [rcx + 0x1d8], 4
jne 0x140030cb0
mov rax, qword [0x1403db8c8]
inc dword [rax + 0x1d60]
test dword [rcx + 0x30c], 0x40000
je 0x140030cb0
mov edx, 2
call fcn.1400bd170
mov r15, rax
test rax, rax
je 0x140030cb0
mov dword [rbp + 0x6f], r14d
mov r9d, 1
lea r8, [rbp + 0x6f]
lea rdx, [0x140323f10]
mov rcx, rax
call fcn.14000f150
test byte [rbp + 0x6f], 0xc
mov ecx, r14d
setne cl
mov dword [rbp - 0x21], ecx
movups xmm0, xmmword [str._alsC]
movaps xmmword [rbp + 0x17], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8d, [r9 + 0x31]
lea rdx, [rbp + 0x17]
mov rcx, qword [r15 + 0x30]
call fcn.14005c200
test byte [rsi + 0x50], 4
je 0x140030d93
mov rax, qword [rsi + 0x1bd8]
test rax, rax
je 0x140030d93
mov rcx, rax
mov rax, qword [rax]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140030d6c
cmp dword [rcx + 0x1d8], 1
jne 0x140030d6c
xor r8d, r8d
xor edx, edx
call fcn.1400198a0
mov eax, dword [rsi + 0x50]
test al, 0x20
je 0x140030da5
mov rcx, rsi
call fcn.140031660
mov eax, dword [rsi + 0x50]
test al, 0x40
je 0x140030e01
mov ecx, dword [rsi + 0x56c]
test ecx, ecx
je 0x140030ddf
lea rax, [rsi + 0x6b4]
nop word [rax + rax]
cmp dword [rax - 0x10], 0x1a
jne 0x140030dd1
cmp dword [rax], 0xffffffff
jne 0x140030dd1
cmp dword [rax + 8], 0
je 0x140030de2
inc r14d
add rax, 0xac
cmp r14d, ecx
jb 0x140030dc0
mov r14d, r12d
movsxd rax, r14d
imul rcx, rax, 0xac
test byte [rcx + rsi + 0x620], 2
je 0x140030e01
mov ecx, 0x80000041
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
mov r14d, 1
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140030e22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x140030e40
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r14d
jmp 0x1400305f3
call fcn.1400f5890
int3
call fcn.1400f5890
int3
mov ecx, 0x80004005
call fcn.14000dc70
nop
mov ecx, 0x80004005
call fcn.14000dc70
nop
call fcn.1400f5890
int3
call fcn.1400f5890
int3