Function at 0x140071d60
Capabilities:
Check os version
Log keystrokes via application hook

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rbp, rdx
mov rbx, rcx
test rdx, rdx
jne 0x140071d86
xor eax, eax
jmp 0x1400722f3
mov qword [0x14022c3b8], rcx
call fcn.14008a700
test eax, eax
je 0x1400722f3
mov eax, dword [0x14022c3f4]
test eax, eax
jne 0x140071dc1
mov dword [0x14022c3f0], 0x114
lea rcx, [0x14022c3f0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [0x14022c3f4]
xor esi, esi
cmp eax, 6
jne 0x140071ddc
cmp dword [0x14022c3f8], esi
jne 0x140071ddc
mov dword [reloc.DSOUND.dll_DirectSoundCreate], 1
jmp 0x140071de2
mov dword [reloc.DSOUND.dll_DirectSoundCreate], esi
lea rcx, [rbx + 0x278]
call fcn.140119320
test eax, eax
je 0x1400722f3
mov rcx, qword [0x14022c510]
test rcx, rcx
je 0x1400722f1
mov dword [rsp + 0x98], esi
lea rdx, [rsp + 0x50]
mov rax, qword [0x1401ab248]
mov qword [rdx], rax
mov rax, qword [0x1401ab250]
mov qword [rdx + 8], rax
lea r12, [rbx + 0x6c]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x1f4
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 0x19]
lea rdx, [rsp + 0x50]
call fcn.14008acf0
test eax, eax
je 0x1400722f1
bt dword [rbx + 0x184], 0xa
jae 0x140071e7a
lea rcx, [rbx + 0x278]
call fcn.14011a840
mov dword [rbx + 0x1d40], eax
lea rdi, [rbx + 0x274]
lea rcx, [rbx + 0x540]
mov r8, rdi
mov rdx, r12
call fcn.140128bd0
test rdi, rdi
je 0x1400722ed
mov rcx, rdi
call fcn.140072670
test eax, eax
je 0x1400722ed
bt dword [rdi], 0x15
jae 0x140071ec0
mov dword [rbx + 0x1d30], 1
or dword [rbx + 0x70], 3
mov ecx, 0x80
call fcn.14013c710
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140071ee1
mov rcx, rax
call fcn.14012c680
mov rcx, rax
jmp 0x140071ee4
mov rcx, rsi
mov qword [rbx + 0x538], rcx
test rcx, rcx
jne 0x140071ef7
xor eax, eax
jmp 0x1400722f3
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + 0x20]
test eax, eax
je 0x1400722f3
lea rcx, [rbp + 0xa8]
mov rax, qword [rcx]
lea r8, [rbx + 0x550]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov edx, 0x10000076
call qword [rax + 0x10]
test eax, eax
je 0x1400722f3
mov rdx, rbx
lea rcx, [rbx + 0x558]
call fcn.1400bad30
test eax, eax
je 0x1400722f3
mov rdx, rbx
lea rcx, [rbx + 0x1bc0]
call fcn.1400de720
test eax, eax
je 0x1400722f3
mov rcx, qword [rbx + 0x538]
test rcx, rcx
je 0x140071f74
mov rax, qword [rcx]
call qword [rax + 0xb0]
lea rdx, str.CplExecuted
lea rcx, [rsp + 0xa0]
call fcn.140005060
nop
lea rdx, [0x14019bd68]
lea rcx, [rsp + 0xa8]
call fcn.140005060
nop
movzx eax, word [rbx + 0x44c]
movzx ecx, word [rbx + 0x44e]
movzx r9d, word [rbx + 0x448]
movzx r8d, word [rbx + 0x44a]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str.__X_X__X_X
lea rcx, [rsp + 0xa8]
call fcn.140001df0
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xa0]
call fcn.14003f7b0
xor r9d, r9d
mov r8, qword [rsp + 0xa0]
lea rdx, str.General
lea rcx, [0x14022c580]
call fcn.14014cc50
test eax, eax
jne 0x1400720bc
mov rcx, qword [rbx + 0x538]
test rcx, rcx
je 0x140072025
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rdx, rbx
lea rcx, [rbx + 0x1bc0]
call fcn.1400de720
test eax, eax
jne 0x140072086
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14007205e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x14007207f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400722f3
mov rcx, qword [rbx + 0x538]
test rcx, rcx
je 0x14007209b
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov r9d, 1
mov r8, qword [rsp + 0xa0]
lea rdx, str.General
lea rcx, [0x14022c580]
call fcn.14014ccf0
test byte [rbx + 0x34], 4
je 0x1400720ca
mov rcx, rbx
call fcn.140072750
test byte [rbx + 0x37], 1
je 0x1400720d8
mov rcx, rbx
call fcn.140077c20
bt dword [rbx + 0x1bc], 0xc
jae 0x1400720ea
mov rcx, rbx
call fcn.140077de0
test byte [rbx + 0x34], 0x20
je 0x1400720f8
mov rcx, rbx
call fcn.1400727f0
bt dword [rbx + 0x5c], 0xc
jae 0x140072107
mov rcx, rbx
call fcn.1400728b0
test byte [rbx + 0x34], 0x40
je 0x140072148
mov rcx, qword [rbx + 0x1d38]
test rcx, rcx
je 0x14007212a
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
je 0x14007212a
mov qword [rbx + 0x1d38], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140074090]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rbx + 0x1d38], rax
bt dword [rbx + 0x34], 0x11
jae 0x140072157
mov rcx, rbx
call fcn.140076ea0
mov rdi, qword [rbx + 0x1bd0]
test rdi, rdi
je 0x14007219f
mov rdx, rdi
test rdi, rdi
je 0x140072199
mov rdi, qword [rdi]
mov rdx, qword [rdx + 0x10]
test rdx, rdx
je 0x140072192
cmp dword [rdx + 0x168], 0
je 0x140072192
bt dword [rdx + 0x314], 0x12
jae 0x140072192
mov rcx, rbx
call fcn.140077300
test rdi, rdi
jne 0x140072163
jmp 0x14007219f
call fcn.14013de24
int3
mov rdi, qword [rbx + 0x1bd0]
test rdi, rdi
je 0x1400721f1
nop
nop
mov rcx, rdi
test rdi, rdi
je 0x1400721eb
mov rdi, qword [rdi]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400721e4
cmp dword [rcx + 0x168], 0
je 0x1400721e4
mov eax, dword [rcx + 0x318]
bt eax, 0xc
jb 0x1400721df
bt eax, 0x1a
jae 0x1400721e4
call fcn.1400613b0
test rdi, rdi
jne 0x1400721b0
jmp 0x1400721f1
call fcn.14013de24
int3
test byte [rbx + 0x34], 0x40
je 0x1400721fd
test byte [rbx + 0x44], 2
jne 0x140072207
bt dword [rbx + 0x184], 0xa
jae 0x140072213
lea rcx, [0x14022d510]
call fcn.1400713f0
mov eax, dword [rbx + 0x11c]
test al, 1
jne 0x140072221
test al, 2
je 0x140072229
mov rcx, rbx
call fcn.140072a20
test byte [rbx + 0x50], 4
je 0x140072237
mov rcx, rbx
call fcn.140072b70
test byte [rbx + 0x50], 0x20
je 0x140072245
mov rcx, rbx
call fcn.140072ef0
or edi, 0xffffffff
test byte [rbx + 0x50], 0x40
je 0x1400722a0
mov ecx, dword [rbx + 0x56c]
test ecx, ecx
je 0x14007227e
lea rax, [rbx + 0x6b4]
nop
cmp dword [rax - 0x10], 0x1a
jne 0x140072271
cmp dword [rax], 0xffffffff
jne 0x140072271
cmp dword [rax + 8], 0
je 0x140072280
add esi, 1
add rax, 0xac
cmp esi, ecx
jb 0x140072260
mov esi, edi
movsxd rax, esi
imul rax, rax, 0xac
test byte [rax + rbx + 0x620], 2
je 0x1400722a0
mov ecx, 0x80000041
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x1400722c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
add edi, 0xffffffff
test edi, edi
jg 0x1400722e6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, 1
jmp 0x1400722f3
xor eax, eax
jmp 0x1400722f3
xor eax, eax
add rsp, 0x60
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret