Function at 0x100007abc
Capabilities:
Log keystrokes via polling
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x2d0
mov rax, qword [0x100028110]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
lea rdx, [rsp + 0x50]
mov rdi, rcx
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r12d, r12d
mov r13d, 1
mov rbx, rax
cmp rax, r12
je 0x100007b54
lea edx, [r13 + 0x57]
mov rcx, rax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
lea edx, [r13 + 0x59]
mov rcx, rbx
mov dword [0x10002870c], eax
call qword [sym.imp.GDI32.dll_GetDeviceCaps]
cmp dword [0x10002870c], 0x60
mov dword [0x1000287d8], eax
jne 0x100007b42
cmp eax, 0x60
je 0x100007b49
mov dword [0x10002a3b0], r13d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [rsp + 0x58]
sub eax, dword [rsp + 0x50]
mov dword [0x10002a398], eax
mov eax, dword [rsp + 0x5c]
sub eax, dword [rsp + 0x54]
mov dword [0x10002a39c], eax
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
movzx ecx, ax
lea eax, [rcx + rcx*2]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [0x10002a3a0], eax
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
movzx eax, ax
add eax, eax
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [0x10002a3a4], eax
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
mov r11d, eax
shr r11, 0x10
movzx eax, r11w
lea eax, [rax + rax*4]
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [0x10002a3a8], eax
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
movzx eax, ax
imul eax, eax, 0xd
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [0x10002a3b4], eax
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
mov r15d, 0x330
mov r11d, eax
mov ecx, 0x10
mov qword [rsp + 0x48], r12
shr r11, 0x10
mov dword [rsp + 0x40], r15d
movzx eax, r11w
add eax, eax
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [0x10002a3b8], eax
call qword [sym.imp.USER32.dll_GetKeyState]
lea rbp, [0x10002ae80]
cmp ax, r12w
jge 0x100007c75
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r12w
jge 0x100007c75
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, r12w
jge 0x100007c75
call fcn.100012c74
xor r9d, r9d
xor edx, edx
mov r8d, 0xc3b4
mov ecx, eax
mov dword [rsp + 0x20], r12d
call fcn.100021bd0
mov ebx, r13d
jmp 0x100007d2f
lea rax, [rsp + 0x48]
lea rdx, [0x1000061a0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, r12d
mov esi, 0x80070000
cmp eax, r12d
je 0x100007cb4
movzx ebx, ax
or ebx, esi
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100007d2f
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rdx, [0x100006218]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, r12d
cmp eax, r12d
je 0x100007cf5
movzx ebx, ax
or ebx, esi
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x100007d2f
cmp dword [rsp + 0x44], 3
jne 0x100007d2a
cmp dword [rsp + 0x40], r15d
jne 0x100007d2a
mov eax, dword [0x10002a3d8]
dec eax
cmp dword [0x10002aea0], eax
jg 0x100007d2a
cmp dword [0x10002ae84], r12d
jne 0x100007d2f
cmp dword [0x10002ae8c], 3
je 0x100007d2f
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x100007d3f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
jl 0x100007d49
cmp ebx, r13d
jne 0x100007d51
mov rcx, rbp
call fcn.100007204
mov qword [0x10002a358], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
call qword [sym.imp.USER32.dll_GetThreadDesktop]
or rbx, 0xffffffffffffffff
test byte [0x10002b1a0], 4
mov qword [0x10002a360], rax
je 0x100007d9e
mov dword [rsp + 0x30], 3
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9d, 0x64
mov r8, rdi
xor edx, edx
mov ecx, 0x54000100
call qword [sym.imp.COMCTL32.dll_CreateStatusWindowW]
mov r11, rax
mov qword [0x10002a368], rax
cmp rax, r12
jne 0x100007dca
xor eax, eax
jmp 0x100008098
movd xmm0, dword [0x10002870c]
mov esi, 0x404
mov dword [rsp + 0x7c], ebx
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [0x100007020]
cvttsd2si r8d, xmm0
mov dword [rsp + 0x70], r8d
lea r9d, [r8 + r8*4]
mov eax, r9d
cdq
and edx, 3
add eax, edx
sar eax, 2
lea ecx, [r8 + rax]
mov eax, r9d
lea r9, [rsp + 0x70]
cdq
mov dword [rsp + 0x74], ecx
mov r8d, 4
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, r11
mov dword [rsp + 0x78], eax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x10002a370]
mov edx, 0x6b
call qword [sym.imp.USER32.dll_LoadIconW]
cmp rax, r12
je 0x100007e58
mov r9, rax
mov r8, r13
mov edx, 0x80
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x10002a38c]
xor r9d, r9d
xor r8d, r8d
mov edx, esi
call qword [sym.imp.USER32.dll_PostThreadMessageW]
mov rcx, qword [0x10002a368]
mov dword [rsp + 0x30], 0x1b
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov dword [rsp + 0x28], r12d
mov dword [0x10002a3ac], eax
mov dword [rsp + 0x20], r12d
call qword [sym.imp.USER32.dll_SetWindowPos]
mov edx, 0x3e8
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetDlgItem]
cmp dword [0x10002a3d8], r12d
mov esi, r12d
mov rbp, rax
lea r15, [0x10002a3e0]
jle 0x100007f76
mov rbx, r15
mov r15d, 0x104
mov rcx, qword [rbx]
mov rdx, rbp
mov r8, qword [rcx]
call qword [r8]
cmp eax, r12d
jl 0x100007f4b
mov rcx, qword [rbx]
lea rdx, [rsp + 0xb0]
mov r8, r15
mov rax, qword [rcx]
call qword [rax + 0x20]
lea rax, [rsp + 0xb0]
lea r9, [rsp + 0x80]
movsxd r8, esi
mov edx, 0x133e
mov rcx, rbp
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x80], r13d
mov dword [rsp + 0x84], r12d
mov dword [rsp + 0x88], r12d
mov dword [rsp + 0x98], r15d
mov dword [rsp + 0x9c], r12d
mov qword [rsp + 0xa0], r12
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100007f5c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add esi, r13d
add rbx, 8
cmp esi, dword [0x10002a3d8]
jl 0x100007ecb
lea r15, [0x10002a3e0]
call fcn.100007440
mov r11d, dword [0x10002aea0]
cmp r11d, r12d
jl 0x100007f9d
mov eax, dword [0x10002a3d8]
cmp r11d, eax
jge 0x100007f9d
cmp eax, 3
jne 0x100007fa7
cmp r11d, 2
jne 0x100007fa7
mov r11d, r12d
mov dword [0x10002aea0], r12d
mov rcx, qword [0x10002a358]
mov edx, 0x3e8
movsxd rbx, r11d
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
mov edx, 0x130c
call qword [sym.imp.USER32.dll_SendMessageW]
movsxd r11, dword [0x10002aea0]
mov rcx, qword [r15 + r11*8]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetClientRect]
mov r9d, dword [rsp + 0x6c]
mov r8d, dword [rsp + 0x68]
sub r9d, dword [rsp + 0x64]
sub r8d, dword [rsp + 0x60]
mov rcx, qword [0x10002a358]
xor edx, edx
call fcn.1000082a8
mov rcx, qword [0x10002a358]
xor r9d, r9d
mov edx, 0x22b
mov r8d, 0xfa0
call qword [sym.imp.USER32.dll_SetTimer]
cmp dword [0x10002b1dc], r12d
je 0x10000807c
mov al, byte [0x10002b1e0]
cmp al, 4
jae 0x100008044
cmp al, r12b
jne 0x10000807c
movabs rax, 0x8001000000000000
test qword [0x10002b1c8], rax
je 0x10000807c
mov rdx, qword [0x10002b1d0]
mov rcx, rdx
and rcx, rax
cmp rcx, rdx
jne 0x10000807c
mov rcx, qword [0x10002b1b0]
lea rdx, [0x100005dd8]
call fcn.10000b060
mov rcx, qword [0x10002a358]
xor r9d, r9d
mov edx, 0x22c
lea r8d, [r9 + 0x64]
call qword [sym.imp.USER32.dll_SetTimer]
mov eax, r13d
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.100022bc0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret