Function at 0x140129340
Capabilities:
Log keystrokes via polling
Spoof parent pid

Disassembly:
jmp 0x140129340
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x3c0
lea rdi, [rsp + 0x50]
mov ecx, 0xdc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x3d0]
mov rax, qword [0x1405dc580]
xor rax, rsp
mov qword [rsp + 0x3b8], rax
mov dword [rsp + 0x50], 0xc0000001
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x78], 0
mov byte [rsp + 0x114], 0
cmp qword [rsp + 0x3d8], 0
je 0x1401293c1
mov rax, qword [rsp + 0x3d8]
cmp qword [rax], 0
jne 0x1401293cb
mov eax, 0xc0000001
jmp 0x140129bda
mov rax, qword [rsp + 0x3d8]
mov rcx, rax
call sym.ProcessHacker.exe_PhExpandEnvironmentStrings
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1401293fd
mov rax, qword [rsp + 0x3d8]
mov rcx, rax
call fcn.1400070e0
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
lea r9, [rsp + 0x68]
lea r8, [rsp + 0xb8]
lea rdx, [rsp + 0x88]
mov rcx, rax
call sym.ProcessHacker.exe_PhParseCommandLineFuzzy
cmp qword [rsp + 0x68], 0
je 0x140129432
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
jne 0x14012944c
lea rcx, [rsp + 0x88]
call fcn.1400070e0
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400040d0
cmp qword [rsp + 0x68], 0
je 0x14012945f
mov rax, qword [rsp + 0x68]
cmp qword [rax], 0
jne 0x14012947b
cmp qword [rsp + 0x68], 0
je 0x140129471
mov rcx, qword [rsp + 0x68]
call sym.ProcessHacker.exe_PhDereferenceObject
mov eax, 0xc0000001
jmp 0x140129bda
cmp qword [rsp + 0xb8], 0
je 0x140129498
lea rcx, [rsp + 0xb8]
call fcn.1400070e0
mov qword [rsp + 0x78], rax
lea rdx, [rsp + 0xe8]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call fcn.140003780
test eax, eax
jl 0x1401294e7
mov eax, dword [rsp + 0x108]
and eax, 0x10
test eax, eax
je 0x1401294cd
mov dword [rsp + 0x378], 1
jmp 0x1401294d8
mov dword [rsp + 0x378], 0
movzx eax, byte [rsp + 0x378]
mov byte [rsp + 0x114], al
movzx eax, byte [rsp + 0x114]
test eax, eax
jne 0x140129508
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhDoesFileExistsWin32
movzx eax, al
test eax, eax
jne 0x140129530
xor r9d, r9d
xor r8d, r8d
mov rax, qword [rsp + 0x58]
mov rdx, qword [rax + 8]
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax]
call fcn.14001a820
mov dword [rsp + 0x50], eax
jmp 0x140129ba0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf0
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
je 0x140129572
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x1401295b8
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, eax
jge 0x1401295b8
mov rcx, qword [rsp + 0x78]
call fcn.140008600
mov qword [rsp + 0x380], rax
mov rcx, qword [rsp + 0x68]
call fcn.140008600
mov r9b, 1
mov rcx, qword [rsp + 0x380]
mov r8, rcx
mov rdx, rax
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax]
call fcn.14001a820
mov dword [rsp + 0x50], eax
jmp 0x140129ba0
mov dword [rsp + 0x124], 0xffffffff
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x148], 0
mov qword [rsp + 0x238], 0
mov qword [rsp + 0x258], 0
mov qword [rsp + 0x278], 0
mov qword [rsp + 0x298], 0
mov dword [rsp + 0x2a4], 0
mov r8d, 0x70
xor edx, edx
lea rcx, [rsp + 0x1b0]
call fcn.1400139e0
mov dword [rsp + 0x1b0], 0x70
mov dword [rsp + 0x1ec], 1
mov eax, 0xa
mov word [rsp + 0x1f0], ax
xor ecx, ecx
call fcn.14001a440
mov qword [rsp + 0x138], rax
call qword [sym.imp.USER32.dll_GetShellWindow]
mov qword [rsp + 0x198], rax
cmp qword [rsp + 0x198], 0
jne 0x14012969c
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x3d0]
call fcn.14001aa40
movzx eax, al
test eax, eax
je 0x140129697
mov dword [rsp + 0x50], 0
jmp 0x140129ae1
lea rdx, [rsp + 0x124]
mov rcx, qword [rsp + 0x198]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x124], 0xffffffff
jne 0x1401296c9
mov dword [rsp + 0x50], 0xc0000001
jmp 0x140129ae1
lea rcx, [rsp + 0x300]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x1401296ed
mov dword [rsp + 0x388], 0x21000
jmp 0x1401296f8
mov dword [rsp + 0x388], 0
mov ecx, dword [rsp + 0x124]
call fcn.14000baa0
mov ecx, dword [rsp + 0x388]
bts ecx, 7
mov r8, rax
mov edx, ecx
lea rcx, [rsp + 0x148]
call fcn.140011f10
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jge 0x140129731
jmp 0x140129ae1
lea r9, [rsp + 0x238]
xor r8d, r8d
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x140129766
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140129766
call fcn.140010ff0
mov dword [rsp + 0x50], eax
jmp 0x140129ae1
mov rcx, qword [rsp + 0x238]
call sym.ProcessHacker.exe_PhAllocate
mov qword [rsp + 0x218], rax
lea r9, [rsp + 0x238]
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
test eax, eax
jne 0x1401297ab
call fcn.140010ff0
mov dword [rsp + 0x50], eax
jmp 0x140129ae1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 8
lea r9, [rsp + 0x148]
mov r8d, 0x20000
xor edx, edx
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
test eax, eax
jne 0x1401297f6
call fcn.140010ff0
mov dword [rsp + 0x50], eax
jmp 0x140129ae1
lea rcx, [rsp + 0x318]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x140129827
lea r8, [rsp + 0x258]
mov edx, 0x15
mov rcx, qword [rsp + 0x148]
call sym.ProcessHacker.exe_PhGetObjectSecurity
lea rcx, [rsp + 0x330]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x14012984b
mov dword [rsp + 0x38c], 0x20000
jmp 0x140129856
mov dword [rsp + 0x38c], 0
mov eax, dword [rsp + 0x38c]
or eax, 8
lea r8, [rsp + 0x188]
mov edx, eax
mov rcx, qword [rsp + 0x148]
call fcn.1400067b0
test eax, eax
jl 0x14012990b
lea rcx, [rsp + 0x348]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x1401298b0
lea r8, [rsp + 0x278]
mov edx, 0x15
mov rcx, qword [rsp + 0x188]
call sym.ProcessHacker.exe_PhGetObjectSecurity
call fcn.1400106c0
test rax, rax
je 0x1401298fd
call fcn.1400106c0
mov qword [rsp + 0x390], rax
xor r8d, r8d
mov rdx, qword [rsp + 0x188]
lea rcx, [rsp + 0x298]
mov rax, qword [rsp + 0x390]
call qword [0x140613010]
test eax, eax
je 0x1401298fd
mov eax, dword [rsp + 0x2a4]
or eax, 2
mov dword [rsp + 0x2a4], eax
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [rsp + 0x2a4]
or eax, 0x194
mov dword [rsp + 0x398], eax
mov rcx, qword [rsp + 0x138]
call fcn.140008600
mov qword [rsp + 0x3a0], rax
mov rcx, qword [rsp + 0x78]
call fcn.140008600
mov qword [rsp + 0x48], 0
lea rcx, [rsp + 0x168]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov ecx, dword [rsp + 0x398]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x3a0]
mov r9, rcx
mov r8, qword [rsp + 0x298]
mov rdx, rax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax + 8]
call sym.ProcessHacker.exe_PhCreateProcessWin32Ex
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jl 0x140129a7f
lea rcx, [rsp + 0x360]
call sym.ProcessHacker.exe_PhGetOwnTokenAttributes
mov eax, dword [rax + 8]
and eax, 1
test eax, eax
je 0x140129a3d
cmp qword [rsp + 0x258], 0
je 0x1401299ec
mov r8, qword [rsp + 0x258]
mov edx, 0x15
mov rcx, qword [rsp + 0x168]
call sym.ProcessHacker.exe_PhSetObjectSecurity
cmp qword [rsp + 0x278], 0
je 0x140129a3d
lea r8, [rsp + 0x188]
mov edx, 0xc0000
mov rcx, qword [rsp + 0x168]
call fcn.1400067b0
test eax, eax
jl 0x140129a3d
mov r8, qword [rsp + 0x278]
mov edx, 0x15
mov rcx, qword [rsp + 0x188]
call sym.ProcessHacker.exe_PhSetObjectSecurity
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.ntdll.dll_NtClose]
lea rdx, [rsp + 0x2b8]
mov rcx, qword [rsp + 0x168]
call fcn.14000a560
test eax, eax
jl 0x140129a61
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntdll.dll_NtResumeProcess]
mov rcx, qword [rsp + 0x168]
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x140129ae1
mov eax, dword [rsp + 0x50]
shr eax, 0x10
and eax, 0xfff
cmp eax, 7
jne 0x140129ae1
mov eax, dword [rsp + 0x50]
and eax, 0xffff
cmp eax, 0x2e4
jne 0x140129ae1
mov rcx, qword [rsp + 0x78]
call fcn.140008600
mov qword [rsp + 0x3a8], rax
mov rcx, qword [rsp + 0x68]
call fcn.140008600
mov r9b, 1
mov rcx, qword [rsp + 0x3a8]
mov r8, rcx
mov rdx, rax
mov rax, qword [rsp + 0x3d0]
mov rcx, qword [rax]
call fcn.14001a820
mov dword [rsp + 0x50], eax
cmp qword [rsp + 0x298], 0
je 0x140129b19
call fcn.14000c360
test rax, rax
je 0x140129b19
call fcn.14000c360
mov qword [rsp + 0x3b0], rax
mov rcx, qword [rsp + 0x298]
mov rax, qword [rsp + 0x3b0]
call qword [0x140613010]
cmp qword [rsp + 0x278], 0
je 0x140129b31
mov rcx, qword [rsp + 0x278]
call sym.ProcessHacker.exe_PhFree
cmp qword [rsp + 0x258], 0
je 0x140129b49
mov rcx, qword [rsp + 0x258]
call sym.ProcessHacker.exe_PhFree
cmp qword [rsp + 0x218], 0
je 0x140129b6f
mov rcx, qword [rsp + 0x218]
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
mov rcx, qword [rsp + 0x218]
call sym.ProcessHacker.exe_PhFree
cmp qword [rsp + 0x148], 0
je 0x140129b88
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.ntdll.dll_NtClose]
cmp qword [rsp + 0x138], 0
je 0x140129ba0
mov rcx, qword [rsp + 0x138]
call sym.ProcessHacker.exe_PhDereferenceObject
cmp qword [rsp + 0x68], 0
je 0x140129bb2
mov rcx, qword [rsp + 0x68]
call sym.ProcessHacker.exe_PhDereferenceObject
cmp qword [rsp + 0x78], 0
je 0x140129bc4
mov rcx, qword [rsp + 0x78]
call sym.ProcessHacker.exe_PhDereferenceObject
cmp qword [rsp + 0x58], 0
je 0x140129bd6
mov rcx, qword [rsp + 0x58]
call sym.ProcessHacker.exe_PhDereferenceObject
mov eax, dword [rsp + 0x50]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x1404ca020]
call fcn.140015750
mov rax, rdi
mov rcx, qword [rsp + 0x3b8]
xor rcx, rsp
call fcn.14000d430
add rsp, 0x3c0
pop rdi
ret