Function at 0x140008ef0
Capabilities:
Encrypt data using rc4 prga
Log keystrokes via polling
Query environment variable

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov edi, r9d
mov rsi, rcx
mov rcx, qword [r8 + 8]
mov bl, 1
test rcx, rcx
je 0x1400091b8
add r8, 0x10
jmp 0x140008f30
mov rcx, qword [r8]
add r8, 8
test rcx, rcx
je 0x1400091b8
movzx eax, word [rcx]
cmp eax, 0x2f
je 0x140008f50
cmp eax, 0x2d
jne 0x140008f20
lea rax, [rcx + 2]
lea r9, [rcx + 4]
cmp word [rcx + 2], 0x2d
cmove rax, r9
jmp 0x140008f57
add rcx, 2
mov rax, rcx
movzx ecx, word [rax]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x73
jne 0x140008f20
movzx ecx, word [rax + 2]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x61
jne 0x140008f20
movzx ecx, word [rax + 4]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x66
jne 0x140008f20
movzx ecx, word [rax + 6]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x65
jne 0x140008f20
movzx ecx, word [rax + 8]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x2d
jne 0x140008f20
movzx ecx, word [rax + 0xa]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x6d
jne 0x140008f20
movzx ecx, word [rax + 0xc]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x6f
jne 0x140008f20
movzx ecx, word [rax + 0xe]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x64
jne 0x140008f20
movzx ecx, word [rax + 0x10]
test cx, cx
je 0x140008f20
movzx r9d, cx
cmp r9d, 0xff
mov r9d, 0xff
cmovb r9d, ecx
lea ecx, [r9 - 0x41]
mov r10d, r9d
or r10b, 0x20
cmp cl, 0x1a
movzx ecx, r10b
cmovae ecx, r9d
cmp cl, 0x65
jne 0x140008f20
cmp word [rax + 0x12], 0
jne 0x140008f20
test dil, 1
je 0x1400091b6
mov rax, qword [r8]
mov qword [r8 - 8], rax
add r8, 8
test rax, rax
jne 0x1400091a4
dec dword [rdx]
xor ebx, ebx
test dil, 2
jne 0x1400091ce
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400091d6
test bl, bl
je 0x140009211
xor ebx, ebx
jmp 0x140009222
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400091ce
mov ecx, 0x12
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1400091ce
lea rcx, str.MOZ_DISABLE_SAFE_MODE_KEY
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x140009211
cmp byte [rax], 0
setne al
test bl, al
jne 0x1400091d2
lea rcx, str.DisableSafeMode
call fcn.1400046a0
mov ebx, eax
xor bl, 1
lea rcx, [0x1400f80c6]
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
test rax, rax
je 0x14000925b
movzx eax, byte [rax]
test al, al
movzx ecx, bl
mov ebx, 1
cmove ebx, ecx
test dil, 1
je 0x14000925b
test al, al
je 0x14000925b
lea rcx, str.MOZ_SAFE_MODE_RESTART
call sub.api_ms_win_crt_environment_l1_1_0.dll__putenv
mov bl, 1
mov byte [rsi], bl
mov byte [rsi + 1], 1
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret