Function at 0x100008694
Capabilities:
Create process on windows
Create thread
Log keystrokes via polling
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x300
mov rax, qword [0x100028110]
xor rax, rsp
mov qword [rsp + 0x2f0], rax
lea eax, [rdx - 0xea63]
xor esi, esi
mov edi, edx
mov r12, rcx
mov edx, 0xea63
mov ecx, esi
cmp eax, 0x40
ja 0x1000086dc
lea ecx, [rdi - 0xea63]
mov edi, edx
mov eax, 0x9c46
cmp edi, eax
jg 0x100008b6e
je 0x100008b1b
mov eax, 0x967
cmp edi, eax
jg 0x100008882
je 0x10000886c
cmp edi, 2
je 0x1000088de
cmp edi, 0x417
jle 0x100008f93
cmp edi, 0x41a
jle 0x10000882b
cmp edi, 0x961
je 0x100008810
cmp edi, 0x962
je 0x1000087fd
cmp edi, 0x963
je 0x1000087ea
cmp edi, 0x964
je 0x1000087ac
cmp edi, 0x965
je 0x100008791
cmp edi, 0x966
jne 0x100008f93
cmp dword [0x10002a3d8], 4
jle 0x100008f93
mov rax, qword [0x10002a400]
mov ebx, 1
mov dword [rax + 0x80], ebx
xor edx, edx
mov rcx, r12
call fcn.100007988
jmp 0x100008f93
cmp dword [0x10002aeb4], esi
mov eax, esi
sete al
mov dword [0x10002aeb4], eax
call fcn.100007440
jmp 0x100008f93
cmp dword [0x10002a3d8], 4
jle 0x100008f93
mov rax, qword [0x10002a400]
lea r9, [0x1000126cc]
mov edx, 0x969
mov r8, qword [0x10002a358]
mov rcx, qword [0x10002a370]
mov qword [rsp + 0x20], rax
call qword [sym.imp.USER32.dll_DialogBoxParamW]
jmp 0x100008f93
cmp dword [0x10002aeb0], esi
mov eax, esi
sete al
mov dword [0x10002aeb0], eax
jmp 0x1000087a2
cmp dword [0x10002aeac], esi
mov eax, esi
sete al
mov dword [0x10002aeac], eax
jmp 0x1000087a2
cmp dword [0x10002aea8], esi
mov eax, esi
sete al
mov dword [0x10002aea8], eax
call fcn.100007440
jmp 0x100008782
mov ecx, dword [0x10002aea0]
cmp ecx, esi
je 0x100008859
mov ebx, 1
cmp ecx, ebx
jne 0x100008faf
mov rcx, qword [0x10002a3e8]
xor r8d, r8d
movzx edx, di
call fcn.100017940
jmp 0x100008faf
mov rcx, qword [0x10002a3e0]
mov edx, edi
call fcn.10001cea0
jmp 0x100008faf
cmp dword [0x10002aea4], esi
mov eax, esi
sete al
mov dword [0x10002aea4], eax
jmp 0x1000087a2
cmp edi, 0x968
je 0x100008ae7
cmp edi, 0x96a
je 0x100008ad1
cmp edi, 0xc94
je 0x100008a8d
cmp edi, 0xdb3
jle 0x100008f93
cmp edi, 0xdb7
jle 0x100008a64
cmp edi, 0x755b
je 0x100008bcf
cmp edi, 0x9c41
je 0x1000088eb
cmp edi, 0x9c42
jne 0x100008f93
mov rcx, r12
call fcn.100008600
jmp 0x100008f93
mov ecx, 0x11
call qword [sym.imp.USER32.dll_GetKeyState]
cmp ax, si
jl 0x100008937
lea r8, [fcn.100008410]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
cmp rax, rsi
jne 0x100008929
xor ecx, ecx
call fcn.100008410
jmp 0x100008f93
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100008f93
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call sub.msvcrt.dll_memset
xor eax, eax
mov ebp, 0x104
lea ebx, [rax + 1]
lea rdx, [rsp + 0xe0]
lea rcx, [0x100006580]
mov r8d, ebp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rax
mov dword [rsp + 0xac], ebx
mov word [rsp + 0xb0], bx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x70], 0x68
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
jne 0x1000089f6
lea rdx, [rsp + 0xe0]
lea rcx, [0x100006598]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
jne 0x1000089f6
lea rdx, [0x1000065d0]
lea rax, [rsp + 0xe0]
lea rcx, [rsp + 0xe0]
sub rdx, rax
lea rax, [rbp + 0x7ffffefa]
cmp rax, rsi
je 0x1000089ea
movzx eax, word [rcx + rdx]
cmp ax, si
je 0x1000089ea
mov word [rcx], ax
add rcx, 2
sub rbp, rbx
jne 0x1000089c9
cmp rbp, rsi
jne 0x1000089f3
sub rcx, 2
mov word [rcx], si
lea rax, [rsp + 0x50]
lea rdx, [rsp + 0xe0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
xor ecx, ecx
mov dword [rsp + 0x28], 0x4000000
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp eax, esi
je 0x100008a52
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100008a5a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, 0xc3b5
jmp 0x100008f93
mov rcx, qword [0x10002a3f0]
mov rax, qword [rcx]
movsxd rbx, edi
call qword [rax + 0x28]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
mov edx, 0x111
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100008faf
mov ecx, dword [0x10002b1a0]
mov edx, 0x80
mov eax, ecx
not eax
and eax, edx
and eax, 0xffffff80
xor eax, ecx
and eax, edx
xor ecx, eax
mov dword [0x10002b1a0], ecx
call fcn.100007440
cmp dword [0x10002a3d8], 5
jle 0x100008f93
mov rcx, qword [0x10002a408]
mov rax, qword [rcx]
call qword [rax + 0x30]
jmp 0x100008f93
cmp dword [0x10002aebc], esi
mov eax, esi
sete al
mov dword [0x10002aebc], eax
jmp 0x1000087a2
cmp dword [0x10002aeb8], esi
mov eax, esi
sete al
mov dword [0x10002aeb8], eax
call fcn.100007440
cmp dword [0x10002a3d8], 4
jle 0x100008f93
mov rcx, qword [0x10002a400]
call fcn.100011050
jmp 0x100008f93
mov ecx, dword [0x10002b1a0]
mov dword [rsp + 0x30], 3
xor r9d, r9d
mov eax, ecx
xor r8d, r8d
mov dword [rsp + 0x28], esi
not eax
mov dword [rsp + 0x20], esi
and eax, 4
and eax, 0xfffffffc
xor eax, ecx
and eax, 4
xor ecx, eax
mov dword [0x10002b1a0], ecx
mov rdx, qword [0x10002b1a0]
mov rcx, r12
and edx, 4
shr rdx, 2
or rdx, 0xfffffffffffffffe
call qword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x1000087a2
mov eax, 0x9c78
cmp edi, eax
jg 0x100008e02
je 0x100008dc7
mov eax, 0x9c6d
cmp edi, eax
jg 0x100008cae
je 0x100008bcf
cmp edi, 0x9c47
je 0x100008c92
mov eax, 0x9c55
cmp edi, eax
je 0x100008c2f
jle 0x100008f93
cmp edi, 0x9c59
jle 0x100008bdb
cmp edi, 0x9c66
jle 0x100008f93
cmp edi, 0x9c6a
jg 0x100008f93
mov rcx, qword [0x10002a3e0]
jmp 0x100008a6b
lea eax, [rdi - 0x9c56]
xor edx, edx
movsxd rcx, eax
mov dword [0x10002ae8c], eax
lea rax, [0x1000065e8]
mov ebx, dword [rax + rcx*4]
mov rcx, qword [0x10002a358]
mov dword [0x10002ae84], ebx
call qword [sym.imp.USER32.dll_KillTimer]
cmp ebx, esi
je 0x1000087a2
mov r8d, dword [0x10002ae84]
mov rcx, qword [0x10002a358]
xor r9d, r9d
xor edx, edx
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x1000087a2
mov rcx, qword [0x10002a370]
mov edx, 0x6b
call qword [sym.imp.USER32.dll_LoadIconW]
mov rbx, rax
cmp rax, rsi
je 0x100008f93
mov rcx, qword [0x10002a370]
lea r8, [rsp + 0xe0]
mov r9d, 0x104
mov edx, 0x2713
call qword [sym.imp.USER32.dll_LoadStringW]
lea rdx, [rsp + 0xe0]
mov r9, rbx
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.SHELL32.dll_ShellAboutW]
mov rcx, rbx
call qword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x100008f93
mov ecx, dword [0x10002b1a0]
mov eax, ecx
not eax
xor eax, ecx
and eax, 1
xor ecx, eax
mov dword [0x10002b1a0], ecx
jmp 0x1000087a2
mov ecx, edi
sub ecx, 0x9c71
je 0x100008d19
sub ecx, 3
mov ebx, 1
je 0x100008cf5
cmp ecx, ebx
jne 0x100008f93
cmp dword [0x10002a3d8], 4
jle 0x100008782
cmp dword [0x10002aea0], 4
jne 0x100008782
mov rcx, qword [0x10002a400]
call fcn.100011ffc
jmp 0x100008782
cmp dword [0x10002a3d8], ebx
jle 0x100008f93
mov rax, qword [0x10002a3e8]
lea r9, [0x100019158]
mov edx, 0x79
jmp 0x1000087cc
mov edx, 6
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, esi
mov ebp, eax
jge 0x100008d3b
mov edx, 4
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebp, eax
lea rax, [rsp + 0x68]
mov ebx, 1
lea r9, [0x100006738]
lea rcx, [0x100006728]
xor edx, edx
mov r8d, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jl 0x100008db4
mov rcx, qword [rsp + 0x68]
lea rdx, [0x1000064d0]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [0x100006548]
xor r11d, r11d
mov qword [rsp + 0x58], r11
lea r9, [rsp + 0x50]
mov r8d, ebx
mov edx, 0x38f
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 2
call sub.ntdll.dll_WinSqmAddToStream
cmp ebp, esi
jl 0x100008f93
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x100008f93
mov ecx, dword [0x10002b1a0]
mov eax, ecx
not eax
and eax, 8
and eax, 0xfffffff8
xor eax, ecx
and eax, 8
xor ecx, eax
mov dword [0x10002b1a0], ecx
call fcn.100007440
cmp dword [0x10002a3d8], 3
jle 0x100008f93
mov rcx, qword [0x10002a3f8]
jmp 0x100008ac6
cmp edi, 0x9c7f
je 0x100008f85
cmp edi, 0x9c80
je 0x100008f7e
cmp edi, 0x9c81
je 0x100008f64
mov eax, 0x9ca3
cmp edi, eax
je 0x100008f38
jle 0x100008f93
cmp edi, 0x9ca5
jle 0x100008ebf
lea ebx, [rax + 0xa]
cmp edi, ebx
je 0x100008e8c
cmp edi, 0xea5f
jle 0x100008f93
cmp edi, edx
jg 0x100008f93
lea eax, [rdi + rcx - 0xea60]
mov dword [0x10002ae88], eax
call fcn.100007440
cmp dword [0x10002a3d8], 3
jle 0x100008f93
mov rcx, qword [0x10002a3f8]
call fcn.10000c508
jmp 0x100008df6
cmp dword [0x10002a3d8], 5
jle 0x100008f93
mov rcx, qword [0x10002a408]
mov rax, qword [rcx]
call qword [rax + 0x28]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
mov edx, 0x111
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x100008f93
mov ecx, dword [0x10002a3d8]
or ebp, 0xffffffff
cmp edi, 0x9ca4
lea ebx, [rbp + 2]
lea eax, [rcx - 1]
mov r12d, 0x3e8
cmove ebp, ebx
mov edx, r12d
add ebp, dword [0x10002aea0]
cmp ebp, esi
cmovl ebp, eax
cmp ebp, ecx
mov rcx, qword [0x10002a358]
cmovge ebp, esi
movsxd rbx, ebp
call qword [sym.imp.USER32.dll_GetDlgItem]
xor r9d, r9d
mov r8, rbx
mov edx, 0x130c
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [0x10002a358]
mov edx, r12d
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
call fcn.100008200
cmp eax, esi
je 0x100008f93
mov dword [0x10002aea0], ebp
jmp 0x100008f93
mov ecx, dword [0x10002b1a0]
mov eax, ecx
not eax
and eax, 0x10
and eax, 0xfffffff0
xor eax, ecx
and eax, 0x10
xor ecx, eax
mov dword [0x10002b1a0], ecx
call fcn.100007440
mov rcx, r12
call fcn.10000764c
jmp 0x100008f93
mov ecx, dword [0x10002b1a0]
mov eax, ecx
not eax
and eax, 0x20
and eax, 0xffffffe0
xor eax, ecx
and eax, 0x20
jmp 0x100008ca1
call fcn.100009030
jmp 0x100008f93
mov edx, 6
mov rcx, r12
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.100012c74
mov edx, dword [0x10002aea0]
xor r9d, r9d
mov r8d, edi
mov ecx, eax
mov dword [rsp + 0x20], esi
call fcn.100021bd0
mov rcx, qword [rsp + 0x2f0]
xor rcx, rsp
call fcn.100022bc0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret