Function at 0x140001130
Capabilities:
Log keystrokes via application hook
Terminate process

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x118
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov esi, r9d
lea r8, [0x140005750]
mov r9d, 0x64
mov edx, 0x67
mov rdi, rcx
call qword [sym.imp.USER32.dll_LoadStringW]
lea rbp, [0x140005670]
mov r9d, 0x64
mov r8, rbp
mov edx, 0x6d
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
xor ecx, ecx
mov dword [rsp + 0x70], 0x50
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
xor ebx, ebx
mov dword [rsp + 0x74], 3
mov qword [rsp + 0xa0], rax
mov edx, 0x6b
lea rax, [0x1400016a0]
mov qword [rsp + 0x80], rbx
mov rcx, rdi
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
mov rcx, qword [rsp + 0x88]
mov edx, 0x6c
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa8], 0x6d
mov qword [rsp + 0xb0], rbp
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rsp + 0x70]
mov qword [rsp + 0xb8], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], rbx
lea r8, [0x140005750]
mov qword [rsp + 0x50], rdi
mov r9d, 0xcf0000
mov qword [rsp + 0x48], rbx
mov rdx, rbp
mov qword [rsp + 0x40], rbx
xor ecx, ecx
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rbx, rax
test rax, rax
je 0x140001638
mov qword [rsp + 0x110], r13
mov edx, esi
mov rcx, rbx
mov qword [rsp + 0x108], r14
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 0x6d
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov r14, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
movabs r13, 0xb2f4fc0794908cf3
mov rcx, rax
cmp rbx, 0x989680
jne 0x1400012dd
imul rdi, rcx, 0x64
jmp 0x140001351
cmp rbx, 0x16e3600
jne 0x140001330
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
lea rdi, [rcx + rdx]
sar rdi, 0x18
mov rax, rdi
shr rax, 0x3f
add rdi, rax
imul rax, r8, 0x3b9aca00
jmp 0x14000134e
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rdi, rax
imul rax, rcx, 0x3b9aca00
add rdi, rax
mov qword [rsp + 0x148], r12
lea rcx, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x100], r15
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140001611
movabs rbp, 0x7fffffffc46535ff
movabs rsi, 0x7fffffffffffffff
movabs r15, 0x4e94914f0000
movabs r12, 0x431bde82d7b634db
nop word [rax + rax]
mov r8, qword [0x140005738]
lea rdx, [0x1400010f0]
xor r9d, r9d
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov r8, qword [0x140005738]
lea rdx, [fcn.1400010e0]
xor r9d, r9d
mov qword [0x140005740], rax
mov ecx, 0xe
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCursorPos]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rbx, 0x989680
jne 0x14000141a
imul rbx, rcx, 0x64
jmp 0x14000148e
cmp rbx, 0x16e3600
jne 0x14000146d
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
lea rbx, [rcx + rdx]
sar rbx, 0x18
mov rax, rbx
shr rax, 0x3f
add rbx, rax
imul rax, r8, 0x3b9aca00
jmp 0x14000148b
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
lea rcx, [rsp + 0x60]
call fcn.140001000
mov rax, qword [rsp + 0x60]
cmp rax, rbp
lea rbp, [rax + 0x3b9aca00]
jl 0x1400014b0
mov rbp, rsi
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rsi, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
mov rcx, rax
cmp rsi, 0x989680
jne 0x1400014d1
imul rax, rcx, 0x64
jmp 0x140001542
cmp rsi, 0x16e3600
jne 0x140001524
mov rax, r13
imul rcx
lea r8, [rcx + rdx]
sar r8, 0x18
mov rax, r8
shr rax, 0x3f
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
mov rax, r13
imul rcx, rcx, 0x3b9aca00
imul rcx
lea rax, [rcx + rdx]
sar rax, 0x18
mov rcx, rax
shr rcx, 0x3f
add rax, rcx
imul rcx, r8, 0x3b9aca00
jmp 0x14000153f
cqo
idiv rsi
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rsi
imul rcx, rcx, 0x3b9aca00
add rax, rcx
cmp rax, rbp
jge 0x140001590
mov rcx, rbp
sub rcx, rax
cmp rcx, r15
jl 0x140001561
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x1400014b0
mov rax, r12
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140001584
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x1400014b0
sub rbx, rdi
movabs rax, 0x2540be400
cmp rbx, rax
jge 0x140001654
mov rcx, qword [rsp + 0xc0]
lea r8, [rsp + 0xc0]
mov rdx, r14
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x1400015df
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0xc0]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0xc0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
movabs rsi, 0x7fffffffffffffff
movabs rbp, 0x7fffffffc46535ff
test eax, eax
jne 0x1400013b0
mov eax, dword [rsp + 0xd0]
mov r12, qword [rsp + 0x148]
mov r15, qword [rsp + 0x100]
mov r13, qword [rsp + 0x110]
mov r14, qword [rsp + 0x108]
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.140001850
add rsp, 0x118
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8, qword [0x140005738]
lea rdx, [0x1400010f0]
xor r9d, r9d
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov r8, qword [0x140005738]
lea rdx, [fcn.1400010e0]
xor r9d, r9d
mov qword [0x140005740], rax
mov ecx, 0xe
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3