Function at 0x1400014e0
Capabilities:
Log keystrokes via application hook
Read .ini file

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x1400f7080]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov rsi, r9
mov r14d, r8d
mov r13, rdx
mov r12, qword [rbp + 0x7f]
mov rbx, qword [0x1400fba90]
cmp r8d, 0x111
ja 0x14000158c
je 0x14000157c
mov eax, r8d
sub eax, 2
je 0x140001562
sub eax, 0xe
je 0x14000156f
sub eax, 1
je 0x140001a12
cmp eax, 5
jne 0x1400015bc
test r9, r9
je 0x140001a12
mov rcx, rbx
call fcn.140001cb0
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x140001a12
mov rcx, rbx
call fcn.140001cb0
jmp 0x140001a12
mov rdx, rsi
mov rcx, rbx
call fcn.140001d50
jmp 0x140001a12
cmp r14d, 0x113
je 0x140001887
cmp r14d, 0x218
je 0x140001770
cmp r14d, 0x2b1
je 0x140001740
cmp r14d, 0x8100
je 0x1400015fb
cmp r14d, dword [rbx + 0x28]
jne 0x1400015d4
lea rax, [r12 + r9]
test rax, rax
jne 0x140001a12
jmp 0x140001756
cmp r14d, dword [rbx + 0x30]
jne 0x140001a12
imul r8d, esi, 0x3e8
xor r9d, r9d
lea edx, [r9 + 0x64]
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetTimer]
jmp 0x140001a12
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, r12
sub rax, 0x202
je 0x140001698
sub rax, 3
je 0x140001632
cmp rax, 1
jne 0x140001a12
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x140001a12
call fcn.140005fb0
mov r15, rax
mov eax, dword [rax + 0x20c]
xor edi, edi
cmp eax, 0x80000000
jne 0x140001671
mov dword [r15 + 0x20c], edi
mov r9, r15
xor r8d, r8d
lea rdx, str.RMenu
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [r15 + 0x20c], eax
test eax, eax
je 0x140001a12
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 0x68
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_LoadMenuW]
mov edx, 1
jmp 0x1400016f6
call fcn.140005fb0
mov r15, rax
mov eax, dword [rax + 0x208]
xor edi, edi
test eax, eax
jns 0x1400016d6
mov dword [r15 + 0x208], edi
mov r9, r15
xor r8d, r8d
lea rdx, str.LMenu
lea rcx, str.Setting
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [r15 + 0x208], eax
test eax, eax
je 0x140001a12
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 0x68
mov rcx, qword [rbx]
call qword [sym.imp.USER32.dll_LoadMenuW]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_GetSubMenu]
mov qword [rsp + 0x30], rdi
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
mov edx, 2
mov rcx, rax
call qword [sym.imp.USER32.dll_TrackPopupMenu]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x140001a12
cmp rsi, 2
je 0x14000174c
cmp rsi, 8
jne 0x140001756
call fcn.140003320
xor edi, edi
mov dword [rax + 8], edi
mov rcx, qword [rbx + 0x20]
mov r8b, 1
xor edx, edx
mov rcx, qword [rcx + 0xb0]
call fcn.140006a20
jmp 0x140001a12
cmp rsi, 0x12
jne 0x14000185d
call fcn.140003320
mov rdi, rax
mov rax, qword [rax]
test rax, rax
je 0x140001756
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140001756
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x140001756
cmp eax, 0xffffffff
je 0x140001756
mov dword [rdi + 8], 1
lea rcx, [rbp - 0x41]
call qword [sym.imp.POWRPROF.dll_GetPwrCapabilities]
test al, al
je 0x1400017c2
cmp byte [rbp - 0x2d], 0
jne 0x140001805
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x112
mov ecx, 0xffff
mov r9d, 1
mov r8d, 0xf170
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
mov edx, 0x112
mov ecx, 0xffff
mov r9d, 2
mov r8d, 0xf170
call qword [sym.imp.USER32.dll_SendNotifyMessageW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r15, rax
cmp qword [rdi + 0x10], 0
jne 0x140001832
xor r9d, r9d
mov r8, rax
lea rdx, [0x1400033f0]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rdi + 0x10], rax
cmp qword [rdi + 0x18], 0
jne 0x140001756
xor r9d, r9d
mov r8, r15
lea rdx, [0x1400033f0]
lea ecx, [r9 + 0xe]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [rdi + 0x18], rax
jmp 0x140001756
cmp rsi, 0x8013
jne 0x140001a12
cmp dword [r12 + 0x10], 1
jb 0x140001a12
cmp byte [r12 + 0x14], 0
setne al
mov byte [rbx + 0x2c], al
jmp 0x140001a12
cmp rsi, 0x64
jne 0x140001a12
mov rdx, rsi
mov rcx, qword [rbx + 8]
call qword [sym.imp.USER32.dll_KillTimer]
cmp byte [rbx + 0x2c], 0
jne 0x1400019fc
call fcn.140003320
cmp dword [rax + 8], 0
je 0x140001a12
call fcn.140005fb0
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp - 0x71], xmm0
xor edi, edi
mov word [rsp + 0x50], di
movdqu xmmword [rbp - 0x51], xmm0
mov word [rbp - 0x61], di
lea r8d, [rsi - 0x59]
lea rdx, str.suspendMode
lea rcx, [rbp - 0x61]
call fcn.140002160
nop
lea r8, [rsp + 0x50]
lea rdx, [rbp - 0x61]
call fcn.1400059a0
test al, al
sete bl
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x140001941
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000193c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a51
call fcn.1400a508c
movdqa xmm0, xmmword [0x1400e5d00]
movdqu xmmword [rbp - 0x51], xmm0
mov word [rbp - 0x61], di
test bl, bl
je 0x14000199d
mov rdx, qword [rbp - 0x69]
cmp rdx, 8
jb 0x140001a12
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001996
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a57
call fcn.1400a508c
jmp 0x140001a12
lea rcx, [rsp + 0x50]
cmp qword [rbp - 0x69], 8
cmovae rcx, qword [rsp + 0x50]
call fcn.1400aa4ec
mov ebx, eax
cmp eax, 2
cmova ebx, edi
mov rdx, qword [rbp - 0x69]
cmp rdx, 8
jb 0x1400019f7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001a4b
call fcn.1400a508c
cmp ebx, 1
jne 0x140001a00
xor cl, cl
jmp 0x140001a07
cmp ebx, 2
jne 0x140001a12
mov cl, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.POWRPROF.dll_SetSuspendState]
mov r9, r12
mov r8, rsi
mov edx, r14d
mov rcx, r13
call qword [sym.imp.USER32.dll_DefWindowProcW]
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.1400a4a60
mov rbx, qword [rsp + 0x130]
add rsp, 0xf0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400a8f10
nop
call fcn.1400a8f10
nop
call fcn.1400a8f10
int3