Function at 0x14001152d
Capabilities:
Hide graphical window
Log keystrokes via application hook

Disassembly:
jmp 0x140019570
push rbp
push rdi
sub rsp, 0x298
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140030040]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x140036107]
call fcn.14001175d
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x28], 0x8050
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 1
lea rdx, str.gred.ico
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x14001961d
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_load_icon_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x14001981e
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r9, qword [rbp + 8]
xor r8d, r8d
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r9, qword [rbp + 8]
mov r8d, 1
mov edx, 0x80
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
lea rax, [0x1400111c2]
mov qword [rbp + 0x38], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x48], rax
lea rax, str.FClicker
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x50], rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_RegisterClassW]
movzx eax, ax
test eax, eax
jne 0x1400196c7
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_register_window_class_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
jmp 0x14001981e
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x48]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x12c
mov dword [rsp + 0x30], 0x190
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, str.FClicker
mov rdx, qword [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [rbp + 0x98], rax
cmp qword [rbp + 0x98], 0
jne 0x140019769
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_create_window_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x70]
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov eax, 1
jmp 0x14001981e
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140011799]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x1400304c8], rax
call fcn.14001166d
lea rax, [rbp + 0x1f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rdx, [rbp + 0x1f4]
lea rcx, [rbp + 0xb8]
call fcn.140013a70
nop
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400197e9
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0xe8]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x1400197b4
mov rcx, qword [0x1400304c8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
lea rcx, [rbp + 0xb8]
call fcn.14001100a
mov dword [rbp + 0x214], 0
lea rcx, [rbp + 0xb8]
call fcn.140011352
mov eax, dword [rbp + 0x214]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x140024210]
call fcn.14001165e
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.1400113a2
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret