Function at 0x1400017e0
Capabilities:
Log keystrokes via application hook

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140001845
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_load_ntdll.dll
call fcn.140001c10
mov rcx, rax
lea rdx, [0x140001df0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400022d0
add rsp, 0x60
pop rbx
ret
lea rdx, str.NtSuspendProcess
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.NtResumeProcess
mov rcx, rbx
mov qword [0x140006750], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140006750], 0
mov qword [0x140006758], rax
je 0x140001953
test rax, rax
je 0x140001953
xor r9d, r9d
mov qword [rsp + 0x70], rdi
xor r8d, r8d
lea rdx, [0x140001780]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rdi, rax
test rax, rax
jne 0x1400018f8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_install_hook_
call fcn.140001c10
mov rcx, rax
lea rdx, [0x140001df0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400022d0
add rsp, 0x60
pop rbx
ret
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x14000193d
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001910
mov rcx, rdi
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x1400018e0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Failed_to_get_function_address_for_NtSuspendProcess_or_NtResumeProcess
call fcn.140001c10
mov rcx, rax
lea rdx, [0x140001df0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400022d0
add rsp, 0x60
pop rbx
ret