Function at 0x140001850
Capabilities:
Log keystrokes via application hook
Terminate process

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
movups xmmword [rsp + 0xe0], xmm6
pxor xmm6, xmm6
lea rax, [sym.WindowProc_HWND____unsigned_int__unsigned_long_long__long_long_]
xor ecx, ecx
mov rbp, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdi, str.FullScreenClass
movups xmmword [rsp + 0x90], xmm6
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0x98], rax
movups xmmword [rsp + 0xa0], xmm6
movups xmmword [rsp + 0xb0], xmm6
movups xmmword [rsp + 0xc0], xmm6
call rbp
lea rcx, [rsp + 0x90]
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb8], 0
call qword [sym.imp.USER32.dll_RegisterClassA]
mov rsi, qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
call rsi
mov ecx, 1
mov ebx, eax
call rsi
xor ecx, ecx
mov esi, eax
call rbp
mov dword [rsp + 0x38], esi
mov r9d, 0x90000000
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov rdx, rdi
mov ecx, pe_nt_image_headers64
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r12, rax
test rax, rax
je 0x140001ad6
mov r9d, 2
mov r8d, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xor r9d, r9d
xor r8d, r8d
mov rcx, r12
mov rdx, 0xffffffffffffffff
mov dword [rsp + 0x30], 0x40
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], ebx
call qword [sym.imp.USER32.dll_SetWindowPos]
xor ecx, ecx
mov r13, qword [sym.imp.USER32.dll_ShowCursor]
call r13
xor r9d, r9d
xor r8d, r8d
lea rdx, [sym.LowLevelKeyboardProc_int__unsigned_long_long__long_long_]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140008038], rax
test rax, rax
je 0x140001b09
mov rsi, qword [sym.imp.USER32.dll_GetMessageA]
movups xmmword [rsp + 0x60], xmm6
lea rbx, [rsp + 0x60]
mov rbp, qword [sym.imp.USER32.dll_TranslateMessage]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageA]
movups xmmword [rsp + 0x70], xmm6
movups xmmword [rsp + 0x80], xmm6
jmp 0x140001a17
cmp byte [section..data], 0
je 0x140001ac0
mov rcx, rbx
call rbp
mov rcx, rbx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jne 0x140001a00
mov rbx, qword [sym.imp.libstdc_6.dll_std::cout]
mov r8d, 0x10
lea rdx, str.CPCD_on_Windows_
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rax, qword [rbx]
mov rax, qword [rax - 0x18]
mov rsi, qword [rax + rbx + 0xf0]
test rsi, rsi
je 0x140001b04
cmp byte [rsi + 0x38], 0
je 0x140001a90
movsx edx, byte [rsi + 0x43]
mov rcx, rbx
call sym.std::ostream::put_char_
mov rcx, rax
call sym.std::ostream::flush__
nop
movups xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rcx, rsi
call sym.std::ctype_char_::_M_widen_init___const
mov rax, qword [rsi]
mov edx, 0xa
lea rcx, [method.std::ctype_char_.do_widen_char__const]
mov rax, qword [rax + 0x30]
cmp rax, rcx
je 0x140001a66
mov rcx, rsi
call rax
movsx edx, al
jmp 0x140001a66
mov ecx, 1
call r13
mov rcx, r12
call qword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x140001a28
mov r8d, 0x18
lea rdx, str.Failed_to_create_window_
mov rbx, qword [sym.imp.libstdc_6.dll_std::cerr]
mov rcx, rbx
call sym.std::basic_ostream_char__std::char_traits_char____std::__ostream_insert_char__std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const__long_long_
mov rcx, rbx
call method.std::basic_ostream_char__std::char_traits_char____std::endl_char__std.char_traits_char____std::basic_ostream_char__std::char_traits_char______clone_.isra.0_
mov ecx, 1
call sym.exit
call sym.std::__throw_bad_cast__
mov r8d, 0x1c
lea rdx, str.Failed_to_set_keyboard_hook_
jmp 0x140001ae3