Function at 0x140179620
Capabilities:
Log keystrokes via application hook

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8, qword [0x1403d4248]
mov dword [0x1403d4358], eax
test r8, r8
je 0x140179828
xor r9d, r9d
mov rbx, qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, 0xd
lea rdx, [0x140178bd0]
call rbx
xor r9d, r9d
mov r8, qword [0x1403d4248]
lea rdx, [0x1401782c0]
mov ecx, 0xe
mov qword [0x1403d4350], rax
call rbx
xor r8d, r8d
mov edx, 0x800c
mov dword [rsp + 0x30], 2
mov qword [0x1403d4348], rax
lea r9, [0x140177690]
mov ecx, 0x800c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.USER32.dll_SetWinEventHook]
cmp qword [0x1403d4350], 0
mov qword [0x1403d4340], rax
je 0x1401798d0
cmp qword [0x1403d4348], 0
je 0x1401798d0
test rax, rax
je 0x140179938
mov r9d, 0x2b3
lea r8, str.hook_run
mov ecx, 1
lea rdx, str._s___u_:_SetWindowsHookEx___successful._n
call qword [case.0x140177f95.0]
call fcn.1401773f0
mov r12, qword [sym.imp.USER32.dll_GetMessageTime]
call r12
cmp qword [0x1403d42e8], 0
mov dword [0x1403d4300], 1
mov dword [0x1403d4310], 0
cdqe
mov qword [0x1403d4308], rax
je 0x140179910
mov ecx, 1
mov dword [rsp + 0x20], 1
mov r9d, 0x36
lea r8, str.dispatch_event
lea rdx, str._s___u_:_Dispatching_event_type__u._n
call qword [case.0x140177f95.0]
lea rcx, [0x1403d4300]
call qword [0x1403d42e8]
mov rsi, qword [sym.imp.USER32.dll_GetMessageA]
mov rbp, qword [sym.imp.USER32.dll_TranslateMessage]
lea rbx, [rsp + 0x40]
mov rdi, qword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x14017979a
mov rcx, rbx
call rbp
mov rcx, rbx
call rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call rsi
test eax, eax
jg 0x140179790
xor r13d, r13d
call fcn.140179480
call r12
cmp qword [0x1403d42e8], 0
mov dword [0x1403d4300], 2
mov dword [0x1403d4310], 0
cdqe
mov qword [0x1403d4308], rax
je 0x140179898
mov r9d, 0x36
lea r8, str.dispatch_event
lea rdx, str._s___u_:_Dispatching_event_type__u._n
mov dword [rsp + 0x20], 2
mov ecx, 1
call qword [case.0x140177f95.0]
lea rcx, [0x1403d4300]
call qword [0x1403d42e8]
mov eax, r13d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r9d, 0x291
lea r8, str.hook_run
mov ecx, 2
lea rdx, str._s___u_:_hInst_was_not_set_by_DllMain__._n
call qword [case.0x140177f95.0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x1403d4248], rax
test rax, rax
je 0x140179960
call fcn.1401777c0
mov r9d, 0x31e
mov ecx, 2
lea r8, str.load_input_helper
mov dword [rsp + 0x20], eax
lea rdx, str._s___u_:_refresh_locale_list___found__i_locale_s_._n
call qword [case.0x140177f95.0]
mov r8, qword [0x1403d4248]
jmp 0x140179648
mov r9d, 0x3b
lea r8, str.dispatch_event
mov ecx, 3
lea rdx, str._s___u_:_No_dispatch_callback_set__n
call qword [case.0x140177f95.0]
mov eax, r13d
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rbx, qword [case.0x140177f95.0]
mov r13d, 0x30
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x2c7
mov ecx, 4
lea r8, str.hook_run
mov dword [rsp + 0x20], eax
lea rdx, str._s___u_:_SetWindowsHookEx___failed____lX__n
call rbx
mov r12, qword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x1401797ae
mov r9d, 0x3b
lea r8, str.dispatch_event
mov ecx, 3
lea rdx, str._s___u_:_No_dispatch_callback_set__n
call qword [case.0x140177f95.0]
jmp 0x140179771
mov r9d, 0x2af
lea r8, str.hook_run
mov ecx, 3
lea rdx, str._s___u_:_SetWinEventHook___failed__n
call qword [case.0x140177f95.0]
jmp 0x1401796e4
mov rbx, qword [case.0x140177f95.0]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 0x299
mov ecx, 4
lea r8, str.hook_run
mov dword [rsp + 0x20], eax
lea rdx, str._s___u_:_Could_not_determine_hInst_for_SetWindowsHookEx______lX__n
call rbx
mov r8, qword [0x1403d4248]
jmp 0x140179648