Function at 0x1400b3820
Capabilities:
Log keystrokes via application hook

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
movzx ebp, dl
mov rdi, rcx
lea r13, [0x14023c2a0]
mov qword [rax + 0x18], r13
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rsi, qword [0x14023c290]
mov rax, qword [rsi]
mov qword [rsp + 0x28], rax
lea r12, [0x14023c288]
mov qword [rsp + 0x20], r12
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rbx, qword [rsp + 0x28]
nop
cmp rbx, rsi
je 0x1400b38b0
cmp qword [rbx + 0x10], rdi
je 0x1400b38b0
mov rbx, qword [rbx]
jmp 0x1400b38a0
cmp r12, qword [rsp + 0x20]
je 0x1400b38bc
call fcn.14011ef50
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400b38cb
cmp rax, r12
je 0x1400b38d0
call fcn.14011ef50
cmp rbx, rsi
setne al
cmp bpl, al
jne 0x1400b38eb
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
jmp 0x1400b3b12
test bpl, bpl
je 0x1400b3a30
mov r8, rdi
lea rdx, str.enable__p
lea rcx, [0x14023c268]
call fcn.140002fd0
mov rbx, qword [0x14023c290]
lea r9, [rsp + 0xf0]
mov r8, qword [rbx + 8]
mov rdx, rbx
mov rcx, r12
call fcn.1400103b0
mov r11, rax
movabs rcx, 0x1fffffffffffffff
mov rdx, qword [0x14023c298]
sub rcx, rdx
cmp rcx, 1
jae 0x1400b3a18
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
xor ebx, ebx
mov qword [rsp + 0x48], rbx
mov byte [rsp + 0x38], bl
xor r8d, r8d
lea edx, [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400048f0
lea rcx, [rsp + 0x38]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
cmovae rcx, qword [rsp + 0x38]
lea r9d, [rbx + 0x10]
lea r8, str.list_T__too_long
call fcn.14011f480
mov qword [rsp + 0x48], reloc.WS2_32.dll_recv
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + 0x10], bl
lea rcx, [rsp + 0x78]
call fcn.14011f5e0
nop
lea rax, [0x1401905b0]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0xb0], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0xa8], rbx
mov byte [rsp + 0x98], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x90]
call fcn.140005b20
nop
lea rax, [0x140190710]
mov qword [rsp + 0x78], rax
lea rdx, [0x14020b8f0]
lea rcx, [rsp + 0x78]
call fcn.14011f050
nop
add rdx, 1
mov qword [0x14023c298], rdx
mov qword [rbx + 8], rax
mov rax, qword [rax + 8]
mov qword [rax], r11
jmp 0x1400b3a56
mov r8, rdi
lea rdx, str.disable__p
lea rcx, [0x14023c268]
call fcn.140002fd0
lea rdx, [rsp + 0xf0]
mov rcx, r12
call fcn.1400b3720
cmp qword [0x14023c298], 0
jne 0x1400b3a9b
mov rbx, qword [0x14023c260]
test rbx, rbx
je 0x1400b3afb
lea rdx, str.unhook
lea rcx, [0x14023c268]
call fcn.140002fd0
mov rcx, qword [0x14023c260]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor ebx, ebx
mov qword [0x14023c260], rbx
jmp 0x1400b3afb
mov rbx, qword [0x14023c260]
test rbx, rbx
jne 0x1400b3afb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r8, rax
xor r9d, r9d
lea rdx, [0x1400b3500]
lea ecx, [rbx + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x14023c260], rax
lea rcx, str.success
lea r8, str.fail
test rax, rax
cmovne r8, rcx
lea rdx, str.hook__s
lea rcx, [0x14023c268]
call fcn.140002fd0
mov rbx, qword [0x14023c260]
test bpl, bpl
je 0x1400b3b05
test rbx, rbx
je 0x1400b3b07
mov bl, 1
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, bl
mov rbx, qword [rsp + 0xf8]
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret