Function at 0x140001b90
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14000a010]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r15d, ecx
mov dword [rsp + 0x20], ecx
lea rcx, str.ntdll.dll
mov rsi, r9
mov rdi, r8
mov r12d, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140001fcf
xor eax, eax
mov dword [rsp + 0x70], r15d
mov qword [rsp + 0x40], rax
lea rcx, [rbp - 0x78]
mov dword [rsp + 0x74], eax
xor edx, edx
lea rax, [rsp + 0x40]
mov dword [rbp - 0x80], 0x1000
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x70]
mov qword [rbp - 0x70], rax
mov rax, qword [0x14000a948]
mov dword [rbp - 0x7c], 0x40
mov dword [rbp - 0x78], 0x92b
mov dword [rbp - 0x74], 0x149
call qword [rax]
mov r13, qword [rsp + 0x40]
test r13, r13
je 0x140001fcf
mov edx, 0x74
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rdx - 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x14000a050]
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x28], rax
lea r14, [rcx + 0x5c]
mov qword [rsp + 0x60], rcx
movups xmmword [rax], xmm0
mov dword [rsp + 0x54], 0
movaps xmm1, xmmword [0x14000a060]
movups xmmword [rax + 0x10], xmm1
mov dword [rsp + 0x50], r15d
movaps xmm0, xmmword [0x14000a070]
movups xmmword [rax + 0x20], xmm0
mov qword [rsp + 0x58], r13
movaps xmm1, xmmword [0x14000a080]
movups xmmword [rax + 0x30], xmm1
mov qword [rsp + 0x68], 0x74
movaps xmm0, xmmword [str.D__H]
movups xmmword [rax + 0x40], xmm0
mov dword [rsp + 0x30], 0x92b
movsd xmm0, qword [0x14000a0a0]
movsd qword [rax + 0x50], xmm0
mov eax, dword [0x14000a0a8]
mov dword [rcx + 0x58], eax
lea rax, [r13 + 0x5c]
mov qword [rcx + 6], rax
lea rcx, [rsp + 0x30]
mov qword [r14 + 0x10], rdi
mov eax, dword [rsi + 0x28]
add rax, rdi
mov dword [rsp + 0x34], 0x139
mov qword [r14 + 8], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [0x14000a948]
mov r8, qword [rax]
call r8
cmp rax, 0x91a
jne 0x140001fcf
mov r9d, r12d
mov r8, rbx
mov rdx, r13
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [r14], 2
mov qword [rsp + 0x40], rax
je 0x140001ef3
movaps xmmword [rsp + 0x130], xmm6
movabs rdi, 0x7fffffffffffffff
movsd xmm6, qword [0x140006710]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r12d
movabs rsi, 0x7fffffffff67697e
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140001d99
imul rax, rax, 0x64
jmp 0x140001db7
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, rsi
jg 0x140001dc3
lea rdi, [rax + 0x989680]
movabs rsi, 0x311cdad160000
movabs r15, 0x112e0be826d694b3
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140001df5
imul rbx, rax, 0x64
jmp 0x140001e16
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rdi, rbx
je 0x140001e7f
jl 0x140001e7f
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
jbe 0x140001e44
mov rax, rsi
lea r8, [rcx + rsi]
jmp 0x140001e48
lea r8, [rcx + rax]
add rcx, rax
mov rax, r15
imul rcx
lea rcx, [rbp - 0x78]
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rbp - 0x78], rdx
sub r8d, eax
mov dword [rbp - 0x70], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x140001dd7
mov r15d, dword [rsp + 0x20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rsi, [r13 + 0x5c]
mov rax, qword [0x14000a948]
lea rcx, [rsp + 0x30]
xor ebx, ebx
mov dword [rsp + 0x50], r15d
xor edx, edx
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 0x18
mov dword [rsp + 0x30], 0x92b
mov dword [rsp + 0x34], 0x129
call qword [rax]
cmp dword [r14], 2
movabs rdi, 0x7fffffffffffffff
jne 0x140001d60
movaps xmm6, xmmword [rsp + 0x130]
mov rax, qword [rsp + 0x40]
jmp 0x140001ef5
xor ebx, ebx
mov rcx, rax
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
xorps xmm0, xmm0
mov dword [rsp + 0x54], ebx
xor eax, eax
mov dword [rsp + 0x50], r15d
mov dword [rbp + 0x10], eax
lea rcx, [rsp + 0x30]
lea rax, [rbp - 0x60]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], rax
xor edx, edx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x68], 0x74
mov qword [rsp + 0x38], rax
mov rax, qword [0x14000a948]
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x30], 0x92b
movups xmmword [rbp - 0x50], xmm0
mov dword [rsp + 0x34], 0x139
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov r8, qword [rax]
call r8
cmp rax, 0x91a
jne 0x140001fcf
lea rax, [rbp - 0x78]
mov dword [rbp - 0x74], ebx
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
mov rax, qword [0x14000a948]
xor edx, edx
mov dword [rbp - 0x78], r15d
mov qword [rbp - 0x70], r13
mov dword [rsp + 0x40], 0x92b
mov r8, qword [rax]
mov dword [rsp + 0x44], 0x132
call r8
cmp rax, 0x91a
jne 0x140001fcf
mov rcx, qword [rsp + 0x28]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov al, 1
jmp 0x140001fd1
xor al, al
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1400040a0
mov rbx, qword [rsp + 0x190]
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret