The whole reason TLS exists is to protect you from someone who controls your router, classically in an internet cafe. If TLS doesn't protect you from that, TLS has no reason to exist and web browsers like Chrome have no reason to behave any differently between http and https sites.
TLS does protect you. But! Someone in control of your router can do a lot of bad stuff, classically they would intercept an unauthenticated download of an executable, for example a software update, and replace it with a backdoored one, and then when they have their code running on your computer with the permissions of that software, probably with access to all your user's files, they will continue the attack and TLS won't matter. TLS is necessary for security, but it's not sufficient.
Modern TLS doesn't support it, but old TLS had "RSA cipher suites" (
TLS_RSA_with_...), which are cipher suites that don't provide Perfect Forward Secrecy, don't use any kind of Diffie Hellman key exchange, and use RSA encryption for key agreement instead. To decrypt traffic of connections established using RSA cipher suites you need the private key for the server's certificate. Unless it's your own server, you're not going to get it.
Modern TLS only supports cipher suites that provide PFS (in practice, always using ECDHE). Traffic in connections using these cipher suites is protected by a per-connection key, and so to decrypt it you need someone who knows the per-connection key to tell it to you. Unless you control the server, the server is not going to give you the per-connection key, so usually people get the client (e.g. a web browser) to log the per-connections keys. People can do that because they control those programs that run on their own devices. When using
SSLKEYLOGFILE, Chrome will log all the info needed to decrypt the traffic later, regardless of the cipher suite, that's why internally that file has different formats for different cipher suites.
Again, without the keys either from the server or from the client, you can't decrypt a recorded TLS connection (which is the point of TLS).
Chrome won't write a
SSLKEYLOGFILE by default. It will only do that if the user runs chrome with the right options. If the attacker can make Chrome on your computer run with
SSLKEYLOGFILE, they can probably also replace Chrome with a backdoored browser of their choice that looks like Chrome but secretly reports everything you do and type to the attacker, without sniffing TLS.
If your endpoint is completely compromised, transport security won't help you at all.
I don't understand your focus on the details of TLS decryption. Either your computer was compromised, or it wasn't. If it was, everything it had access to is compromised, and if it wasn't, only plain http traffic was sniffed and potentially replaced by the attacker.
Want to be safer? Assuming you don't have a backup from before the breach, make Chrome export your passwords and bookmarks (or sync them to google cloud) to a file, boot from a USB thumbdrive, backup documents (not executable programs), format the PC and install a clean OS, then install all the apps and restore documents from the backup. Use something like google apps to process document files if they could have been tampered with. Make sure someone didn't configure your email to copy everything to a different account, etc. Good recommendations for all this are not under the
tls tag, but I'm sure you can find them.