Function at 0x100012950
Capabilities:
Hide graphical window
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
sub rsp, 0x270
mov rax, qword [0x100025108]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
call fcn.100011424
lea rbp, [0x100025288]
test eax, eax
jns 0x1000129ac
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x1000129ac
test byte [rcx + 0x1c], 4
je 0x1000129ac
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006360]
mov edx, 0x17
mov r9d, eax
call fcn.100009880
mov rcx, rbx
call fcn.100014fe4
mov edx, 0x7f89
xor ecx, ecx
movzx r11d, ax
mov dword [0x1000261c8], r11d
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x1000261c0], rax
call fcn.10000a564
call fcn.10000a384
call fcn.10000a5fc
test eax, eax
je 0x1000129f2
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.100013494
mov rcx, qword [rbx + 8]
xor edx, edx
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
mov rcx, rbx
call fcn.100014688
test eax, eax
jns 0x100012a33
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x100012a33
test byte [rcx + 0x1c], 4
je 0x100012a33
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006360]
mov edx, 0x18
mov r9d, eax
call fcn.100009880
mov rcx, qword [0x100026048]
lea r8, [rbx + 0x68]
mov edx, 0x3e9
mov r9d, 0x100
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x100012a91
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x100012a91
test byte [rcx + 0x1c], 4
je 0x100012a91
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
lea r8, [0x100006360]
or r9d, 0x80070000
test eax, eax
mov edx, 0x19
cmovle r9d, eax
call fcn.100009880
mov rcx, rbx
call fcn.100011738
mov rcx, qword [0x100026048]
lea r8, [rsp + 0x60]
mov r9d, 0x100
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_LoadStringW]
mov rax, qword [0x100026048]
mov qword [rsp + 0x58], 0x64
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x48], 0xd1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x60]
lea rdx, [0x100006b48]
mov r9d, 0x5003400b
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
je 0x100012b27
mov r8, qword [0x1000261c0]
mov edx, 0xfffffff4
mov rcx, rax
call qword [sym.imp.USER32.dll_SetClassLongPtrW]
jmp 0x100012b4e
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x100012b4e
test byte [rcx + 0x1c], 4
je 0x100012b4e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006360]
mov edx, 0x1a
call fcn.10000a624
mov rcx, rbx
call fcn.1000121e4
mov rcx, qword [rbx + 8]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov r8, qword [0x100026048]
xor r9d, r9d
lea ecx, [r9 + 0xd]
lea rdx, [0x100013f70]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rdx, qword [rbx + 8]
xor r9d, r9d
lea r8d, [r9 - 4]
mov ecx, 0x8002
mov qword [0x1000263e8], rax
call qword [sym.imp.USER32.dll_NotifyWinEvent]
cmp dword [0x10002679c], 0
je 0x100012bec
mov al, byte [0x1000267a0]
cmp al, 4
jae 0x100012bb4
test al, al
jne 0x100012bec
movabs rdx, 0x8000000000000000
test qword [0x100026788], rdx
je 0x100012bec
mov rcx, qword [0x100026790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100012bec
mov rcx, qword [0x100026770]
lea rdx, [0x100006158]
call fcn.100010250
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.100020bf0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rbp
ret