Function at 0x1400a5630
Capabilities:
Log keystrokes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x14022e2a0]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rsi, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [0x140252730]
call fcn.14011cbb0
test eax, eax
jne 0x1400a5d57
xorps xmm0, xmm0
movups xmmword [rsp + 0x100], xmm0
xor r14d, r14d
mov qword [rsp + 0x110], r14
mov qword [rsp + 0x118], SafeArrayGetLBound
mov byte [rsp + 0x100], r14b
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], r14
mov qword [rsp + SafeArrayGetLBound8], 0xf
mov byte [rsp + 0xe0], r14b
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + SafeArrayGetLBound0], 0xb
mov qword [rsp + 0xb8], SafeArrayGetLBound
movsd xmm0, qword [str.NglWorkflow]
movsd qword [rsp + 0xa0], xmm0
movzx eax, word [0x1401bc6c0]
mov word [rsp + 0xa8], ax
movzx eax, byte [0x1401bc6c2]
mov byte [rsp + 0xaa], al
mov byte [rsp + 0xab], r14b
lea r9, [rsp + 0x100]
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.1400e6390
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400a577e
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5779
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5d5f
call fcn.14013b70c
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0xb8], SafeArrayGetLBound
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x1400a57de
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a57d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5d65
call fcn.14013b70c
nop
mov rdx, qword [rsp + 0x118]
cmp rdx, 0x10
jb 0x1400a5821
inc rdx
mov rcx, qword [rsp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a581c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5d6b
call fcn.14013b70c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400a589d
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400a5843
lock inc dword [rbx + 8]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x80], xmm0
mov rax, qword [rcx]
lea r8, str.ActivateWindow
lea rdx, str._s:_invoked
call qword [rax + 0x28]
nop
mov rdi, 0xffffffffffffffff
test rbx, rbx
je 0x1400a58a4
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400a58a4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a58a4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400a58a4
mov rdi, 0xffffffffffffffff
lea rcx, [0x140252730]
call fcn.14011cbd4
nop
mov rbx, qword [rsp + 0x58]
test rbx, rbx
je 0x1400a58e5
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400a58e5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a58e5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400a58f3
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov rdx, qword [rsi + 0x20]
test rdx, rdx
je 0x1400a5932
mov eax, dword [rdx + 8]
test eax, eax
je 0x1400a5932
nop dword [rax]
lea ecx, [rax + 1]
lock cmpxchg dword [rdx + 8], ecx
je 0x1400a5920
test eax, eax
jne 0x1400a5910
jmp 0x1400a5932
mov rax, qword [rsi + 0x18]
mov qword [rsp + 0x60], rax
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rax + 0x18]
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov rdx, qword [rsi + 0x30]
test rdx, rdx
je 0x1400a5976
mov eax, dword [rdx + 8]
test eax, eax
je 0x1400a5976
lea ecx, [rax + 1]
lock cmpxchg dword [rdx + 8], ecx
je 0x1400a5964
test eax, eax
jne 0x1400a5954
jmp 0x1400a5976
mov rax, qword [rsi + 0x28]
mov qword [rsp + 0x70], rax
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r15d, eax
cmp esi, eax
je 0x1400a59d6
mov r8d, 1
mov edx, eax
mov ecx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov edx, r15d
mov ecx, esi
call qword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1400a59f6
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 5
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov dword [rsp + 0x30], 3
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, [r9 - 2]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetWindowPos]
nop
lea rcx, [0x140252730]
call fcn.14011cbb0
test eax, eax
jne 0x1400a5d71
xorps xmm0, xmm0
movups xmmword [rsp + 0x140], xmm0
mov qword [rsp + 0x150], r14
mov qword [rsp + 0x158], SafeArrayGetLBound
mov byte [rsp + 0x140], 0
movups xmmword [rsp + 0x120], xmm0
mov qword [rsp + 0x130], r14
mov qword [rsp + 0x138], SafeArrayGetLBound
mov byte [rsp + 0x120], 0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], SafeArrayGetLBound
mov qword [rsp + 0xd8], SafeArrayGetLBound
movsd xmm0, qword [str.NglWorkflow]
movsd qword [rsp + 0xc0], xmm0
movzx eax, word [0x1401bc6c0]
mov word [rsp + 0xc8], ax
movzx eax, byte [0x1401bc6c2]
mov byte [rsp + 0xca], al
mov byte [rsp + 0xcb], 0
lea r9, [rsp + 0x140]
lea r8, [rsp + 0x120]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.1400e6390
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x1400a5b5b
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5b56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5d79
call fcn.14013b70c
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], SafeArrayGetLBound
mov byte [rsp + 0xc0], 0
mov rdx, qword [rsp + 0x138]
cmp rdx, 0x10
jb 0x1400a5bbb
inc rdx
mov rcx, qword [rsp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5bb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5d7f
call fcn.14013b70c
nop
mov rdx, qword [rsp + 0x158]
cmp rdx, 0x10
jb 0x1400a5bfe
inc rdx
mov rcx, qword [rsp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a5bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a5d85
call fcn.14013b70c
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400a5c71
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400a5c20
lock inc dword [rbx + 8]
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x90], xmm0
mov rax, qword [rcx]
lea r8, str.ActivateWindow
lea rdx, str._s:_finished
call qword [rax + 0x28]
nop
test rbx, rbx
je 0x1400a5c71
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400a5c71
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a5c71
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x140252730]
call fcn.14011cbd4
nop
mov rbx, qword [rsp + 0x48]
test rbx, rbx
je 0x1400a5cb2
mov eax, edi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400a5cb2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a5cb2
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400a5cbb
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x1400a5cf6
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400a5cf6
mov rbx, qword [rsp + 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400a5cf6
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a5d2e
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400a5d2e
mov rbx, qword [rsp + 0x68]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1400a5d2e
mov rcx, qword [rsp + 0x68]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.14013b390
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, eax
call fcn.14011d17c
nop
call fcn.1401408a0
nop
call fcn.1401408a0
nop
call fcn.1401408a0
nop
mov ecx, eax
call fcn.14011d17c
nop
call fcn.1401408a0
nop
call fcn.1401408a0
nop
call fcn.1401408a0
int3