Function at 0x1400a6130
Capabilities:
Log keystrokes

Disassembly:
push rbx
push r12
push r15
sub rsp, 0x40
movzx r12d, dl
mov rbx, rcx
test rcx, rcx
je 0x1400a644a
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x14012c648]
mov r15d, eax
je 0x1400a616d
mov rcx, rbx
call fcn.1400a7c90
test al, al
jne 0x1400a644a
mov qword [rsp + 0x68], rbp
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400a619b
test r12b, r12b
jne 0x1400a619b
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x1400a61b2
mov rbp, qword [rsp + 0x68]
mov rax, rbx
add rsp, 0x40
pop r15
pop r12
pop rbx
ret
cmp byte [0x14012acae], 0
mov qword [rsp + 0x78], rdi
jne 0x1400a6221
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x1401241d0], 0
lea ecx, [rdx + 9]
call fcn.1400016f0
mov dword [0x1401241d0], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
jne 0x1400a6200
mov rdi, rbx
jmp 0x1400a6433
cmp rdi, rbp
je 0x1400a6221
mov edx, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400a6221
test rdi, rdi
jne 0x1400a6433
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x38], r13
xor r13b, r13b
mov qword [rsp + 0x30], r14
mov byte [rsp + 0x60], r13b
test rbp, rbp
je 0x1400a62a3
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x1400a62a8
cmp dword [0x14012c648], eax
je 0x1400a627e
mov rcx, rbp
call fcn.1400a7c90
test al, al
jne 0x1400a627e
mov ecx, dword [0x14012c648]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
test r15d, r15d
je 0x1400a62a8
cmp r14d, r15d
je 0x1400a62a8
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne byte [rsp + 0x60]
jmp 0x1400a62a8
mov r14d, dword [rsp + 0x60]
xor esi, esi
nop word [rax + rax]
movzx eax, byte [0x14012acae]
cmp esi, eax
jne 0x1400a62e9
cmp byte [0x14012df2e], 0
jne 0x1400a62e9
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d450
xor r9d, r9d
mov byte [0x14012df2e], 1
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov byte [rsp + 0x20], r8b
lea ecx, [r8 + 1]
call fcn.14001fac0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x1401241d0], 0
lea ecx, [rdx + 9]
call fcn.1400016f0
mov dword [0x1401241d0], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x1400a63e1
cmp rax, rbp
je 0x1400a6346
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400a6346
test rdi, rdi
jne 0x1400a63e4
inc esi
cmp esi, 5
jl 0x1400a62b0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fac0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fac0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x1401241d0], 0
lea ecx, [rdx + 9]
call fcn.1400016f0
mov dword [0x1401241d0], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x1400a63e1
cmp rax, rbp
je 0x1400a63dd
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
je 0x1400a63e4
xor edi, edi
jmp 0x1400a63e4
mov rdi, rbx
mov rsi, qword [rsp + 0x70]
test r13b, r13b
mov r13, qword [rsp + 0x38]
je 0x1400a6405
mov ecx, dword [0x14012c648]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
cmp byte [rsp + 0x60], 0
je 0x1400a641b
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x30]
test rdi, rdi
je 0x1400a6433
test r12b, r12b
jne 0x1400a6433
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rbp, qword [rsp + 0x68]
mov rax, rdi
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r12
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop r15
pop r12
pop rbx
ret