Function at 0x100012920
Capabilities:
Hide graphical window
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
sub rsp, 0x270
mov rax, qword [0x100025108]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
call fcn.1000113f4
lea rbp, [0x100025288]
test eax, eax
jns 0x10001297c
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x10001297c
test byte [rcx + 0x1c], 4
je 0x10001297c
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006330]
mov edx, 0x17
mov r9d, eax
call fcn.100009850
mov rcx, rbx
call fcn.100014fb4
mov edx, 0x7f89
xor ecx, ecx
movzx r11d, ax
mov dword [0x1000261c8], r11d
call qword [sym.imp.USER32.dll_LoadCursorW]
mov qword [0x1000261c0], rax
call fcn.10000a534
call fcn.10000a354
call fcn.10000a5cc
test eax, eax
je 0x1000129c2
mov rdx, qword [rbx + 8]
mov rcx, rbx
call fcn.100013464
mov rcx, qword [rbx + 8]
xor edx, edx
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
mov rcx, rbx
call fcn.100014658
test eax, eax
jns 0x100012a03
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x100012a03
test byte [rcx + 0x1c], 4
je 0x100012a03
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006330]
mov edx, 0x18
mov r9d, eax
call fcn.100009850
mov rcx, qword [0x100026048]
lea r8, [rbx + 0x68]
mov edx, 0x3e9
mov r9d, 0x100
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x100012a61
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x100012a61
test byte [rcx + 0x1c], 4
je 0x100012a61
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
lea r8, [0x100006330]
or r9d, 0x80070000
test eax, eax
mov edx, 0x19
cmovle r9d, eax
call fcn.100009850
mov rcx, rbx
call fcn.100011708
mov rcx, qword [0x100026048]
lea r8, [rsp + 0x60]
mov r9d, 0x100
mov edx, 0x3ef
call qword [sym.imp.USER32.dll_LoadStringW]
mov rax, qword [0x100026048]
mov qword [rsp + 0x58], 0x64
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x48], 0xd1
mov qword [rsp + 0x40], rax
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x60]
lea rdx, [0x100006b18]
mov r9d, 0x5003400b
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
je 0x100012af7
mov r8, qword [0x1000261c0]
mov edx, 0xfffffff4
mov rcx, rax
call qword [sym.imp.USER32.dll_SetClassLongPtrW]
jmp 0x100012b1e
mov rcx, qword [0x100025288]
cmp rcx, rbp
je 0x100012b1e
test byte [rcx + 0x1c], 4
je 0x100012b1e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100006330]
mov edx, 0x1a
call fcn.10000a5f4
mov rcx, rbx
call fcn.1000121b4
mov rcx, qword [rbx + 8]
mov edx, 1
call qword [sym.imp.USER32.dll_ShowWindow]
mov r8, qword [0x100026048]
xor r9d, r9d
lea ecx, [r9 + 0xd]
lea rdx, [0x100013f40]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov rdx, qword [rbx + 8]
xor r9d, r9d
lea r8d, [r9 - 4]
mov ecx, 0x8002
mov qword [0x1000263e8], rax
call qword [sym.imp.USER32.dll_NotifyWinEvent]
cmp dword [0x10002679c], 0
je 0x100012bbc
mov al, byte [0x1000267a0]
cmp al, 4
jae 0x100012b84
test al, al
jne 0x100012bbc
movabs rdx, 0x8000000000000000
test qword [0x100026788], rdx
je 0x100012bbc
mov rcx, qword [0x100026790]
mov rax, rcx
and rax, rdx
cmp rax, rcx
jne 0x100012bbc
mov rcx, qword [0x100026770]
lea rdx, [0x100006128]
call fcn.100010220
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.100020bc0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rbp
ret