Function at 0x1400a2a50
Capabilities:
Log keystrokes

Disassembly:
push rbx
push rbp
push rdi
push r15
sub rsp, 0x38
mov rbx, rcx
test rcx, rcx
je 0x1400a2d4e
xor edx, edx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, dword [0x140127508]
mov r15d, eax
je 0x1400a2a89
mov rcx, rbx
call fcn.1400a46f0
test al, al
jne 0x1400a2d4e
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rbx
mov rbp, rax
call qword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1400a2aad
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
cmp rbx, rbp
jne 0x1400a2abf
mov rax, rbx
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
cmp byte [0x140125d6a], 0
jne 0x1400a2b31
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011f180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011f180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
jne 0x1400a2b10
mov rdi, rbx
mov rax, rbx
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
cmp rdi, rbp
je 0x1400a2b31
mov edx, 4
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400a2b31
test rdi, rdi
jne 0x1400a2d41
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], r12
xor r12b, r12b
mov qword [rsp + 0x78], r13
xor r13b, r13b
mov qword [rsp + 0x30], r14
test rbp, rbp
je 0x1400a2bb5
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r14d, eax
test eax, eax
je 0x1400a2bba
cmp dword [0x140127508], eax
je 0x1400a2b91
mov rcx, rbp
call fcn.1400a46f0
test al, al
jne 0x1400a2b91
mov ecx, dword [0x140127508]
mov r8d, 1
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r12b
test r15d, r15d
je 0x1400a2bba
cmp r14d, r15d
je 0x1400a2bba
mov r8d, 1
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne r13b
jmp 0x1400a2bba
mov r14d, dword [rsp + 0x60]
xor esi, esi
nop dword [rax]
movzx eax, byte [0x140125d6a]
cmp esi, eax
jne 0x1400a2bf9
cmp byte [0x140128ddd], 0
jne 0x1400a2bf9
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d450
xor r9d, r9d
mov byte [0x140128ddd], 1
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
mov byte [rsp + 0x20], r8b
lea ecx, [r8 + 1]
call fcn.14001fed0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011f180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011f180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x1400a2cf1
cmp rax, rbp
je 0x1400a2c56
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
jne 0x1400a2c56
test rdi, rdi
jne 0x1400a2cf4
inc esi
cmp esi, 5
jl 0x1400a2bc0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fed0
xor r8d, r8d
mov dword [rsp + 0x28], 0xffc3d44d
xor r9d, r9d
mov byte [rsp + 0x20], r8b
mov dl, reloc.OLEAUT32.dll_SafeArrayGetUBound
lea ecx, [r8 + 2]
call fcn.14001fed0
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, 1
mov dword [0x14011f180], 0
lea ecx, [rdx + 9]
call fcn.140001710
mov dword [0x14011f180], 1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdi, rax
cmp rax, rbx
je 0x1400a2cf1
cmp rax, rbp
je 0x1400a2ced
mov edx, 4
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindow]
cmp rbx, rax
je 0x1400a2cf4
xor edi, edi
jmp 0x1400a2cf4
mov rdi, rbx
mov rsi, qword [rsp + 0x68]
test r12b, r12b
mov r12, qword [rsp + 0x70]
je 0x1400a2d15
mov ecx, dword [0x140127508]
xor r8d, r8d
mov edx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
test r13b, r13b
mov r13, qword [rsp + 0x78]
je 0x1400a2d2e
xor r8d, r8d
mov edx, r15d
mov ecx, r14d
call qword [sym.imp.USER32.dll_AttachThreadInput]
mov r14, qword [rsp + 0x30]
test rdi, rdi
je 0x1400a2d4e
mov rcx, rbx
call qword [sym.imp.USER32.dll_BringWindowToTop]
mov rax, rdi
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret
xor eax, eax
add rsp, 0x38
pop r15
pop rdi
pop rbp
pop rbx
ret