Function at 0x1009be30
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1009be44
pop esi
pop ecx
ret
mov eax, dword [esp + 0x14]
test eax, eax
push ebx
push ebp
push edi
jne 0x1009be66
push eax
push eax
push 0x10
push esi
call fcn.10067560
mov esi, esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 1
jne 0x1009bf14
push esi
call fcn.100508d0
add esp, 4
mov esi, eax
push ebx
pop ebx
push 4
push esi
call fcn.10067450
add esp, 8
mov al, al
push 5
push esi
call fcn.10067450
add esp, 8
mov eax, eax
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call fcn.10067470
add esp, 0x1c
mov dh, dh
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebp
mov dh, dh
mov ah, ah
mov cl, cl
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
mov ebp, ebp
push 0
push esi
call fcn.10067530
add esp, 8
mov ebx, eax
mov ebp, ebp
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov bh, bh
push esi
call ebp
mov esi, esi
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, edi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call fcn.10067470
add esp, 0x1c
mov edx, edx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 2
jne 0x1009bf31
push 7
push esi
call fcn.10067450
add esp, 8
mov esi, esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 3
jne 0x1009bf58
push 0
push 0xf020
push 0x112
push esi
call fcn.100674c0
add esp, 0x10
xchg ebx, eax
xchg ebx, eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 4
jne 0x1009bf75
push 3
push esi
call fcn.10067450
add esp, 8
mov dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 5
jne 0x1009bf92
push 4
push esi
call fcn.10067450
add esp, 8
mov ecx, ecx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 6
jne 0x1009bfaf
push 0
push esi
call fcn.10067450
add esp, 8
mov dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 7
jne 0x1009bfcc
push 5
push esi
call fcn.10067450
add esp, 8
mov esi, esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 8
jne 0x1009c00d
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, edi
or eax, 8
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ch, ch
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call fcn.10067470
add esp, 0x1c
mov dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 9
jne 0x1009c04e
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov al, al
and eax, 0xfffffff7
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push edx
pop edx
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call fcn.10067470
add esp, 0x1c
mov ah, ah
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xa
jne 0x1009c069
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xb
jne 0x1009c084
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xc
jne 0x1009c0fb
push esi
call fcn.100508d0
add esp, 4
mov esi, eax
mov bl, bl
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.1009bc50
add esp, 8
mov ah, ah
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebp
mov ah, ah
mov eax, eax
push edx
pop edx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
mov eax, eax
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.10067530
add esp, 8
mov ebx, eax
mov dl, dl
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push ebx
pop ebx
push esi
call ebp
mov ebp, ebp
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
nop
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xd
jne 0x1009c15a
mov dh, dh
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.10067530
add esp, 8
push edx
pop edx
mov edx, dword [esp + 0x10]
push 0
push 0
push edx
push 0
push 1
call fcn.10066f50
add esp, 0x14
mov esi, eax
mov cl, cl
test esi, esi
je 0x1009c152
push 0
push esi
call fcn.10067050
add esp, 8
mov ch, ch
push esi
call fcn.1004ac90
add esp, 4
mov eax, eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
cmp eax, 0xe
jne 0x1009c184
push esi
call fcn.100508d0
add esp, 4
mov ebx, ebx
push 0
push 0
push eax
call fcn.1009bd20
add esp, 0xc
push eax
pop eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xf
jne 0x1009c1c5
mov ah, ah
push ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
push ecx
pop ecx
push 0
push esi
call fcn.10067530
add esp, 8
mov ebx, eax
mov bl, bl
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push ebx
push edi
call ebp
mov ch, ch
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ecx
push 0
push ebx
push edi
call ebp
mov ecx, ecx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret