Function at 0x100da87c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
cmp dword [ebx + 4], 0x20a
jne 0x100da8dc
mov eax, dword [esi + 0x80]
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x100da8dc
push edi
push edi
push 0x157
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x100da8dc
mov eax, dword [esi + 0x80]
push dword [ebx + 0xc]
mov eax, dword [eax + 0xb8]
push dword [ebx + 8]
push dword [ebx + 4]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
inc eax
jmp 0x100dab3a
cmp dword [ebx + 4], 0x100
jne 0x100dab32
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x100da9e3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x100da9e3
mov eax, dword [esi + 0x80]
mov ecx, dword [eax + 0xb8]
test ecx, ecx
je 0x100da9e3
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x100da95b
cmp eax, 0x20
jbe 0x100da9e3
cmp eax, 0x24
jbe 0x100da943
cmp eax, 0x26
je 0x100da943
cmp eax, 0x28
jne 0x100da9e3
push edi
push edi
push 0x157
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x100da9e3
mov ecx, esi
call fcn.1007223b
mov eax, dword [esi + 0x80]
push edi
push edi
push 0x157
mov eax, dword [eax + 0xb8]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
mov eax, dword [esi + 0x80]
jne 0x100da8bc
mov ecx, dword [eax + 0xb8]
call fcn.1006d2a2
test eax, eax
je 0x100da8d4
mov eax, dword [esi + 0x80]
mov ecx, esi
add eax, 0xbc
push eax
call fcn.1006d5b5
mov eax, dword [esi + 0x80]
mov ecx, dword [eax + 0xb8]
test ecx, ecx
je 0x100da9c5
mov edi, dword [ecx + 0x20]
movzx esi, word [eax + 0x20]
call fcn.1006d2a2
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x100da8d4
mov eax, dword [ebx + 8]
sub eax, 9
je 0x100daafb
sub eax, 0x12
je 0x100daac7
sub eax, 0xb
je 0x100daa07
dec eax
sub eax, 1
jne 0x100dab32
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x100dab32
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x100dab32
mov eax, dword [esi + 0x80]
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x100dab32
push edi
push edi
push 0x157
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x100da8d4
mov eax, dword [esi + 0x80]
push edi
push 1
push 0x14f
mov eax, dword [eax + 0xb8]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x80]
mov eax, dword [eax + 0xb8]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.1006d056
test eax, eax
je 0x100da8d4
mov eax, dword [esi + 0x80]
lea esi, [eax + 0x94]
mov eax, dword [eax + 0xb8]
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.1006d056
push 1
push esi
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x100da8d4
mov eax, dword [esi + 0x80]
mov eax, dword [eax + 0xb8]
test eax, eax
je 0x100daae7
push edi
push edi
push 0x14f
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
call fcn.1006d4a6
test eax, eax
je 0x100dab32
mov ecx, esi
call fcn.1006d4a6
jmp 0x100dab26
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.1006d056
test eax, eax
je 0x100dab32
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.1006d056
push edi
push esi
mov ecx, eax
call fcn.10078795
mov ecx, eax
call fcn.1007223b
jmp 0x100da8d4
push ebx
mov ecx, esi
call fcn.1006f416
pop edi
pop esi
pop ebx
pop ebp
ret 4