Function at 0x100974c0
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100974d4
pop esi
pop ecx
ret
mov eax, dword [esp + 0x14]
test eax, eax
push ebx
push ebp
push edi
jne 0x100974f6
push eax
push eax
push 0x10
push esi
call fcn.10064ee0
mov dh, dh
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 1
jne 0x100975a4
push esi
call fcn.1004ea50
add esp, 4
mov esi, eax
mov bh, bh
push 4
push esi
call fcn.10064dd0
add esp, 8
mov cl, cl
push 5
push esi
call fcn.10064dd0
add esp, 8
mov ch, ch
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call fcn.10064df0
add esp, 0x1c
mov edx, edx
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebp
mov edx, edx
test edx, edx
test edx, edx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
test bh, bh
push 0
push esi
call fcn.10064eb0
add esp, 8
mov ebx, eax
test edi, edi
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ah, ah
push esi
call ebp
mov ecx, ecx
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test al, al
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call fcn.10064df0
add esp, 0x1c
mov eax, eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 2
jne 0x100975c1
push 7
push esi
call fcn.10064dd0
add esp, 8
push edx
pop edx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 3
jne 0x100975e8
push 0
push 0xf020
push 0x112
push esi
call fcn.10064e40
add esp, 0x10
mov edi, edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 4
jne 0x10097605
push 3
push esi
call fcn.10064dd0
add esp, 8
test edi, edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 5
jne 0x10097622
push 4
push esi
call fcn.10064dd0
add esp, 8
mov dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 6
jne 0x1009763f
push 0
push esi
call fcn.10064dd0
add esp, 8
push eax
pop eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 7
jne 0x1009765c
push 5
push esi
call fcn.10064dd0
add esp, 8
test bl, bl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 8
jne 0x1009769d
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, edi
or eax, 8
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov dh, dh
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call fcn.10064df0
add esp, 0x1c
mov ch, ch
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 9
jne 0x100976dd
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test ah, ah
and eax, 0xfffffff7
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
nop
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call fcn.10064df0
add esp, 0x1c
mov dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xa
jne 0x100976f8
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
test ecx, ecx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xb
jne 0x10097713
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, ecx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xc
jne 0x1009778e
push esi
call fcn.1004ea50
add esp, 4
mov esi, eax
mov bh, bh
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.100972e0
add esp, 8
test edx, edx
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebp
mov ebp, ebp
mov esi, esi
push eax
pop eax
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
test al, al
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.10064eb0
add esp, 8
mov ebx, eax
mov ch, ch
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test bh, bh
push esi
call ebp
test eax, 0x1807
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ebx, ebx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xd
jne 0x100977f3
test eax, 0x349e
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.10064eb0
add esp, 8
test eax, 0x2edb
mov edx, dword [esp + 0x10]
push 0
push 0
push edx
push 0
push 1
call fcn.100648d0
add esp, 0x14
mov esi, eax
xchg ebx, eax
xchg ebx, eax
test esi, esi
je 0x100977eb
push 0
push esi
call fcn.100649d0
add esp, 8
mov ah, ah
push esi
call fcn.100486c0
add esp, 4
test edx, edx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
cmp eax, 0xe
jne 0x1009781d
push esi
call fcn.1004ea50
add esp, 4
mov edi, edi
push 0
push 0
push eax
call fcn.100973b0
add esp, 0xc
mov cl, cl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xf
jne 0x10097864
test dh, dh
test eax, 0x4dfc
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
test esi, esi
push 0
push esi
call fcn.10064eb0
add esp, 8
mov ebx, eax
test esi, esi
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push ebx
push edi
call ebp
test eax, 0x4a66
push esi
call dword [sym.imp.USER32.dll_SetFocus]
test eax, eax
push 0
push ebx
push edi
call ebp
mov ebx, ebx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret