Function at 0x100d64a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x100d64ea
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x100d64ea
call fcn.100d5d2c
test eax, eax
je 0x100d64ea
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.1000c2a9
xor eax, eax
inc eax
jmp 0x100d6702
cmp dword [ebx + 4], 0x100
push edi
jne 0x100d66f9
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x100d65e7
push 0x11
call edi
test ax, ax
jl 0x100d65e7
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x100d65e7
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x100d655a
cmp eax, 0x20
jbe 0x100d65e7
cmp eax, 0x24
jbe 0x100d654d
cmp eax, 0x26
je 0x100d654d
cmp eax, 0x28
jne 0x100d65e7
call fcn.100d5d2c
test eax, eax
je 0x100d65e7
mov ecx, esi
call fcn.1000e630
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.100d5d2c
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x100d658f
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.1000c2a9
jmp 0x100d66f4
call fcn.1001306b
test eax, eax
je 0x100d66f4
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.100130a3
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x100d65bd
xor edi, edi
jmp 0x100d65c0
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.1001306b
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x100d66f4
mov eax, dword [ebx + 8]
sub eax, 9
je 0x100d66c3
sub eax, 0x12
je 0x100d669b
sub eax, 0xb
je 0x100d6609
dec eax
dec eax
jne 0x100d66f9
push 0x12
call edi
test ax, ax
jl 0x100d66f9
push 0x11
call edi
test ax, ax
jl 0x100d66f9
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x100d66f9
call fcn.100d5d2c
test eax, eax
jne 0x100d66f4
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.100d5ca6
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.10011d03
test eax, eax
je 0x100d66f4
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.10011d03
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x100d66f4
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x100d66af
push 0
call fcn.100d5ca6
mov ecx, esi
call fcn.100127ee
test eax, eax
je 0x100d66f9
mov ecx, esi
call fcn.100127ee
jmp 0x100d66ed
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.10011d03
test eax, eax
je 0x100d66f9
push dword [esi + 0x20]
call edi
push eax
call fcn.10011d03
push 0
push esi
mov ecx, eax
call fcn.10018020
mov ecx, eax
call fcn.1000e630
xor eax, eax
inc eax
jmp 0x100d6701
push ebx
mov ecx, esi
call fcn.1000fc63
pop edi
pop esi
pop ebx
pop ebp
ret 4