Function at 0x10001a90
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x10009d82
mov eax, dword fs:[0]
push eax
sub esp, 0x4c8
mov eax, dword [0x1000d0c8]
xor eax, esp
mov dword [esp + 0x4c4], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1000d0c8]
xor eax, esp
push eax
lea eax, [esp + 0x4dc]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4ec]
sub eax, 1
mov esi, dword [esp + 0x4f0]
je 0x10001b05
sub eax, 3
jne case.0x10001b60.3
push str.RocketDock
push str.ROCKETDOCK
call dword [sym.imp.USER32.dll_FindWindowW]
push 0
push esi
push 0x43a
push eax
jmp 0x10001db6
push str.RocketDock
push str.ROCKETDOCK
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, dword [sym.imp.USER32.dll_GetPropW]
mov edi, eax
push str.ManageWindows
push edi
mov dword [esp + 0x1c], edi
call ebx
test eax, eax
je case.0x10001b60.3
push str.RD_INIT_MIN
push esi
call ebx
test eax, eax
jne case.0x10001b60.3
movzx eax, word [esp + 0x4f4]
lea ecx, [eax - 1]
cmp ecx, 0xa
mov dword [esp + 0x1c], eax
ja case.0x10001b60.3
movzx ecx, byte [ecx + 0x10001e0c]
jmp dword [ecx*4 + 0x10001e00]
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je case.0x10001b60.3
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne case.0x10001b60.3
xor ebp, ebp
xor bl, bl
mov dword [esp + 0xc4], 7
mov dword [esp + 0xc0], ebp
mov word [esp + 0xb0], bp
mov edx, dword [0x1000a1fc]
mov ax, word [0x1000a200]
push 0x202
lea ecx, [esp + 0x2da]
push ebp
push ecx
mov dword [esp + 0x4f0], ebp
mov dword [esp + 0x2dc], edx
mov word [esp + 0x2e0], ax
call fcn.10002af0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push esi
mov dword [esp + 0x20], ebp
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x18]
push eax
push ebp
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebp
je 0x10001c1d
push 0x104
lea ecx, [esp + 0x2d4]
push ecx
push ebp
push edi
call sub.PSAPI.DLL_GetModuleBaseNameW
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1000a1fc]
mov ax, word [0x1000a200]
push 0x202
lea ecx, [esp + 0xd2]
push ebp
push ecx
mov dword [esp + 0xd4], edx
mov word [esp + 0xd8], ax
call fcn.10002af0
add esp, 0xc
push 0x104
lea edx, [esp + 0xcc]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
lea eax, [esp + 0xc8]
push eax
lea ecx, [esp + 0x78]
call fcn.10001820
mov edi, eax
lea ecx, [esp + 0x2d0]
push ecx
lea ecx, [esp + 0x40]
mov byte [esp + 0x4e8], 1
call fcn.10001820
push eax
lea edx, [esp + 0x94]
push 0x1000a1ec
push edx
mov byte [esp + 0x4f0], 2
call fcn.10001860
push 0x1000a1e8
push eax
lea eax, [esp + 0x34]
push eax
mov byte [esp + 0x4fc], 3
call fcn.10001920
push edi
push eax
lea ecx, [esp + 0x78]
push ecx
mov byte [esp + 0x508], 4
call fcn.100019e0
add esp, 0x24
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0xb8]
mov byte [esp + 0x4f0], 5
call fcn.10001650
lea ecx, [esp + 0x58]
call fcn.10001410
lea ecx, [esp + 0x20]
call fcn.10001410
lea ecx, [esp + 0x90]
call fcn.10001410
lea ecx, [esp + 0x3c]
call fcn.10001410
lea ecx, [esp + 0x74]
call fcn.10001410
cmp dword [esp + 0xc4], 8
mov eax, dword [esp + 0xb0]
jae 0x10001d38
lea eax, [esp + 0xb0]
mov edx, dword [esp + 0x14]
push eax
push edx
call dword [sym.imp.USER32.dll_GetPropW]
test eax, eax
je 0x10001d4a
mov bl, 1
lea ecx, [esp + 0xac]
call fcn.10001410
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
test ax, ax
mov ebp, dword [sym.imp.USER32.dll_PostMessageW]
jns 0x10001d91
push 0x10
call edi
test ax, ax
jns case.0x10001b60.3
push 0x12
call edi
test ax, ax
jns case.0x10001b60.3
mov eax, dword [esp + 0x14]
push 0
push esi
push 0x441
push eax
call ebp
test bl, bl
sete bl
test bl, bl
jne case.0x10001b60.3
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push ecx
push esi
push 0x43b
push edx
call ebp
mov eax, 1
jmp 0x10001dd5
push eax
push esi
push 0x43b
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 0x4f4]
mov ecx, dword [esp + 0x4ec]
push eax
push esi
push ecx
push 0
call dword [sym.imp.USER32.dll_CallNextHookEx]
mov ecx, dword [esp + 0x4dc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x4c4]
xor ecx, esp
call fcn.10002ad6
add esp, 0x4d4
ret 0xc