Function at 0x100291ef
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1003a68a
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x1b8]
push edi
call fcn.1002a8f0
test eax, eax
je case.0x1002932a.20
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov ebx, dword [sym.imp.user32.dll_GetKeyState]
xor edi, edi
push 0x12
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], edi
call ebx
test ah, 0x80
je 0x100291c3
push 0x11
call ebx
test ah, 0x80
je 0x100291c3
mov edx, dword [esi + 0xb0]
mov eax, dword [esi + 0xb8]
dec edx
dec eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
mov edx, dword [esi]
lea eax, [esp + 0x28]
push 0x100451e4
push eax
mov ecx, esi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
call dword [edx + 0xc4]
cmp eax, edi
je 0x100299ed
mov ecx, eax
call sub.mfc42u.dll_COleDataSource::SetClipboard
jmp 0x100299ed
push 0x11
call ebx
test ah, 0x80
je case.0x100291e8.50
mov ecx, dword [esp + 0x50]
lea eax, [ecx - 0x2d]
cmp eax, 0x2b
ja case.0x100291e8.50
xor edx, edx
mov dl, byte [eax + 0x10029a1c]
jmp dword [edx*4 + 0x10029a04]
call sub.mfc42u.dll_AfxGetThread
mov ebp, dword [eax + 0x20]
call sub.mfc42u.dll_AfxGetModuleState
mov ecx, dword [eax + 4]
call sub.mfc42u.dll_CWinApp::GetFirstDocTemplatePosition
mov dword [esp + 0x14], eax
call sub.mfc42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call sub.mfc42u.dll_CWinApp::GetNextDocTemplate
cmp dword [esp + 0x14], edi
jne 0x1002926d
push 0x6c
call sub.mfc42u.dll_operatornew
add esp, 4
mov dword [esp + 0x18], eax
cmp eax, edi
mov dword [esp + 0x48], edi
je 0x10029253
mov edx, dword [sym.imp.mfc42u.dll_CRuntimeClassconstCFrameWnd::classCFrameWnd]
push 0x1003db40
push edx
push edi
push 0xad
mov ecx, eax
call sub.mfc42u.dll_CSingleDocTemplate::CSingleDocTemplate
mov edi, eax
mov dword [esp + 0x48], 0xffffffff
call sub.mfc42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
push edi
mov ecx, eax
call sub.mfc42u.dll_CWinApp::AddDocTemplate
jmp 0x10029283
call sub.mfc42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
lea ecx, [esp + 0x14]
push ecx
mov ecx, eax
call sub.mfc42u.dll_CWinApp::GetNextDocTemplate
mov edi, eax
mov edx, dword [edi]
push 0
push 0
mov ecx, edi
call dword [edx + 0x78]
mov ebx, eax
mov eax, dword [edi]
push 1
push 0
push ebx
mov ecx, edi
call dword [eax + 0x7c]
mov ecx, ebx
call sub.mfc42u.dll_CFrameWnd::GetActiveView
mov dword [0x10045500], esi
mov edx, dword [eax]
mov ecx, eax
mov dword [eax + 0x44], ebp
call dword [edx + 0x110]
xor edi, edi
jmp case.0x100291e8.50
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd8]
jmp case.0x100291e8.50
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xcc]
jmp case.0x100291e8.50
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd0]
jmp case.0x100291e8.50
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xd4]
mov ebx, dword [sym.imp.user32.dll_GetKeyState]
push 0x10
call ebx
test ah, 0x80
je 0x10029308
cmp dword [esp + 0x50], 0x2d
jne 0x10029308
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xd4]
mov ecx, dword [esp + 0x50]
lea eax, [ecx - 9]
cmp eax, 0x68
mov dword [esp + 0x14], eax
ja case.0x1002932a.20
mov ebp, dword [sym.imp.user32.dll_SendMessageW]
xor edx, edx
mov dl, byte [eax + 0x10029a78]
jmp dword [edx*4 + 0x10029a48]
mov eax, dword [esi + 0x1bc]
mov ecx, dword [esi + 0x1b8]
push eax
push ecx
mov ecx, esi
call fcn.1002e380
mov edx, dword [esi + 0x1bc]
mov eax, dword [esi + 0x1b8]
push edx
push eax
mov ecx, esi
call fcn.1002e380
test eax, eax
je 0x100297c8
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.1002bf70
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp ebx, eax
jg 0x100293d6
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
cmp edi, eax
jg 0x100293cd
push 0xffffff51
push ebx
push edi
mov ecx, esi
call fcn.10028760
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x100451e4
call sub.mfc42u.dll_CString::CString_2
mov edx, dword [esi]
push ebx
push edi
mov ecx, esi
call dword [edx + 0x104]
push 0xffffff50
push ebx
push edi
mov ecx, esi
call fcn.10028760
mov eax, dword [esp + 0x30]
inc edi
cmp edi, eax
jle 0x10029387
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
inc ebx
cmp ebx, ecx
jle 0x10029383
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.1002e630
xor edi, edi
jmp 0x100297c8
push 0x10
call ebx
test ah, 0x80
je 0x10029445
mov eax, dword [esi + 0xbc]
mov ecx, dword [esp + 0x24]
cmp ecx, eax
jle 0x1002940a
dec ecx
mov dword [esp + 0x24], ecx
jmp 0x100297c8
jne 0x10029439
mov ecx, dword [esp + 0x20]
mov eax, dword [esi + 0xb4]
cmp ecx, eax
jle 0x10029439
mov eax, dword [esi + 0xb8]
mov edx, ecx
dec edx
dec eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], 1
jmp 0x100297c8
mov ecx, esi
call sub.mfc42u.dll_CWnd::Default
jmp 0x100297c8
mov eax, dword [esi + 0xb8]
mov ecx, dword [esp + 0x24]
dec eax
cmp ecx, eax
jge 0x1002945e
inc ecx
mov dword [esp + 0x24], ecx
jmp 0x100297c8
jne 0x10029439
mov edx, dword [esi + 0xb0]
mov eax, dword [esp + 0x20]
dec edx
cmp eax, edx
jge 0x10029439
inc eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0xbc]
mov dword [esp + 0x24], eax
jmp 0x100297c8
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0xb0]
mov ebx, eax
inc eax
cmp eax, ecx
mov dword [esp + 0x20], eax
jge 0x100294c3
push eax
mov ecx, esi
call fcn.1002dbd0
test eax, eax
jg 0x100297c8
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0xb0]
inc eax
cmp eax, ecx
mov dword [esp + 0x20], eax
jl 0x100294a0
mov dword [esp + 0x20], ebx
jmp 0x100297c8
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0xb4]
mov ebx, eax
dec eax
cmp eax, ecx
mov dword [esp + 0x20], eax
jl 0x10029504
push eax
mov ecx, esi
call fcn.1002dbd0
test eax, eax
jg 0x100297c8
mov eax, dword [esp + 0x20]
mov ecx, dword [esi + 0xb4]
dec eax
cmp eax, ecx
mov dword [esp + 0x20], eax
jge 0x100294e1
mov dword [esp + 0x20], ebx
jmp 0x100297c8
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0xb8]
mov ebx, eax
inc eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jge 0x10029545
push eax
mov ecx, esi
call fcn.1002dc00
test eax, eax
jg 0x100297c8
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0xb8]
inc eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x10029522
mov dword [esp + 0x24], ebx
jmp 0x100297c8
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0xbc]
mov ebx, eax
dec eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jl 0x10029586
push eax
mov ecx, esi
call fcn.1002dc00
test eax, eax
jg 0x100297c8
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0xbc]
dec eax
cmp eax, ecx
mov dword [esp + 0x24], eax
jge 0x10029563
mov dword [esp + 0x24], ebx
jmp 0x100297c8
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.1002bd00
mov edx, dword [esi + 0x20]
push edi
push 3
push 0x115
push edx
call ebp
lea eax, [esp + 0x18]
mov ecx, esi
push eax
call fcn.1002bd00
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
sub eax, ecx
je 0x100295e3
mov ecx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esi + 0xb0]
dec eax
mov dword [esp + 0x20], ecx
cmp ecx, eax
jle 0x100297c8
mov dword [esp + 0x20], eax
jmp 0x100297c8
mov eax, dword [esi + 0xb0]
dec eax
mov dword [esp + 0x20], eax
jmp 0x100297c8
lea ecx, [esp + 0x18]
push ecx
mov ecx, esi
call fcn.1002bd00
mov edx, dword [esi + 0x20]
push edi
push 2
push 0x115
push edx
call ebp
lea eax, [esp + 0x28]
mov ecx, esi
push eax
call fcn.1002bd00
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
sub eax, ecx
je 0x10029646
mov ecx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esi + 0xb4]
cmp ecx, eax
mov dword [esp + 0x20], ecx
jge 0x100297c8
mov dword [esp + 0x20], eax
jmp 0x100297c8
mov ecx, dword [esi + 0xb4]
mov dword [esp + 0x20], ecx
jmp 0x100297c8
push 0x11
call ebx
test ah, 0x80
push edi
push 6
je 0x10029686
mov edx, dword [esi + 0x20]
push 0x115
push edx
call ebp
mov eax, dword [esi + 0x20]
push edi
push 6
push 0x114
push eax
call ebp
mov ecx, dword [esi + 0xb4]
mov dword [esp + 0x20], ecx
jmp 0x10029691
mov edx, dword [esi + 0x20]
push 0x114
push edx
call ebp
mov ecx, dword [esi + 0xb8]
mov eax, dword [esi + 0xbc]
dec ecx
mov dword [esp + 0x24], eax
cmp eax, ecx
jge 0x100296c6
push eax
mov ecx, esi
call fcn.1002dc00
test eax, eax
jg 0x100296c6
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 0xb8]
inc eax
dec edx
cmp eax, edx
mov dword [esp + 0x24], eax
jl 0x100296a6
mov ecx, dword [esi + 0xb0]
mov eax, dword [esp + 0x20]
dec ecx
cmp eax, ecx
jge 0x100297c8
push eax
mov ecx, esi
call fcn.1002dbd0
test eax, eax
jg 0x100297c8
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 0xb0]
inc eax
dec edx
cmp eax, edx
mov dword [esp + 0x20], eax
jl 0x100296d9
jmp 0x100297c8
push 0x11
call ebx
test ah, 0x80
push edi
push 7
je 0x10029734
mov eax, dword [esi + 0x20]
push 0x115
push eax
call ebp
mov ecx, dword [esi + 0x20]
push edi
push 7
push 0x114
push ecx
call ebp
mov eax, dword [esi + 0xb0]
dec eax
mov dword [esp + 0x20], eax
jmp 0x1002973f
mov edx, dword [esi + 0x20]
push 0x114
push edx
call ebp
mov eax, dword [esi + 0xb8]
mov ecx, dword [esi + 0xbc]
dec eax
inc ecx
cmp eax, ecx
mov dword [esp + 0x24], eax
jle 0x10029775
push eax
mov ecx, esi
call fcn.1002dc00
test eax, eax
jg 0x10029775
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 0xbc]
dec eax
inc edx
cmp eax, edx
mov dword [esp + 0x24], eax
jg 0x10029755
mov ecx, dword [esi + 0xb4]
mov eax, dword [esp + 0x20]
inc ecx
cmp eax, ecx
jle 0x100297c8
push eax
mov ecx, esi
call fcn.1002dbd0
test eax, eax
jg 0x100297c8
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 0xb4]
dec eax
inc edx
cmp eax, edx
mov dword [esp + 0x20], eax
jg 0x10029784
jmp 0x100297c8
mov edx, dword [esi]
or ecx, 0xffffffff
or eax, 0xffffffff
push 1
push ecx
mov ecx, dword [esi + 0x1b8]
push eax
mov eax, dword [esi + 0x1bc]
push eax
push ecx
mov ecx, esi
call dword [edx + 0x108]
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0x1b8]
cmp edx, eax
jne 0x100297e8
mov eax, dword [esp + 0x24]
mov ecx, dword [esi + 0x1bc]
cmp eax, ecx
je 0x100299ed
cmp dword [esi + 0x190], edi
jne 0x10029897
mov edx, dword [esi + 0x1f8]
cmp edx, edi
je 0x1002981e
mov eax, dword [esi + 0x1fc]
cmp eax, edi
jbe 0x1002981e
mov ecx, edx
mov ebx, eax
mov eax, dword [ecx]
cmp eax, edi
je 0x10029818
mov eax, dword [eax]
cmp eax, edi
jne 0x10029812
add ecx, 4
dec ebx
jne 0x1002980c
push edx
call sub.mfc42u.dll_operatordelete
mov ecx, dword [esi + 0x208]
add esp, 4
mov dword [esi + 0x1f8], edi
mov dword [esi + 0x200], edi
mov dword [esi + 0x204], edi
call sub.mfc42u.dll_CPlex::FreeDataChain
mov dword [esi + 0x208], edi
mov ecx, dword [esi + 0x80]
neg ecx
sbb ecx, ecx
push 0x10
add ecx, 4
mov dword [esi + 0x190], ecx
call dword [sym.imp.user32.dll_GetKeyState]
test ah, 0x80
je 0x10029871
cmp dword [esp + 0x50], 9
jne 0x10029885
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esi + 0x1b0], edx
mov dword [esi + 0x1b4], eax
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.10031e90
mov dword [esi + 0x190], edi
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edx
lea ecx, [esp + 0x3c]
push eax
push ecx
mov ecx, esi
call fcn.10031c30
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edx
push eax
mov ecx, esi
call fcn.1002e400
test eax, eax
jne 0x100299ed
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
mov ecx, esi
call fcn.1002e1e0
mov eax, dword [esp + 0x14]
cmp eax, 0x1f
ja case.0x100298ec.5
xor ecx, ecx
mov cl, byte [eax + 0x10029afc]
jmp dword [ecx*4 + 0x10029ae4]
push edi
push 1
mov edx, dword [esi + 0x20]
push 0x114
push edx
call ebp
mov edx, dword [esi + 0x20]
push 1
push edi
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x100299ed
mov eax, dword [esi + 0x20]
push edi
push edi
push 0x114
push eax
call ebp
mov edx, dword [esi + 0x20]
push 1
push edi
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x100299ed
push edi
push 1
push 0x115
jmp 0x100299d1
mov edx, dword [esi + 0x20]
push edi
push edi
push 0x115
push edx
call ebp
mov edx, dword [esi + 0x20]
push 1
push edi
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x100299ed
push 0x10
call dword [sym.imp.user32.dll_GetKeyState]
test ah, 0x80
mov eax, dword [esp + 0x10]
je 0x100299a0
cmp eax, edi
push edi
push edi
je 0x100298f6
mov eax, dword [esi + 0x20]
push 0x115
push eax
call ebp
mov ecx, dword [esi + 0xf8]
push 1
push ecx
push edi
mov ecx, esi
call fcn.1002c160
mov edx, dword [esi + 0x20]
push 1
push edi
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x100299ed
cmp eax, edi
push edi
push 1
je 0x100299cc
mov eax, dword [esi + 0x20]
push 0x115
push eax
call ebp
push 1
push edi
push edi
mov ecx, esi
call fcn.1002c160
mov edx, dword [esi + 0x20]
push 1
push edi
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x100299ed
push 0x114
mov ecx, dword [esi + 0x20]
push ecx
call ebp
mov edx, dword [esi + 0x20]
push 1
push edi
push edx
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x100299ed
mov ecx, esi
call sub.mfc42u.dll_CWnd::Default
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x3c
ret 0xc