Function at 0x1017b214
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x18], esi
test edi, edi
je 0x1017b71a
xor ebx, ebx
cmp dword [esi], ebx
je 0x1017b71a
mov eax, dword [edi + 4]
xor edx, edx
mov ecx, dword [edi]
inc edx
mov dword [ebp - 8], ecx
mov byte [ebp - 4], bl
mov byte [ebp - 0x10], bl
mov byte [ebp + 0xb], dl
mov byte [ebp - 0xc], bl
mov dword [ebp - 0x14], ebx
cmp eax, 0x104
ja 0x1017b3ff
je 0x1017b352
cmp eax, 0x21
ja 0x1017b32b
je 0x1017b31a
cmp eax, 3
je 0x1017b2e5
cmp eax, 6
je 0x1017b2b4
cmp eax, 0x10
je 0x1017b2a0
cmp eax, 0x1c
jne 0x1017b71a
cmp dword [edi + 8], ebx
jne 0x1017b71a
cmp byte [ebp + 0xc], bl
je 0x1017b67b
jmp 0x1017b71a
test ecx, ecx
je 0x1017b71a
push ebx
push ecx
call fcn.1017ab84
jmp 0x1017b71a
cmp dword [edi + 8], ebx
jne 0x1017b71a
push dword [edi + 0xc]
call fcn.1017a7ed
test al, al
jne 0x1017b71a
xor ebx, ebx
inc ebx
push ebx
push 2
call fcn.1017ad12
push ebx
push 4
call fcn.1017ad12
jmp 0x1017b71a
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1017b71a
call fcn.1017aa0a
test eax, eax
je 0x1017b71a
push dword [ebp - 8]
mov ecx, eax
call fcn.101c2f5a
test al, al
je 0x1017b71a
jmp 0x1017b67b
cmp byte [ebp + 0xc], bl
sete dl
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
jmp 0x1017b673
sub eax, 0xa1
je 0x1017b452
sub eax, 3
je 0x1017b452
sub eax, 3
je 0x1017b452
sub eax, 0x59
je 0x1017b36f
jmp 0x1017b71a
cmp dword [edi + 8], 0x12
je 0x1017b36c
call fcn.10258327
push ebx
push ebx
push ebx
mov edx, dword [eax]
mov ecx, eax
push ebx
push dword [ebp - 8]
push 0xc
call dword [edx]
mov byte [ebp + 0xb], bl
cmp dword [edi + 8], 0x70
jne 0x1017b3b6
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1017b3b6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1017b3b6
xor eax, eax
mov dword [ebp - 8], ebx
inc eax
mov byte [ebp - 4], al
call fcn.10258338
push dword [edi + 0x10]
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x28]
mov edx, dword [ebp - 4]
mov dword [ebp - 0x14], 2
jmp 0x1017b673
cmp byte [esi + 0x1c], bl
jne 0x1017b3a7
push dword [edi]
call fcn.101a1a51
test al, al
jne 0x1017b3da
push dword [edi]
call fcn.1017a923
test al, al
jne 0x1017b3da
call fcn.101c3104
test al, al
je 0x1017b3de
mov dl, bl
jmp 0x1017b3aa
call fcn.10258327
push ebx
push ebx
push ebx
mov edx, dword [eax]
mov ecx, eax
push ebx
push ebx
push 0x25
call dword [edx]
xor ecx, ecx
inc ecx
movzx edx, cl
xor ecx, ecx
test eax, eax
cmovne edx, ecx
jmp 0x1017b3aa
mov ecx, 0x242
cmp eax, ecx
ja 0x1017b563
je 0x1017b586
sub eax, 0x201
je 0x1017b438
sub eax, 3
je 0x1017b452
sub eax, 3
je 0x1017b452
sub eax, 3
jne 0x1017b71a
call dword [sym.imp.USER32.dll_GetCapture]
push eax
jmp 0x1017b2c0
cmp dword [0x10669d34], ebx
je 0x1017b452
push ebx
push dword [edi + 0x10]
push dword [edi + 0x18]
push dword [edi + 0x14]
push dword [ebp - 8]
call fcn.1017aa17
cmp byte [ebp + 0xc], bl
je 0x1017b468
lea eax, [ebp - 8]
push eax
push edi
call fcn.101ab90b
mov dl, al
jmp 0x1017b552
push dword [edi]
call fcn.101a1a51
test al, al
jne 0x1017b49f
push dword [edi]
call fcn.1017a923
test al, al
jne 0x1017b49f
push dword [edi]
call fcn.1017a8a8
test al, al
jne 0x1017b49f
xor eax, eax
inc eax
mov dl, al
cmp byte [ebp + 0x10], bl
je 0x1017b555
mov byte [ebp - 0x10], al
jmp 0x1017b555
push dword [edi]
call fcn.1017a8a8
test al, al
jne 0x1017b54f
push dword [edi + 0x18]
mov ecx, dword [esi]
push dword [edi + 0x14]
call fcn.101c34e9
mov ecx, eax
test ecx, ecx
je 0x1017b4d1
mov eax, dword [ecx]
call dword [eax + 0x14]
test al, al
je 0x1017b4d1
mov dl, bl
jmp 0x1017b552
xor eax, eax
inc eax
mov byte [ebp - 4], al
call fcn.10186bcb
mov ecx, eax
test ecx, ecx
je 0x1017b514
mov eax, dword [ecx]
mov esi, dword [0x1057c328]
call dword [eax + 0x64]
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x20]
test al, al
je 0x1017b514
push 2
push dword [edi]
call dword [sym.imp.USER32.dll_GetAncestor]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.1017a7ed
test al, al
jne 0x1017b4ca
push dword [edi]
call fcn.1017a7ed
test al, al
je 0x1017b52a
xor eax, eax
inc eax
mov byte [ebp - 0x10], al
mov edx, dword [ebp - 4]
jmp 0x1017b555
call fcn.1017aa0a
test eax, eax
je 0x1017b54f
push dword [edi]
mov ecx, eax
call fcn.101c30a3
mov ecx, dword [ebp - 0x10]
test al, al
push 1
movzx ecx, cl
pop eax
cmovne ecx, eax
mov dword [ebp - 0x10], ecx
jmp 0x1017b525
mov edx, dword [ebp - 4]
xor eax, eax
inc eax
mov esi, dword [ebp - 0x18]
mov byte [ebp - 0xc], dl
mov dword [ebp - 0x14], eax
jmp 0x1017b673
sub eax, 0x246
je 0x1017b586
sub eax, 0xa
je 0x1017b586
sub eax, 0xab0
jne 0x1017b71a
cmp dword [edi + 8], 0x49
sete dl
jmp 0x1017b673
cmp byte [ebp + 0xc], bl
jne 0x1017b71a
movzx eax, word [edi + 8]
lea ecx, [ebp + 0xc]
push ecx
push eax
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
call dword [sym.imp.USER32.dll_GetPointerType]
test eax, eax
jne 0x1017b5bc
push 0x151003
call fcn.10153dc1
xor ecx, ecx
inc ecx
mov eax, ecx
mov dword [ebp + 0xc], eax
jmp 0x1017b5c2
mov eax, dword [ebp + 0xc]
xor ecx, ecx
inc ecx
cmp eax, 2
jb 0x1017b71a
cmp eax, 3
jbe 0x1017b5d9
cmp eax, 5
jne 0x1017b71a
mov byte [ebp - 4], cl
call fcn.1017aa0a
mov edx, eax
test edx, edx
je 0x1017b614
movsx eax, word [edi + 0xe]
movsx ecx, word [edi + 0xc]
push eax
push ecx
mov ecx, edx
call fcn.101c34e9
mov ecx, eax
test ecx, ecx
je 0x1017b614
mov eax, dword [ecx]
call dword [eax + 0x14]
mov edx, dword [ebp - 4]
movzx ecx, dl
xor edx, edx
test al, al
cmovne ecx, edx
mov dl, cl
jmp 0x1017b617
mov edx, dword [ebp - 4]
xor eax, eax
inc eax
mov byte [ebp - 0x10], al
mov dword [ebp - 0x14], eax
test dl, dl
je 0x1017b71a
mov eax, dword [esi + 0x38]
sub eax, 0x21
je 0x1017b656
sub eax, 0x221
je 0x1017b649
sub eax, 4
je 0x1017b649
sub eax, 0xa
je 0x1017b649
xor eax, eax
inc eax
mov byte [ebp - 0xc], al
jmp 0x1017b673
movzx eax, word [esi + 0x3c]
cmp eax, dword [ebp + 0x10]
setne byte [ebp - 0xc]
jmp 0x1017b673
movzx eax, word [esi + 0x42]
mov ecx, dword [edi + 4]
cmp eax, ecx
jne 0x1017b673
mov dword [esi + 0x38], ecx
mov eax, dword [edi + 8]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], eax
mov byte [ebp - 0xc], bl
test dl, dl
je 0x1017b6fe
push dword [ebp - 8]
mov ecx, esi
call fcn.1017a86e
test al, al
jne 0x1017b6fe
push dword [ebp - 8]
call fcn.1017a7ed
test al, al
jne 0x1017b6fe
push dword [ebp - 8]
mov ecx, esi
call fcn.1017ae2f
test al, al
jne 0x1017b6fe
cmp byte [ebp + 0xb], bl
je 0x1017b6bc
call fcn.10258327
push ebx
push ebx
push ebx
mov edx, dword [eax]
mov ecx, eax
push ebx
push dword [ebp - 8]
push 0xc
call dword [edx]
push ebx
cmp byte [ebp - 0x10], bl
je 0x1017b6de
push dword [ebp - 8]
call fcn.1018737a
neg al
sbb al, al
inc al
movzx eax, al
push eax
push dword [ebp - 0x14]
call fcn.1017b155
jmp 0x1017b6e6
push dword [ebp - 0x14]
call fcn.1017ab45
mov ebx, eax
mov eax, dword [ebp - 0xc]
test ebx, ebx
je 0x1017b701
cmp dword [edi + 4], 0x21
push 1
movzx eax, al
pop ecx
cmove eax, ecx
jmp 0x1017b701
mov eax, dword [ebp - 0xc]
test al, al
je 0x1017b71a
mov eax, dword [edi + 4]
mov dword [esi + 0x38], eax
mov eax, dword [edi + 8]
mov dword [esi + 0x3c], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], ebx
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc