Function at 0x10087e50
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x2c
mov eax, dword [0x101a53c4]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
test edi, edi
mov dword [esp + 4], ecx
jne 0x10087e80
push eax
call fcn.100873d0
add esp, 4
mov edi, eax
push ecx
pop ecx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10087e9b
pop edi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100f5016
add esp, 0x2c
ret
push ebx
push ebp
push esi
push 5
push edi
call fcn.10052c50
add esp, 8
test eax, eax
je 0x10087f2c
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
push eax
pop eax
push 0
push edi
call fcn.10052c10
add esp, 8
mov ebx, eax
mov bh, bh
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
mov cl, cl
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
xchg ebx, eax
xchg ebx, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call ebx
test eax, eax
je 0x10087f2c
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10087f2c
mov esi, ebp
push ebx
pop ebx
push ebp
call ebx
test eax, eax
je 0x10087f2c
jmp 0x10087f10
cmp esi, edi
je 0x10087f28
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
mov bl, bl
push esi
call ebx
test eax, eax
jne 0x10087f10
jmp 0x10087f2c
mov edi, ebp
mov dl, dl
mov eax, dword [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10087f33
sub eax, edx
mov ebx, eax
mov ebx, ebx
lea ebp, [ebx + ebx + 2]
push ebp
call fcn.100f4a78
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
push edx
pop edx
test esi, esi
jne 0x10087f6e
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100f5016
add esp, 0x2c
ret
push ebp
push 0
push esi
call fcn.100f5b10
add esp, 0xc
mov cl, cl
mov edx, dword [esp + 0x10]
add ebx, 1
push ebx
push esi
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov bh, bh
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10087fa0
sub eax, edx
sar eax, 1
mov al, al
mov edx, edx
test eax, eax
jle 0x1008803f
mov ebx, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ebp, eax
mov bl, bl
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov al, al
push eax
push eax
push 0x20
lea eax, [esp + 0x24]
push eax
push 1
push esi
push 0
push 0
call ebx
mov bh, bh
mov dword [esp + 0x10], 0
xchg ebx, eax
xchg ebx, eax
mov eax, dword [esp + 0x18]
xor edx, edx
mov dh, al
lea ecx, [esp + 0x10]
push ecx
push 0x9c4
push 1
movzx eax, ah
push 1
or edx, eax
push edx
push 0x286
push edi
call fcn.10052bc0
add esp, 0x1c
mov ecx, ecx
add esi, 2
sub ebp, 1
jne 0x10087fc3
mov esi, dword [esp + 0x14]
push esi
call fcn.100f4b3b
add esp, 4
mov edi, edi
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
mov eax, 1
call fcn.100f5016
add esp, 0x2c
ret