Function at 0x1018c6c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x9c69
mov ebx, ecx
xor edi, edi
cmp eax, esi
mov dword [ebp - 4], ebx
jg 0x1018df5
je 0x1018da9
cmp eax, 0x418
je 0x1019047
cmp eax, 0x419
je 0x1018fd2
cmp eax, 0x41a
je 0x1018ea2
cmp eax, 0x755b
je 0x1018d5a
lea ecx, [esi - 0x28]
cmp eax, ecx
je 0x1018d45
cmp eax, 0x9c66
jle 0x1018d3b
cmp eax, 0x9c68
jg 0x1018d3b
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x18]
mov ecx, ebx
call fcn.01018be2
mov ebx, eax
cmp ebx, edi
je 0x1018d27
xor esi, esi
cmp dword [ebp - 0x10], edi
jbe 0x1018d18
xor eax, eax
cmp dword [ebp + 8], 0x9c67
setne al
dec eax
and eax, 3
add eax, 3
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebx + esi*4]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x1018d06
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push dword [ebp + 8]
push edi
call fcn.010055be
push eax
call fcn.0101af4e
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x10], edi
pop edi
pop esi
pop ebx
leave
ret 4
push edi
push ecx
push 0x111
push dword [0x101e098]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1018d3b
lea eax, [ebp + 8]
push eax
push dword [ebx + 0x18]
call fcn.01018be2
mov esi, eax
cmp esi, edi
je 0x1018d77
push dword [ebp + 8]
mov ecx, ebx
push esi
call fcn.01018027
push esi
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
cmp esi, edi
je 0x1018d9d
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push 0x755b
jmp 0x1018e91
lea eax, [ebp + 8]
push eax
push dword [ebx + 0x18]
call fcn.01018be2
mov ebx, eax
cmp ebx, edi
je 0x1018dc7
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
push ebx
call fcn.01018027
push ebx
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CascadeWindows]
cmp ebx, edi
je 0x1018ded
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push esi
jmp 0x1018d2c
sub eax, 0x9c6a
je 0x10190e7
dec eax
dec eax
je 0x1019047
dec eax
je 0x1018fd2
dec eax
je 0x1018ea2
dec eax
je 0x1018e22
sub eax, 0x54
jne 0x1018d3b
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.01018be2
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1018e8c
mov esi, dword [eax]
push esi
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_HungWindowFromGhostWindow]
cmp eax, edi
je 0x1018e46
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 8], edi
je 0x1018e7b
cmp dword [ebp + 8], 0x9cc3
push dword [ebp - 8]
push eax
jne 0x1018e6a
push 0x405
jmp 0x1018e6f
push 0x401
push dword [0x101e098]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push dword [ebp + 8]
push edi
call fcn.010055be
push eax
call fcn.0101af4e
jmp 0x1018d3b
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.01018be2
or dword [ebp - 0x18], 0xffffffff
push 0x11
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ebx, ax
shr ebx, 0x10
and ebx, 1
cmp dword [ebp - 0x10], edi
je 0x1018d38
cmp ebx, edi
je 0x1018ed9
add dword [ebp + 8], 0x10000
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0x1c], edi
jbe 0x1018fbc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ecx*4]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edi
call esi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_HungWindowFromGhostWindow]
cmp eax, edi
je 0x1018f15
lea ecx, [ebp - 8]
push ecx
push eax
call esi
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 8], eax
je 0x1018fad
push 0x1c
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x1018f40
lea esi, [ebp - 0x38]
mov dword [ebp - 0x18], edi
jmp 0x1018f47
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
cmp dword [ebp - 0x18], edi
je 0x1018f9e
push edi
push 0x11
push esi
push fcn.01018383
mov dword [esi + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHCreateThread]
test eax, eax
jne 0x1018fa7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1018fa7
push esi
mov dword [esi + 0x18], edi
call fcn.01018383
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0x1018ee5
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1018d38
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.01018be2
mov esi, eax
cmp esi, edi
je 0x1018e8c
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
push ebx
push esi
call fcn.01018027
dec ebx
cmp ebx, edi
jl 0x101900f
push 0x4003
push edi
push edi
push edi
push edi
push edi
push dword [esi + ebx*4]
call dword [sym.imp.USER32.dll_SetWindowPos]
dec ebx
jns 0x1018ff9
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1019028
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 4]
jmp 0x1018e8c
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x18]
call fcn.01018be2
mov esi, eax
cmp esi, edi
je 0x1018e8c
push dword [esi]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1019073
push 9
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push dword [esi]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10190a4
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1018d3b
push 0xfffffffffffffff0
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x8000000
jne 0x10190da
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
test byte [0x101e458], 1
je 0x10190e1
push 6
push dword [0x101e098]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10190e1
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
push esi
jmp 0x1018e7e
lea eax, [ebp + 8]
push eax
push dword [ebx + 0x18]
call fcn.01018be2
mov esi, eax
cmp esi, edi
je 0x1019104
push dword [ebp + 8]
mov ecx, ebx
push esi
call fcn.01018027
push esi
push dword [ebp + 8]
push edi
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
cmp esi, edi
je 0x101912b
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push 0x9c6a
jmp 0x1018e91