Function at 0x10b0698
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x111121c]
and dword [ebp - 0x48], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor edx, edx
mov dword [ebp - 4], eax
mov esi, ecx
mov ecx, dword [ebp + 8]
inc edx
mov eax, 0x102
cmp ecx, eax
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], edx
ja 0x10b0ac8
je 0x10b0a81
cmp ecx, 0x16
ja 0x10b07e2
je 0x10b07bb
cmp ecx, 0x10
ja 0x10b077e
je 0x10b075c
sub ecx, 5
je 0x10b074e
dec ecx
je 0x10b0741
dec ecx
je 0x10b0735
sub ecx, 8
jne 0x10b0793
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_BeginPaint]
test eax, eax
je 0x10b0720
push eax
mov ecx, esi
call fcn.0109ff09
lea eax, [ebp - 0x44]
push eax
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x10b0cc1
mov ecx, esi
call fcn.0109fa40
jmp 0x10b0cc1
push ebx
mov ecx, esi
call fcn.010a3333
jmp 0x10b0cc1
push edi
push ebx
mov ecx, esi
call fcn.010a4f3a
jmp 0x10b0cc1
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10b0cc1
push 0
mov ecx, esi
call fcn.010a8c9d
jmp 0x10b0cc1
sub ecx, 0x11
je 0x10b07b3
sub ecx, 3
je 0x10b0ca8
dec ecx
je 0x10b0990
push edi
push ebx
push dword [ebp + 8]
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0105ec09
leave
ret 0xc
mov dword [ebp - 0x48], edx
jmp 0x10b0cc1
cmp ebx, edx
jne 0x10b0cc1
mov ecx, esi
call fcn.010a092d
lea ecx, [esi + 0x5c]
call fcn.010bd43e
lea ecx, [esi + 0x22cc]
call fcn.010c2d11
jmp 0x10b0cc1
sub ecx, 0x1a
je 0x10b0990
sub ecx, 6
je 0x10b0980
sub ecx, 4
je 0x10b08f5
sub ecx, 7
je 0x10b0893
sub ecx, 0x23
je 0x10b0885
sub ecx, 0x30
je 0x10b0863
sub ecx, 4
jne 0x10b0793
lea edi, [esi + 0x2fc0]
mov eax, dword [edi]
test eax, eax
je 0x10b0831
add eax, 0x20
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
mov ecx, dword [esi + 0x2b1c]
push esi
call fcn.0104ab8e
xor ebx, ebx
push ebx
push 0xffffffffffffffeb
lea edi, [esi + 0x2614]
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi]
push esi
mov dword [edi], ebx
mov dword [esi + 0x2d98], ebx
call dword [eax + 8]
jmp 0x10b0cc1
lea ecx, [esi + 0x40]
call fcn.0110ae9b
push 0x185
push 0
push 0
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x10b0cc1
push edi
push ebx
mov ecx, esi
call fcn.010af87a
jmp 0x10b0cc1
cmp ebx, 0x9ffc
mov dword [ebp - 0x48], edx
jne 0x10b08ba
mov ecx, dword [esi + 0x2b1c]
push 0x10
push 0x10
push 0
call fcn.0104beff
mov dword [edi + 0x2c], eax
lea ecx, [esi + 0x118]
jmp 0x10b08c8
cmp ebx, 0xa000
jne 0x10b08d3
mov ecx, dword [esi + 0x25f0]
mov eax, dword [ecx]
push edi
call dword [eax + 8]
jmp 0x10b0cc1
cmp ebx, 0x9c59
jne 0x10b08ec
push edi
lea ecx, [esi + 0x2620]
call fcn.010757b8
jmp 0x10b0cc1
and dword [ebp - 0x48], 0
jmp 0x10b0cc1
cmp dword [0x11142c4], 0
jg 0x10b0954
mov eax, dword [esi + 0x2b24]
shl eax, 2
push 4
cdq
pop ecx
idiv ecx
lea ecx, [esi + 0x40]
mov dword [0x11142c4], eax
call fcn.010b2114
mov ecx, dword [0x11142c4]
lea ecx, [ecx + eax + 0x28]
mov eax, 0x8c
cmp ecx, eax
mov dword [0x11142c4], ecx
jle 0x10b0938
mov dword [0x11142c4], eax
cmp dword [esi + 0x2564], 0
je 0x10b0954
push 1
lea ecx, [esi + 0x7a0]
call fcn.0109c301
add dword [0x11142c4], eax
mov eax, dword [0x11142c4]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x2f98]
add eax, dword [0x11142a0]
mov ecx, dword [0x11142ac]
add eax, dword [0x11142a4]
lea eax, [eax + ecx + 5]
mov dword [edi + 0x1c], eax
jmp 0x10b0cc1
push edi
push ebx
push 0x20
mov ecx, esi
call fcn.0109fd66
jmp 0x10b0b34
call fcn.0107682f
lea ebx, [esi + 0x2dd0]
push ebx
call fcn.0109f7af
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 4
push 0x444
push dword [esi + 0x2618]
call ebx
lea eax, [esi + 0x2dd0]
push eax
push 0
push 0x444
push dword [esi + 0x2618]
call ebx
lea ecx, [esi + 0x2fa0]
call fcn.0109c1d0
mov ecx, esi
call fcn.0109fe0b
push edi
push dword [ebp - 0x4c]
lea ebx, [esi + 0x40]
push dword [ebp + 8]
mov ecx, ebx
call fcn.0110af39
push edi
push dword [ebp - 0x4c]
lea ecx, [esi + 0x118]
push dword [ebp + 8]
call fcn.0110bb6e
push edi
push dword [ebp - 0x4c]
lea ecx, [esi + 0x7a0]
push dword [ebp + 8]
call fcn.0109cbb6
mov ecx, dword [esi + 0x2fc0]
test ecx, ecx
je 0x10b0a2a
push edi
push dword [ebp - 0x4c]
push dword [ebp + 8]
call fcn.0109751f
lea eax, [ebp - 0x60]
push eax
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebx]
mov ecx, ebx
call fcn.0110ae6c
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x5c]
movzx eax, ax
movzx ecx, cx
shl eax, 0x10
or eax, ecx
push eax
mov eax, dword [ebp - 0x58]
sub eax, dword [ebp - 0x60]
mov ecx, ebx
push eax
call dword [edi]
mov ecx, esi
call fcn.010a6e34
push 0x185
push 0
push 0
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x10b0b34
cmp ebx, 9
jne 0x10b0ab9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0x8000
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
push dword [esi + 0x2614]
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
test eax, eax
je 0x10b0ab2
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
jmp 0x10b07a4
push edi
push ebx
push eax
mov ecx, esi
call fcn.010afcde
jmp 0x10b07a4
mov eax, 0x2b1
cmp ecx, eax
ja 0x10b0bc6
je 0x10b0bb8
sub ecx, 0x111
je 0x10b0baa
dec ecx
dec ecx
je 0x10b0b9d
sub ecx, 4
je 0x10b0b8f
sub ecx, 0x1c
je 0x10b0b3c
dec ecx
dec ecx
je 0x10b0b1f
sub ecx, 3
je 0x10b0b3c
sub ecx, 0xfb
jne 0x10b0793
push ebx
mov ecx, esi
call fcn.010a7327
jmp 0x10b0cc1
cmp dword [esi + 0x2b7c], 0
je 0x10b0b2c
push 5
jmp 0x10b0b2e
push 0xf
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x48], eax
jmp 0x10b0cc1
cmp edi, dword [esi + 0x2b50]
je 0x10b0b4c
cmp edi, dword [esi + 0x2b54]
jne 0x10b0b7f
push 0x23
call fcn.010767fc
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0x24
call fcn.010767fc
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [esi + 0x2fa0]
test eax, eax
jne 0x10b0b7c
push 5
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x48], eax
xor eax, eax
cmp dword [ebp - 0x48], eax
setne al
mov dword [ebp - 0x50], eax
jmp 0x10b0cb7
push edi
push ebx
mov ecx, esi
call fcn.010ad207
jmp 0x10b0cc1
push ebx
mov ecx, esi
call fcn.010a54f0
jmp 0x10b0cc1
push edi
push ebx
mov ecx, esi
call fcn.010aef71
jmp 0x10b0cc1
push edi
push ebx
mov ecx, esi
call fcn.010a32b3
jmp 0x10b0c96
sub ecx, 0x318
je 0x10b0ca8
sub ecx, 0xe8
je 0x10b0c9f
sub ecx, 0x11
je 0x10b0c86
dec ecx
je 0x10b0c74
dec ecx
je 0x10b0c62
dec ecx
je 0x10b0c56
dec ecx
jne 0x10b0793
push edi
push dword [esi + 0x2da8]
lea ebx, [esi + 0x2614]
push dword [ebx]
lea ecx, [ebp - 0x68]
call fcn.010da13a
lea ecx, [ebp - 0x68]
call fcn.010da174
cmp eax, 1
je 0x10b0c42
push dword [ebx]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10b0c42
and dword [esi + 0x2fd8], 0
and dword [esi + 0x2fd4], 0
push 1
mov ecx, esi
call fcn.010a4184
test edi, edi
je 0x10b0c4c
mov eax, dword [edi]
push edi
call dword [eax + 8]
lea ecx, [ebp - 0x68]
call fcn.010a4946
jmp 0x10b0cc1
mov ecx, esi
call fcn.0109fa40
jmp 0x10b0793
mov ecx, esi
call fcn.0109fa40
push edi
push ebx
mov ecx, esi
call fcn.010a7cf6
jmp 0x10b0c96
mov ecx, esi
call fcn.0109fa40
push edi
push ebx
mov ecx, esi
call fcn.010a7ca8
jmp 0x10b0c96
mov ecx, esi
call fcn.0109fa40
push edi
push ebx
mov ecx, esi
call fcn.010a7c68
mov dword [ebp - 0x48], 1
jmp 0x10b0cc1
mov dword [ebp - 0x48], 0x534b9c59
jmp 0x10b0cc1
push ebx
mov ecx, esi
call fcn.0109fdbf
mov dword [ebp - 0x48], 1
cmp dword [ebp - 0x50], 0
je 0x10b0793
mov eax, dword [ebp - 0x48]
jmp 0x10b07a4