Function at 0x10067d3b
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x100c3b40
call fcn.100a35ac
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
cmp dword [esi + 0x12dc], ebx
je 0x10067f4f
call fcn.1005528b
cmp byte [eax], bl
je 0x10067f4f
call fcn.1005528b
mov byte [eax], bl
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x12dc]
lea ecx, [eax + 0x70]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp ebx, eax
jae 0x10067e54
push ebx
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
push 0x100cb0a0
push str.type
call dword [eax + 0xc]
mov edi, eax
push str.Combo
push edi
mov dword [ebp + 8], edi
call fcn.100a26ab
pop ecx
pop ecx
test eax, eax
je 0x10067e3d
push str.Edit
push edi
call fcn.100a26ab
pop ecx
pop ecx
test eax, eax
je 0x10067e3d
push str.Password
push edi
call fcn.100a26ab
pop ecx
pop ecx
test eax, eax
je 0x10067e3d
mov ecx, dword [esi + 0x12dc]
push ebx
add ecx, 0x70
lea edi, [esi + 0xb8]
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
push edi
call dword [eax + 0x20]
test al, al
je 0x10067e3d
push dword [ebp + 8]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xa8]
call fcn.1005528b
mov byte [eax], 1
mov ecx, dword [esi + 0x12dc]
push ebx
add ecx, 0x70
call fcn.10001bf2
push dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
push edi
call dword [eax + 0x4c]
jmp 0x10067f52
push dword [ebp + 8]
lea ecx, [esi + 0xb8]
mov eax, dword [ecx]
call dword [eax + 0xa8]
inc ebx
jmp 0x10067d7f
cmp dword [ebp - 0x14], 9
jne 0x10067fc2
mov eax, dword [ebp + 0xc]
cmp dword [eax + 4], 0x100
jne 0x10067fc2
lea ecx, [esi + 0xe4]
call fcn.10055381
xor ebx, ebx
mov byte [ebp + 0xf], al
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], ebx
mov eax, dword [esi + 0x12dc]
lea ecx, [eax + 0x88]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp dword [ebp + 8], eax
jae 0x10067f6e
push dword [ebp + 8]
call fcn.10001bf2
cmp byte [ebp + 0xf], 0
mov edi, dword [eax]
je 0x10067ec9
test ebx, ebx
jne 0x10067ec9
push edi
lea ecx, [esi + 0xe4]
call fcn.100557ef
test al, al
je 0x10067ec9
mov dword [ebp - 0x14], edi
mov eax, dword [edi]
lea ebx, [esi + 0xb8]
push ebx
mov ecx, edi
call dword [eax + 0x20]
test al, al
je 0x10067f63
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x10067ef0
dec dword [ebp + 8]
jmp 0x10067ef3
inc dword [ebp + 8]
mov eax, dword [esi + 0x12dc]
lea ecx, [eax + 0x88]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp dword [ebp + 8], eax
jae 0x10067f34
push dword [ebp + 8]
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x78]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 0xc0]
call fcn.1005528b
mov byte [eax], 1
xor eax, eax
jmp 0x10067f52
cmp byte [ebp + 0xf], 0
je 0x10067f47
push 0
lea ecx, [esi + 0xe4]
call fcn.1005584b
call fcn.1005528b
mov byte [eax], 1
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
inc dword [ebp + 8]
mov ebx, dword [ebp - 0x14]
jmp 0x10067e84
mov ecx, dword [esi + 0x12dc]
mov eax, dword [ecx + 0x98]
sub eax, dword [ecx + 0x94]
add ecx, 0x88
test eax, 0xfffffffc
je 0x10067f28
cmp byte [ebp + 0xf], 0
je 0x10067faf
test ebx, ebx
je 0x10067f9d
mov eax, dword [ebx]
mov ecx, ebx
jmp 0x10067fba
push 0
lea ecx, [esi + 0xe4]
call fcn.1005584b
jmp 0x10067f28
push 0
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
call dword [eax + 0x74]
jmp 0x10067f28
xor ebx, ebx
mov eax, dword [esi + 0x12dc]
lea ecx, [eax + 0x88]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
cmp ebx, eax
jae 0x10068017
push ebx
lea edi, [esi + 0xb8]
call fcn.10001bf2
mov ecx, dword [eax]
mov eax, dword [ecx]
push edi
call dword [eax + 0x20]
test al, al
je 0x10068014
call fcn.1005528b
mov byte [eax], 1
mov ecx, dword [esi + 0x12dc]
push ebx
add ecx, 0x88
call fcn.10001bf2
jmp 0x10067e2d
inc ebx
jmp 0x10067fc4
or dword [ebp - 4], 0xffffffff
jmp 0x10067f47