Function at 0x1008ec00
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x101fe383
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x18], esi
mov ecx, dword [esi + 0x1c]
test ecx, ecx
mov dword [esp + 0x14], 0
je 0x1008ec4c
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
call edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
cmp eax, 3
jne 0x1008ec8b
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x1008f2ec
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [esi]
push ecx
mov ecx, dword [ebp + 8]
push edx
mov edx, dword [eax + 0x78]
push 3
push ecx
mov ecx, esi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x11
jne 0x1008ee0e
cmp byte [esi + 0xad], 0
je 0x1008edb1
lea eax, [esi - 0xc]
push eax
mov byte [esi + 0xad], 0
call fcn.1008c580
mov edi, eax
test edi, edi
je 0x1008edaa
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1008edaa
push edi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1008edaa
lea ecx, [esp + 0x1c]
xor eax, eax
push ecx
push edi
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
add eax, dword [esp + 0x1c]
cmp eax, 0x7530
jg 0x1008edaa
cmp dword [esi + 0x2c], 0
je 0x1008edb1
push 0x10
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x18], eax
mov dword [esp + 0x38], 0
test eax, eax
je 0x1008ed40
push eax
call fcn.1008a760
mov edi, eax
jmp 0x1008ed42
xor edi, edi
mov dword [esp + 0x38], 0xffffffff
test edi, edi
mov dword [esp + 0x18], edi
je 0x1008ed5a
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov dword [esp + 0x38], 1
test edi, edi
mov ebx, dword [esi + 0x2c]
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
mov dword [eax], edi
je 0x1008ed7a
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, edi
call eax
mov byte [esp + 0x3c], 2
mov eax, dword [ebx]
push 0
add eax, 0x14
push 4
mov byte [esp + 0x44], 1
mov edx, dword [eax]
mov ecx, ebx
call edx
mov dword [esp + 0x38], 0xffffffff
test edi, edi
je 0x1008edb1
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
jmp 0x1008edb1
mov byte [esi + 0xad], 1
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x1008edd7
lea eax, [esi - 0xc]
test eax, eax
je 0x1008edc4
lea eax, [esi - 4]
jmp 0x1008edc6
xor eax, eax
mov edx, dword [ecx]
push 0
push 0
push 0x123
push eax
mov eax, dword [edx + 0x24]
call eax
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x1008f2ec
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x78]
push eax
mov eax, dword [ebp + 8]
push ecx
push 0x11
push eax
mov ecx, esi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 9
jne 0x1008ee5d
lea ebx, [esi + 0x9c]
call fcn.101c4d40
mov ecx, dword [esi + 0x24]
test ecx, ecx
je 0x1008f2ec
lea eax, [esi - 0xc]
test eax, eax
je 0x1008ee35
lea eax, [esi - 4]
jmp 0x1008ee37
xor eax, eax
mov edx, dword [ecx]
push 0
push 0
push 0x122
push eax
mov eax, dword [edx + 0x24]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0xa
jne 0x1008ee89
mov esi, dword [esi + 0x20]
test esi, esi
je 0x1008f2ec
mov eax, esi
call fcn.100742e0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x23
jne 0x1008eec2
lea ebx, [esi + 0x9c]
call fcn.101c4d40
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1008f2ec
mov edx, dword [ebp + 0x10]
push edx
call fcn.10074ca0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x13
jne 0x1008eef6
mov esi, dword [esi + 0x20]
test esi, esi
je 0x1008f2ec
cmp dword [ebp + 0x10], 1
mov ecx, esi
sete al
push eax
call fcn.100743a0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x17
jne 0x1008eff5
mov eax, dword [esi + 0x20]
test eax, eax
je 0x1008ef0b
call fcn.10074490
lea ecx, [esp + 0x14]
push ecx
add esi, 0xfffffff4
push esi
call fcn.1008c440
mov dword [esp + 0x38], 3
cmp dword [esp + 0x14], 0
je 0x1008efe4
cmp dword [ebp + 0x10], 0
je 0x1008efe4
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov bl, 4
mov byte [esp + 0x38], bl
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x84]
call eax
lea edi, [eax - 1]
cmp edi, 1
jb 0x1008efd6
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
mov eax, dword [edx + 0x8c]
push edi
call eax
mov esi, eax
test esi, esi
mov dword [esp + 0x18], esi
je 0x1008ef82
mov edx, dword [esi]
mov eax, dword [edx]
mov ecx, esi
call eax
mov byte [esp + 0x38], 5
test esi, esi
je 0x1008ef99
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
mov ecx, esi
call eax
cmp dword [ebp + 0x10], eax
je 0x1008efb4
mov byte [esp + 0x38], bl
test esi, esi
je 0x1008efaa
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
sub edi, 1
cmp edi, 1
jae 0x1008ef61
jmp 0x1008efd6
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x50]
call eax
mov byte [esp + 0x38], bl
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov byte [esp + 0x38], 3
lea esi, [esp + 0x1c]
call fcn.100a0ee0
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x14]
jmp 0x1008f2e1
cmp eax, 0x14
jne 0x1008f030
lea ecx, [esp + 0x14]
push ecx
add esi, 0xfffffff4
push esi
call fcn.1008c080
mov dword [esp + 0x38], 6
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1008f01f
mov edx, dword [ecx]
mov eax, dword [edx + 0x44]
call eax
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x14]
jmp 0x1008f2e1
cmp eax, 0x1f
jne 0x1008f095
mov esi, dword [esi + 0x44]
test esi, esi
je 0x1008f2ec
mov edx, dword [esi]
mov edx, dword [edx + 0x50]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
call edx
mov dword [esp + 0x38], 7
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1008f065
mov eax, dword [ecx]
mov edx, dword [eax + 0x28]
call edx
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1008f2ec
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x15
jne 0x1008f0f2
lea eax, [esp + 0x14]
push eax
lea ecx, [esi - 0xc]
push ecx
call fcn.1008c260
mov dword [esp + 0x38], 8
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1008f0bf
mov edx, dword [ecx]
mov eax, dword [edx + 0x78]
call eax
add esi, 0x9c
mov eax, 0x15
mov edi, esi
call fcn.101c4ed0
test al, al
je 0x1008f0e1
mov eax, 0x15
mov ebx, esi
call fcn.101c4d40
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x14]
jmp 0x1008f2e1
cmp eax, 0x19
jne 0x1008f132
mov esi, dword [esi + 0x20]
test esi, esi
je 0x1008f2ec
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp + 0x14]
setne cl
mov byte [esp + 0x18], cl
mov eax, dword [esp + 0x18]
push edx
push eax
mov edi, esi
call fcn.100744d0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x1d
jne 0x1008f2ab
push 0x17
lea edi, [eax - 0x1b]
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1008f14f
mov edi, 1
push edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1008f1c8
cmp byte [esi + 0x134], 0
jne 0x1008f17a
mov eax, dword [esi + 0x130]
test eax, eax
je 0x1008f173
call fcn.10059180
mov byte [esi + 0x134], 1
cmp dword [ebp + 0x10], 0x3c
jne 0x1008f278
lea edi, [esi + 0x9c]
mov eax, 0x1d
call fcn.101c4ed0
test al, al
je 0x1008f1a4
mov eax, 0x1d
mov ebx, edi
call fcn.101c4d40
lea eax, [esi - 0xc]
neg eax
push 0xc
sbb eax, eax
push 0xc
and eax, esi
push eax
push 0xc
push edi
mov edi, dword [esp + 0x28]
mov eax, 0x1d
call fcn.101c4c90
jmp 0x1008f278
cmp dword [ebp + 0x10], 0xc
jne 0x1008f20d
lea edi, [esi + 0x9c]
mov eax, 0x1d
call fcn.101c4ed0
test al, al
je 0x1008f1ee
mov eax, 0x1d
mov ebx, edi
call fcn.101c4d40
lea eax, [esi - 0xc]
neg eax
push 0x3c
sbb eax, eax
push 0x3c
and eax, esi
push eax
push 0x3c
push edi
mov edi, dword [esp + 0x28]
mov eax, 0x1d
call fcn.101c4c90
cmp byte [esi + 0x134], 0
mov eax, dword [esi + 0x130]
jne 0x1008f241
test eax, eax
je 0x1008f225
call fcn.10059180
mov byte [esi + 0x134], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, eax
je 0x1008f278
mov esi, eax
call fcn.10059320
test al, al
jne 0x1008f274
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx + 0x130]
call fcn.10059180
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [esp + 0x18]
mov esi, dword [esi + 0x1c]
test esi, esi
je 0x1008f2ec
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi]
mov edx, dword [edx + 0x78]
push eax
mov eax, dword [ebp + 8]
push ecx
push 0x1d
push eax
mov ecx, esi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x26
jne 0x1008f2ec
lea eax, [esp + 0x18]
push eax
add esi, 0xfffffff4
push esi
call fcn.1008c4e0
mov dword [esp + 0x38], 9
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1008f2d5
mov edx, dword [ecx]
mov eax, dword [edx + 0x58]
call eax
mov dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x1008f2ec
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10