Function at 0x10099280
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x30
mov eax, dword [0x101af0fc]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push esi
mov esi, dword [esp + 0x40]
push edi
mov edi, dword [esp + 0x40]
test edi, edi
mov dword [esp + 8], esi
jne 0x100992b0
push eax
call fcn.10098800
add esp, 4
mov edi, eax
nop
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100992cc
pop edi
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1010190d
add esp, 0x30
ret
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x100992d1
push ebx
sub eax, edx
push ebp
mov esi, eax
test dh, dh
lea ebx, [esi + esi + 2]
push ebx
call fcn.1010136f
mov ebp, eax
add esp, 4
mov dword [esp + 0x18], ebp
test eax, 0x5c62
test ebp, ebp
jne 0x10099311
pop ebp
pop ebx
pop edi
pop esi
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.1010190d
add esp, 0x30
ret
push ebx
push 0
push ebp
call fcn.10102a00
add esp, 0xc
mov dh, dh
mov eax, dword [esp + 0x10]
add esi, 1
push esi
push ebp
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
nop
mov eax, ebp
lea edx, [eax + 2]
jmp 0x10099340
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10099340
sub eax, edx
sar eax, 1
mov dword [esp + 0x14], eax
test ch, ch
push 5
push edi
call fcn.10064ef0
add esp, 8
test eax, eax
je 0x100993ee
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
test ch, ch
push 0
push edi
call fcn.10064eb0
add esp, 8
mov ebx, eax
mov ebx, ebx
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
nop
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x10], eax
mov cl, cl
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, esi
mov esi, dword [esp + 0x10]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push esi
call ebx
test eax, eax
je 0x100993ee
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x100993ee
test eax, eax
mov ecx, esi
push ecx
call ebx
test eax, eax
je 0x100993ee
jmp 0x100993d0
cmp esi, edi
je 0x100993e8
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
test ch, ch
push esi
call ebx
test eax, eax
jne 0x100993d0
jmp 0x100993ee
mov edi, dword [esp + 0x10]
mov dl, dl
mov dl, dl
mov eax, dword [esp + 0x14]
test eax, eax
jle 0x1009947f
mov ebx, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov esi, ebp
mov ebp, eax
mov cl, cl
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov eax, eax
push eax
push eax
push 0x20
lea edx, [esp + 0x28]
push edx
push 1
push esi
push eax
push eax
call ebx
mov ebp, ebp
mov dword [esp + 0x10], 0
nop
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov ch, al
push 0x9c4
push 1
movzx edx, ah
push 1
or ecx, edx
push ecx
push 0x286
push edi
call fcn.10064e60
add esp, 0x1c
test eax, eax
add esi, 2
sub ebp, 1
jne 0x10099406
mov ebp, dword [esp + 0x18]
push ebp
call fcn.10101432
add esp, 4
test ebx, ebx
mov ecx, dword [esp + 0x3c]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1010190d
add esp, 0x30
ret