Function at 0x100012a0
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x100
lea eax, [esp + 0xf0]
mov ecx, esp
mov dword [ecx], 0x31
mov ecx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esp + 0xcc], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 8], 0x560
mov dword [ecx + 4], 0x401
mov dword [ecx], 0x8c9
mov ecx, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov word [esp + 0xca], ax
call ecx
sub esp, 0xc
xor ecx, ecx
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc0], ecx
mov eax, dword [esp + 0xc0]
mov ecx, esp
mov dword [ecx], 0x754
mov ecx, dword [sym.imp.USER32.dll_IsWinEventHookInstalled]
mov dword [esp + 0xbc], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0xa78
mov dword [ecx], 0x7b4eb9
mov ecx, dword [sym.imp.USER32.dll_ShowWindowAsync]
mov dword [esp + 0xb8], eax
call ecx
sub esp, 8
mov ecx, dword [sym.imp.USER32.dll_GetClipboardViewer]
mov dword [esp + 0xb4], eax
call ecx
mov ecx, esp
mov dword [ecx + 4], 0x58
mov dword [ecx], 0xf82bdf
mov ecx, dword [sym.imp.KERNEL32.dll_TransmitCommChar]
mov dword [esp + 0xb0], eax
call ecx
sub esp, 8
xor ecx, ecx
mov dword [esp + 0xac], eax
mov dword [esp + 0xa8], ecx
jmp 0x10001485
lea esp, [ebp - 4]
pop esi
pop ebp
ret
mov eax, esp
mov dword [eax], 0x722d9a
mov eax, dword [sym.imp.USER32.dll_DestroyCursor]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx], 0x216148
mov ecx, dword [sym.imp.USER32.dll_SetActiveWindow]
mov dword [esp + 0xa4], eax
call ecx
sub esp, 4
mov dword [esp + 0xa0], eax
jmp 0x1000141d
mov eax, esp
mov dword [eax + 4], 0x1ef
mov dword [eax], 0x1ef
mov eax, dword [sym.imp.ADVAPI32.dll_AreAnyAccessesGranted]
call eax
sub esp, 8
mov ecx, esp
mov dword [ecx + 0xc], 0x104fd6c4
mov dword [ecx + 8], 0x8e8
mov dword [ecx + 4], 0x8e8
mov dword [ecx], str.IOtUfk__m
mov ecx, dword [sym.imp.SHLWAPI.dll_StrCatChainW]
mov dword [esp + 0x9c], eax
call ecx
sub esp, 0x10
mov dword [esp + 0x98], eax
jmp 0x10001970
mov eax, dword [esp + 0x94]
add eax, 1
cmp eax, 0x146
mov dword [esp + 0xa8], eax
jne 0x10001485
mov eax, esp
mov dword [eax], 0xb1080
mov eax, dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
call eax
sub esp, 4
mov ecx, dword [esp + 0xbc]
sub ecx, 9
mov dword [esp + 0x90], eax
mov dword [esp + 0x8c], ecx
je 0x10001970
jmp 0x10001469
mov eax, dword [esp + 0xbc]
sub eax, 0x1e
mov dword [esp + 0x88], eax
je 0x100013c9
jmp 0x10001510
mov eax, dword [esp + 0xa8]
mov ecx, 0xaf286bcb
mov dword [esp + 0x94], eax
mul ecx
mov eax, dword [esp + 0x94]
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x13
mov ecx, dword [esp + 0x94]
sub ecx, eax
mov eax, ecx
sub eax, 0xa
mov dword [esp + 0x84], ecx
mov dword [esp + 0x80], eax
je 0x10001394
jmp 0x100014d1
mov eax, dword [esp + 0x84]
sub eax, 4
mov dword [esp + 0x7c], eax
jne 0x1000141d
jmp 0x100014e7
mov eax, esp
mov dword [eax + 8], 0xd47
mov dword [eax + 4], 0x2e4c28
mov dword [eax], 0xe91480
mov eax, dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
call eax
sub esp, 0xc
mov dword [esp + 0x78], eax
jmp 0x10001394
mov byte [esp + 0xe7], 8
mov eax, esp
lea ecx, [esp + 0xe7]
mov dword [eax + 8], ecx
lea ecx, [esp + 0xe8]
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0xe5b
mov dword [eax], 0x3a7311
mov eax, dword [sym.imp.GDI32.dll_PolyDraw]
call eax
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x74], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x70], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x6c], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x68], eax
call ecx
sub esp, 0x10
mov dword [esp + 0x64], eax
mov eax, esp
lea ecx, [esp + 0xd0]
mov dword [eax], ecx
mov dword [eax + 0x10], 0xd7b
mov dword [eax + 0xc], 0x623
mov dword [eax + 8], 0x549
mov dword [eax + 4], 0x549
mov eax, dword [sym.imp.USER32.dll_SetRect]
call eax
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x60], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x5c], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x58], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x54], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x50], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x4c], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x48], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x44], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x40], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x3c], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x38], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x34], eax
call ecx
sub esp, 0x14
mov byte [esp + 0xe7], 8
mov ecx, esp
lea edx, [esp + 0xe7]
mov dword [ecx + 8], edx
lea edx, [esp + 0xe8]
mov dword [ecx + 4], edx
mov dword [ecx + 0xc], 0xe5b
mov dword [ecx], 0x3a7311
mov ecx, dword [sym.imp.GDI32.dll_PolyDraw]
mov dword [esp + 0x30], eax
call ecx
sub esp, 0x10
mov ecx, esp
lea edx, [esp + 0xd0]
mov dword [ecx], edx
mov dword [ecx + 0x10], 0xd7b
mov dword [ecx + 0xc], 0x623
mov dword [ecx + 8], 0x549
mov dword [ecx + 4], 0x549
mov ecx, dword [sym.imp.USER32.dll_SetRect]
mov dword [esp + 0x2c], eax
call ecx
sub esp, 0x14
mov dword [esp + 0x28], eax
jmp 0x100019dc
mov eax, dword [esp + 0xcc]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov esi, esp
mov dword [esi + 4], edx
mov dword [esi], ecx
mov dword [esi + 8], 0xf39
mov ecx, dword [sym.imp.USER32.dll_MonitorFromPoint]
call ecx
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 4], 0x9c5
mov dword [ecx], str.1JT6pq0v
mov ecx, dword [sym.imp.ole32.dll_OleGetIconOfFile]
mov dword [esp + 0x24], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 8], 0x46c13
mov dword [ecx + 4], 0xf78e58
mov dword [ecx], 0xa0aa7d
mov ecx, dword [sym.imp.GDI32.dll_FillRgn]
mov dword [esp + 0x20], eax
call ecx
sub esp, 0xc
mov dword [esp + 0x1c], eax
mov eax, esp
mov dword [eax], 0x583d4d
mov eax, dword [sym.imp.KERNEL32.dll_CancelIo]
call eax
sub esp, 4
mov ecx, dword [esp + 0xbc]
add ecx, 1
cmp ecx, 0x69
mov dword [esp + 0x18], eax
mov dword [esp + 0xc0], ecx
je 0x1000138e
jmp 0x10001307