Function at 0x1009e350
Capabilities:
Log keystrokes

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1009e364
pop esi
pop ecx
ret
mov eax, dword [esp + 0x14]
test eax, eax
push ebx
push ebp
push edi
jne 0x1009e386
push eax
push eax
push 0x10
push esi
call fcn.10069c50
push ebx
pop ebx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 1
jne 0x1009e437
push esi
call fcn.10052e70
add esp, 4
mov esi, eax
mov dh, dh
push 4
push esi
call fcn.10069b40
add esp, 8
mov dl, dl
push 5
push esi
call fcn.10069b40
add esp, 8
push eax
pop eax
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call fcn.10069b60
add esp, 0x1c
push edx
pop edx
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebp
mov dh, dh
mov esi, esi
mov esi, esi
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
mov ebx, ebx
push 0
push esi
call fcn.10069c20
add esp, 8
mov ebx, eax
test eax, 0x2a1d
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov cl, cl
push esi
call ebp
test ebx, ebx
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test ah, ah
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call fcn.10069b60
add esp, 0x1c
mov dh, dh
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 2
jne 0x1009e454
push 7
push esi
call fcn.10069b40
add esp, 8
test edx, edx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 3
jne 0x1009e47b
push 0
push 0xf020
push 0x112
push esi
call fcn.10069bb0
add esp, 0x10
mov dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 4
jne 0x1009e498
push 3
push esi
call fcn.10069b40
add esp, 8
test edi, edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 5
jne 0x1009e4b5
push 4
push esi
call fcn.10069b40
add esp, 8
push edx
pop edx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 6
jne 0x1009e4d2
push 0
push esi
call fcn.10069b40
add esp, 8
test edi, edi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 7
jne 0x1009e4ef
push 5
push esi
call fcn.10069b40
add esp, 8
test eax, eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 8
jne 0x1009e530
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
push ecx
pop ecx
or eax, 8
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
test cl, cl
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call fcn.10069b60
add esp, 0x1c
test ah, ah
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 9
jne 0x1009e571
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test dh, dh
and eax, 0xfffffff7
push eax
push 0xffffffffffffffec
push esi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov edi, edi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call fcn.10069b60
add esp, 0x1c
test bh, bh
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xa
jne 0x1009e58f
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
test eax, 0x4d2
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xb
jne 0x1009e5aa
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
test dl, dl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xc
jne 0x1009e624
push esi
call fcn.10052e70
add esp, 4
mov esi, eax
mov edi, edi
mov eax, dword [esp + 0x18]
push esi
push eax
call fcn.1009e160
add esp, 8
mov eax, eax
mov ebp, dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call ebp
test eax, 0x32d1
test bl, bl
test ecx, ecx
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
test bl, bl
push 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call fcn.10069c20
add esp, 8
mov ebx, eax
nop
push 1
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test dl, dl
push esi
call ebp
test dh, dh
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push edx
pop edx
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xd
jne 0x1009e686
test bh, bh
lea ecx, [esp + 0x10]
push ecx
push esi
call fcn.10069c20
add esp, 8
mov bl, bl
mov edx, dword [esp + 0x10]
push 0
push 0
push edx
push 0
push 1
call fcn.10069630
add esp, 0x14
mov esi, eax
test eax, 0x2ebe
test esi, esi
je 0x1009e67e
push 0
push esi
call fcn.10069740
add esp, 8
mov dh, dh
push esi
call fcn.1004d3f0
add esp, 4
xchg ebx, eax
xchg ebx, eax
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret
cmp eax, 0xe
jne 0x1009e6b0
push esi
call fcn.10052e70
add esp, 4
mov cl, cl
push 0
push 0
push eax
call fcn.1009e230
add esp, 0xc
test esi, esi
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret
cmp eax, 0xf
jne 0x1009e6f7
test ecx, ecx
test eax, 0x4932
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov edi, eax
test eax, 0x4508
push 0
push esi
call fcn.10069c20
add esp, 8
mov ebx, eax
test ah, ah
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push ebx
push edi
call ebp
push ecx
pop ecx
push esi
call dword [sym.imp.USER32.dll_SetFocus]
test ch, ch
push 0
push ebx
push edi
call ebp
mov bl, bl
pop edi
pop ebp
pop ebx
mov eax, 1
pop esi
pop ecx
ret