Function at 0x1000c900
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x1003b010]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov byte [esp + 0x16], 0
call fcn.1000bec0
test al, al
jne 0x1000c938
mov ecx, esi
call fcn.1000c170
test al, al
je 0x1000ca43
mov ecx, esi
call fcn.1000bec0
test al, al
jne 0x1000c952
mov ecx, esi
call fcn.1000c170
test al, al
je 0x1000ca43
mov ecx, esi
call fcn.1000bec0
test al, al
jne 0x1000c96c
mov ecx, esi
call fcn.1000c170
test al, al
je 0x1000ca43
movzx eax, word [edi]
test ax, ax
je 0x1000ca3b
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
mov dword [esp + 0x1c], eax
shr eax, 8
mov cl, al
mov dword [esp + 0x18], eax
and cl, 1
mov byte [esp + 0x17], cl
je 0x1000c9ae
push 0
push 0
push 0
push 0x10
call esi
mov eax, dword [esp + 0x18]
mov cl, al
and cl, 2
mov byte [esp + 0x16], cl
je 0x1000c9c7
push 0
push 0
push 0
push 0x11
call esi
mov eax, dword [esp + 0x18]
and al, 4
mov dword [esp + 0x18], eax
je 0x1000c9d9
push 0
push 0
push 0
push 0x12
call esi
mov al, byte [esp + 0x1c]
push 0
push 0
push 0
push eax
mov dword [esp + 0x2c], eax
call esi
push 0
push 2
push 0
push dword [esp + 0x28]
call esi
cmp byte [esp + 0x18], 0
je 0x1000ca07
push 0
push 2
push 0
push 0x12
call esi
cmp byte [esp + 0x16], 0
je 0x1000ca18
push 0
push 2
push 0
push 0x11
call esi
cmp byte [esp + 0x17], 0
je 0x1000ca29
push 0
push 2
push 0
push 0x10
call esi
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
test ax, ax
jne 0x1000c980
mov al, 1
mov byte [esp + 0x16], al
jmp 0x1000ca47
mov al, byte [esp + 0x16]
cmp dword [0x1003ba60], 2
jg 0x1000cc4b
mov eax, dword [0x1003ba5c]
test eax, eax
je 0x1000ca6b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1003ba5c]
cmp dword [0x1003ba58], 0
je 0x1000cc3c
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x30]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x34]
push eax
push str._04d__02d__02d__02d:_02d:_02d
push dword [0x1003ba58]
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0x20
test eax, eax
je 0x1000cc37
push str._C:UserschemiuSourceReposAudyxNoahAudyxPluginNativeUIAutomationClientuiautomation.cpp
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push 0x10036b64
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push 0xea
push 0x1003726c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push 0x10036b68
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push str.AutomationElement::manualSetText
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push 0x10036a2c
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push 0x10037298
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push 0x10036a2c
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push str.Returning
push 0x1003725c
push eax
call fcn.1000b710
mov ecx, dword [0x1003ba58]
add esp, 0xc
test ecx, ecx
je 0x1000cc37
cmp byte [esp + 0x16], 0
mov edx, str.false
mov eax, str.true
cmove eax, edx
push eax
push 0x1003725c
push ecx
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push 0x10037270
push 0x1003725c
push eax
call fcn.1000b710
mov eax, dword [0x1003ba58]
add esp, 0xc
test eax, eax
je 0x1000cc37
push eax
call fcn.10015d4e
add esp, 4
mov eax, dword [0x1003ba5c]
test eax, eax
je 0x1000cc47
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [esp + 0x16]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1000e891
mov esp, ebp
pop ebp
ret 4