Function at 0xa62400
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x68
mov eax, 0xafd0e0
call fcn.00af8e2b
mov ebx, ecx
mov ecx, dword [ebp + 8]
lea edx, [ebx + 0x10]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], edx
test ebx, ebx
je 0xa6242a
lock inc dword [edx]
and dword [ebp - 4], 0
mov eax, 0x84
mov edi, dword [ebp + 0xc]
cmp edi, eax
jbe 0xa624fb
mov eax, 0x31a
cmp edi, eax
jbe 0xa6259f
mov eax, edi
sub eax, 0x464
jne 0xa6260f
push 0x40
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00ab4bf6
mov ecx, dword [ebx + 0xcc]
add esp, 0xc
mov eax, dword [ecx]
push 0
mov esi, dword [eax + 0x34]
lea eax, [ebp - 0x60]
push eax
push ecx
cmp esi, fcn.00a60c70
jne 0xb26406
call fcn.00a60c70
cmp dword [ebp - 0x28], 0
jne 0xb26415
mov byte [ebp - 0x61], 0
push dword [ebx + 4]
and dword [ebp - 0x68], 0
xor esi, esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_IsWindowVisible]
test eax, eax
jne 0xa62524
cmp byte [ebp - 0x61], al
jne 0xa62524
mov eax, dword [ebp - 0x68]
movzx esi, si
shl esi, 0x10
movzx eax, ax
or esi, eax
test esi, esi
jne 0xa624d5
mov esi, dword [ebp - 0x6c]
push dword [ebp + 0x14]
push esi
push edi
push dword [ebx + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_DefWindowProcW]
mov esi, eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
test ebx, ebx
je 0xa624f1
and dword [ebp - 0x74], 0
mov ecx, dword [ebp - 0x70]
lock xadd dword [ecx], eax
dec eax
je 0xb26476
mov eax, esi
call fcn.00af8dd5
ret 0x10
je 0xb26301
cmp edi, 0x14
jbe 0xa62575
mov eax, edi
sub eax, 0x21
je 0xb262f9
sub eax, 0x60
je 0xa62642
sub eax, 1
jne 0xa624c5
jmp 0xb262ea
cmp byte [ebx + 0x29], 0
jne 0xb26428
push 6
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
lea eax, [eax*2 + 0x22]
push 6
mov dword [ebp - 0x68], eax
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
mov esi, dword [ebx + 0x14]
push 0x60
push esi
push dword [ebp - 0x68]
lea edi, [eax*2 + 0x20]
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
push 0x60
push esi
push edi
mov dword [ebp - 0x68], eax
call dword [sym.imp.api_ms_win_core_largeinteger_l1_1_0.dll_MulDiv]
mov edi, dword [ebp + 0xc]
mov esi, eax
jmp 0xa624b0
je 0xa625fd
mov eax, edi
sub eax, 1
je 0xa62636
sub eax, 4
je 0xa625f4
sub eax, 3
je 0xb26337
sub eax, 7
jne 0xa624c5
jmp 0xa625e2
je 0xb263fa
mov eax, pe_nt_image_headers32
cmp edi, eax
jb 0xa624c5
cmp edi, 0x102
jbe 0xb26355
cmp edi, 0x103
jbe 0xa624c5
cmp edi, 0x106
jbe 0xb26355
cmp edi, 0x318
jne 0xa624c5
push ecx
push esi
push edi
push ecx
mov ecx, ebx
call fcn.00aae153
mov esi, eax
jmp 0xa624be
mov ecx, ebx
call fcn.00a8fd2c
jmp 0xa625ed
cmp dword [ebx + 0x18], 0
je 0xb262cd
xor esi, esi
inc esi
jmp 0xa624d5
sub eax, 0x14
je 0xa6264a
sub eax, 0x140
jne 0xa624c5
mov ecx, dword [ebx + 4]
call fcn.00a5e592
mov ecx, ebx
mov dword [ebx + 0x14], eax
call fcn.00a4825f
jmp 0xa624c5
push ecx
push ecx
push ecx
mov ecx, ebx
call fcn.00ab0f35
jmp 0xa625ed
lock inc dword [edx]
jmp 0xa624c5
push dword [ebp + 0x14]
push ecx
push ecx
mov ecx, ebx
call fcn.00a8d65c
jmp 0xa625ed
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetClientRect]
push 0x10
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
jmp 0xa62607
sub esp, 0xc
mov ecx, ebx
call fcn.00ba06e7
jmp 0xa625ed
push 3
pop esi
jmp 0xa624d5
mov edi, dword [ebx + 0xcc]
push edi
mov eax, dword [edi]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 0x68]
mov edx, eax
push edi
push dword [ebp + 0x14]
call fcn.00a37404
test al, al
je 0xb26331
or esi, 0xffffffff
jmp 0xa624d5
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x6c]
cmp esi, dword [ebx + 0x2c]
je 0xa624c5
cmp esi, dword [ebx + 0x30]
je 0xa624c5
mov ecx, ebx
call fcn.00b9edd4
jmp 0xa624c5
cmp edi, 0x101
jne 0xb2638c
mov al, byte [ebx + 0x52]
test al, al
jne 0xb26369
cmp byte [ebx + 0x4f], al
je 0xb263e0
cmp esi, 0x20
je 0xb26373
cmp esi, 0xd
jne 0xb263e0
test al, al
je 0xb2637b
push 0
jmp 0xb26383
cmp byte [ebx + 0x4f], 0
je 0xb263d9
push 1
mov ecx, ebx
call fcn.00b9ee1d
jmp 0xb263d9
cmp edi, eax
je 0xb26398
cmp edi, 0x104
jne 0xb263e0
cmp byte [ebx + 0x4f], 0
je 0xb263e0
cmp esi, 0x5d
je 0xb263b5
cmp esi, 0x79
jne 0xb263e0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0xb263e0
push 3
pop eax
cmp dword [ebx + 0x24], eax
je 0xb263cd
push 0
push 0
push dword [ebx + 0x30]
mov dword [ebx + 0x24], eax
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
push ecx
push ecx
push dword [ebx + 0x30]
mov ecx, ebx
call fcn.00ba04cd
xor esi, esi
jmp 0xa624d5
push dword [ebp + 0x14]
push esi
push edi
push dword [ebx + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetParent]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
jmp 0xa625ed
mov ecx, ebx
call fcn.00a4825f
jmp 0xa625ed
mov ecx, esi
call dword [0xc99200]
call esi
jmp 0xa6248a
cmp dword [ebp - 0x58], 0
mov byte [ebp - 0x61], 1
je 0xa62498
jmp 0xa62494
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0xa6252e
cmp dword [ebx + 0x1c], 1
jbe 0xb26450
push 6
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
lea eax, [eax*4 + 0x36]
jmp 0xa6253d
test eax, eax
je 0xa6252e
cmp dword [ebx + 0x1c], 1
jne 0xa6252e
push 6
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
lea eax, [eax*2 + 0x14]
jmp 0xa6253d
mov ecx, ebx
call fcn.00b9ecc8
push 0xd0
push ebx
call fcn.00ab420c
pop ecx
pop ecx
jmp 0xa624f1