Function at 0x103169a
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x103b984]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x10316dc
mov eax, dword [eax + 0x14]
cmp eax, ebx
je 0x10316c0
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10316ca
call fcn.0101df4e
call fcn.01009823
push 0xfffffffffffffff7
mov dword [0x103aab4], 1
pop eax
jmp 0x1031909
cmp dword [0x103d560], ebx
je 0x10316ef
call fcn.01023afd
mov dword [0x103d560], ebx
cmp dword [0x103ba24], ebx
jne 0x1031712
call fcn.010238e2
test eax, eax
jne 0x1031708
or eax, 0xffffffff
jmp 0x1031909
mov dword [0x103ba24], 1
push esi
push edi
xor edi, edi
inc edi
push edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
cmp esi, ebx
pop ecx
je 0x103172b
call fcn.0101df22
jmp 0x103172d
xor esi, esi
call fcn.01023692
call fcn.0102365d
push 0x150
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
je 0x1031754
mov ecx, eax
call fcn.0102c494
mov dword [0x103b984], eax
jmp 0x103175a
mov dword [0x103b984], ebx
mov eax, dword [0x103d498]
push ebx
push 0x1031302
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x103d5a0]
push 0x38d
push dword [0x103d4e8]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [0x103b984]
mov dword [ecx + 0x14], eax
mov eax, dword [0x103b984]
mov ecx, dword [eax + 0x14]
cmp ecx, ebx
jne 0x10317bb
cmp dword [eax + 4], 0xfffffffa
je 0x10318c5
push 2
call fcn.0101e025
mov eax, dword [0x103b984]
or dword [eax + 4], 0xffffffff
mov eax, dword [0x103b984]
jmp 0x10318c5
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, ebx
je 0x10317d0
push edi
mov ecx, esi
call fcn.0102c636
mov eax, dword [0x103b984]
mov dword [eax], edi
mov eax, dword [0x103b984]
cmp dword [eax], ebx
je 0x10318c5
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
cmp dword [ebp - 0x20], 0x100
jne 0x103188e
cmp dword [ebp - 0x1c], 9
jne 0x103188e
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x103188e
mov eax, dword [0x103b984]
push 0x38e
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebx
push ebx
push 0x130b
push eax
mov dword [ebp - 4], eax
call esi
mov edi, eax
push 0x10
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1031850
dec edi
jmp 0x1031851
inc edi
mov eax, dword [0x103b984]
mov eax, dword [eax + 0x20]
cmp edi, eax
jl 0x1031861
xor edi, edi
jmp 0x1031868
cmp edi, ebx
jge 0x1031868
lea edi, [eax - 1]
push ebx
push edi
mov edi, 0x130c
push edi
push dword [ebp - 4]
call esi
cmp eax, 0xffffffff
jne 0x1031884
push ebx
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call fcn.01031204
jmp 0x10318b8
lea eax, [ebp - 0x24]
push eax
mov eax, dword [0x103b984]
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_IsDialogMessageA]
test eax, eax
jne 0x10318b8
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x103b984]
cmp dword [eax], ebx
jne 0x10317ea
mov eax, dword [eax + 0x14]
cmp eax, ebx
je 0x10318e5
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10318e5
mov eax, dword [0x103b984]
push dword [eax + 0x14]
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.010236d1
call fcn.01023611
mov ecx, dword [0x103b984]
mov esi, dword [ecx + 4]
push 1
call fcn.0102c65c
pop edi
mov eax, esi
mov dword [0x103b984], ebx
pop esi
pop ebx
leave
ret