Function at 0x6866b4
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff9c
push ebx
push esi
mov byte [ebp - 0x11], cl
mov ebx, edx
mov dword [ebp - 0x10], eax
lea esi, [ebp - 0x48]
mov eax, dword [ebp - 0x10]
call fcn.00682d64
cmp byte [ebp - 0x11], 0
je 0x6866e1
mov eax, dword [ebp - 0x10]
or byte [eax + 0xaa], 0x40
jmp 0x6866eb
mov eax, dword [ebp - 0x10]
and byte [eax + 0xaa], 0xbf
mov eax, dword [ebp - 0x10]
or byte [eax + 0xaa], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xbc]
call fcn.0061e3c8
call fcn.0067ecac
xor eax, eax
push ebp
push 0x686e66
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x686e16
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
mov byte [ebp - 7], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
test bl, bl
je 0x68679c
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00415450
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa4]
call fcn.00682a1c
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa4]
mov ecx, dword [ebp - 0x1c]
movzx edx, word [0x686e78]
mov ebx, dword [eax]
call dword [ebx + 0x2c]
cmp byte [ebp - 7], 0
je 0x686798
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
mov byte [ebp - 8], 0
mov eax, dword [ebp - 0x10]
test byte [eax + 0xaa], 0x40
je 0x6867b4
movzx edx, byte [ebp + 0x10]
mov eax, dword [ebp - 0x10]
call fcn.00683584
mov byte [ebp - 0x12], 1
jmp 0x686df3
cmp byte [ebp - 0x12], 0
jne 0x6867c8
call sub.user32.dll_WaitMessage
mov byte [ebp - 0x12], 0
jmp 0x686dd4
mov eax, dword [esi + 4]
sub eax, 0x201
je 0x6867e4
sub eax, 3
jne 0x6868d7
lea edx, [ebp - 0x1c]
mov eax, dword [esi + 0xc]
call fcn.00415450
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [esi]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0x1c]
mov dl, 1
call fcn.006134b4
mov ebx, eax
mov eax, ebx
mov edx, dword [0x67e5a4]
call fcn.004088e0
test al, al
je 0x68682e
mov edx, dword [ebx + 0x294]
mov eax, dword [ebp - 0x10]
call fcn.00682ca8
test al, al
jne 0x6868d7
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x68], 0
jne 0x68687a
mov eax, dword [ebp - 0x10]
cmp ebx, dword [eax + 0xbc]
jne 0x68687a
lea ecx, [ebp - 0x50]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xbc]
call fcn.00614cc4
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea edx, [ebp - 0x64]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xbc]
mov ecx, dword [eax]
call dword [ecx + 0x60]
lea eax, [ebp - 0x64]
push eax
call sub.user32.dll_PtInRect
test eax, eax
jne 0x686889
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
cmp dword [esi + 4], 0x201
jne 0x6868d7
push ebp
lea eax, [ebp - 0x1c]
mov dl, 1
call fcn.006861f8
pop ecx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0xa4], 0
je 0x6868c8
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x80], 0
je 0x6868c8
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xa4]
mov eax, dword [eax + 0x18]
test byte [eax + 0x6c], 0x10
je 0x6868d7
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
push 3
push 0
push 0
push 0
push esi
call sub.user32.dll_PeekMessageW
test eax, eax
je 0x686dd4
mov eax, dword [esi + 4]
cmp eax, 0x113
jg 0x686915
je 0x686ad2
sub eax, 0x7b
je case.0x686b4b.518
add eax, 0xffffff7b
sub eax, 0xa
jb 0x686933
jmp 0x686d8f
sub eax, 0x118
je case.0x686b4b.518
add eax, 0xffffff18
sub eax, 0xf
jb 0x686b33
jmp 0x686d8f
mov eax, dword [0xa8f188]
mov eax, dword [eax]
call fcn.005edf28
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x686961
cmp byte [ebp + 0xc], 0
je 0x68695d
push 2
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x686961
xor eax, eax
jmp 0x686963
mov al, 1
mov byte [ebp - 0x22], al
mov eax, dword [esi + 4]
sub eax, 0x100
je 0x686984
sub eax, 2
je 0x6869f4
sub eax, 2
je 0x686984
sub eax, 2
je 0x6869f4
jmp case.0x686b4b.518
cmp dword [esi + 8], 0xe5
jne 0x686998
mov eax, dword [esi]
push eax
call sub.imm32.dll_ImmGetVirtualKey
mov dword [esi + 8], eax
cmp byte [ebp - 0x22], 0
je 0x6869a8
cmp dword [esi + 8], 0x70
jne case.0x686b4b.518
movzx eax, word [esi + 8]
mov word [ebp - 0x24], ax
push ebp
mov eax, dword [esi + 0xc]
call fcn.005e062c
push eax
push ebp
call fcn.00686150
pop ecx
lea edx, [ebp - 0x24]
pop ecx
call fcn.00686414
pop ecx
test al, al
je 0x6869de
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
cmp word [ebp - 0x24], 0
je case.0x686b4b.518
push esi
call sub.user32.dll_TranslateMessage
jmp case.0x686b4b.518
cmp byte [ebp - 0x22], 0
jne case.0x686b4b.518
push ebp
call fcn.00686150
pop ecx
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x21]
push eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp - 0x20]
mov edx, dword [eax + 0xa4]
mov eax, dword [ebp - 0x20]
call fcn.00685984
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jne 0x686a87
mov eax, dword [esi + 8]
sub eax, 0x20
je 0x686a38
sub eax, 0xd
jne 0x686a7b
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x68], 0
jne 0x686a7b
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jne 0x686a7b
call sub.user32.dll_GetActiveWindow
test eax, eax
je 0x686a7b
mov eax, dword [ebp - 4]
mov byte [eax], 2
call sub.user32.dll_GetActiveWindow
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
push 0
call sub.user32.dll_MessageBeep
jmp case.0x686b4b.518
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
call fcn.00683668
cmp byte [ebp - 0x21], 0
je 0x686ac5
mov word [ebp - 0x24], 0xd
push ebp
lea edx, [ebp - 0x24]
movzx ecx, word [0x686e78]
mov eax, dword [ebp - 0x20]
call fcn.00686414
pop ecx
test al, al
je 0x686ac5
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
mov eax, dword [ebp - 0x20]
call fcn.006860d8
jmp case.0x686b4b.518
mov eax, dword [esi]
call fcn.0061196c
mov ebx, eax
test ebx, ebx
je 0x686b28
mov eax, ebx
mov edx, dword [0x67e5a4]
call fcn.004088e0
test al, al
je 0x686b28
cmp dword [esi + 8], 0x2328
jb 0x686b28
cmp dword [esi + 8], 0x232b
ja 0x686b28
cmp dword [ebx + 0x294], 0
je case.0x686b4b.518
mov edx, dword [esi + 8]
sub edx, 0x2328
mov eax, dword [ebx + 0x294]
call fcn.0068663c
jmp case.0x686b4b.518
push esi
call sub.user32.dll_DispatchMessageW
jmp case.0x686b4b.518
mov eax, dword [esi + 4]
add eax, 0xfffffe00
cmp eax, 0xa
ja case.0x686b4b.518
movzx eax, byte [eax + 0x686b52]
jmp dword [eax*4 + 0x686b5d]
mov eax, dword [esi + 0x14]
cmp eax, dword [0xa95594]
jne 0x686b87
mov eax, dword [esi + 0x18]
cmp eax, dword [0xa95598]
je 0x686ba0
mov eax, dword [esi + 0x14]
mov dword [0xa95594], eax
mov eax, dword [esi + 0x18]
mov dword [0xa95598], eax
push ebp
call fcn.006864bc
pop ecx
push ebp
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.00686390
pop ecx
test al, al
je case.0x686b4b.518
lea ecx, [ebp - 0x1c]
lea edx, [esi + 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.00682a1c
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
call dword [ebx + 0x30]
jmp case.0x686b4b.518
push ebp
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.00686390
pop ecx
test al, al
je case.0x686b4b.518
lea ecx, [ebp - 0x1c]
lea edx, [esi + 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.00682a1c
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
movsx edx, word [esi + 0xa]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
call dword [ebx + 0x38]
jmp case.0x686b4b.518
cmp dword [esi + 4], 0x204
setne al
or al, byte [ebp + 0xc]
je case.0x686b4b.518
mov eax, dword [0xa8f188]
mov eax, dword [eax]
call fcn.005edf28
mov byte [ebp - 8], 0
mov eax, dword [ebp - 0x10]
and byte [eax + 0xaa], 0xef
push ebp
lea eax, [esi + 0x14]
mov dl, 1
call fcn.006861f8
pop ecx
push ebp
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.00686390
pop ecx
test al, al
je case.0x686b4b.518
cmp dword [esi + 4], 0x203
je 0x686c7d
movzx eax, word [0x686e78]
mov word [ebp - 0x26], ax
jmp 0x686c88
movzx eax, word [0x686e7c]
mov word [ebp - 0x26], ax
lea ecx, [ebp - 0x1c]
lea edx, [esi + 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.00682a1c
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ebp - 0x26]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
call dword [ebx + 0x2c]
cmp byte [ebp - 7], 0
je 0x686cc2
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00415450
mov eax, dword [ebp - 0x50]
mov dword [0xa95594], eax
mov eax, dword [ebp - 0x4c]
mov dword [0xa95598], eax
jmp case.0x686b4b.518
cmp dword [esi + 4], 0x202
sete al
or al, byte [ebp + 0xc]
je case.0x686b4b.518
push ebp
lea eax, [esi + 0x14]
xor edx, edx
call fcn.006861f8
pop ecx
push ebp
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x20]
call fcn.00686390
pop ecx
test al, al
jne 0x686d5a
cmp dword [ebp - 0x20], 0
je 0x686d33
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x10]
jne case.0x686b4b.518
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x69], 0
je case.0x686b4b.518
mov eax, dword [ebp - 0x10]
test byte [eax + 0xaa], 0x10
jne 0x686d4e
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
mov eax, dword [ebp - 0x10]
and byte [eax + 0xaa], 0xef
jmp case.0x686b4b.518
lea ecx, [ebp - 0x1c]
lea edx, [esi + 0x14]
mov eax, dword [ebp - 0x2c]
call fcn.00682a1c
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov ebx, dword [eax]
call dword [ebx + 0x34]
cmp byte [ebp - 7], 0
je case.0x686b4b.518
call fcn.00409a4c
call fcn.00409a4c
jmp 0x686e6d
push esi
call sub.user32.dll_DispatchMessageW
cmp dword [0xa95594], 0x80000000
jne 0x686dcd
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00415450
mov eax, dword [ebp - 0x50]
mov dword [0xa95594], eax
mov eax, dword [ebp - 0x4c]
mov dword [0xa95598], eax
push ebp
call fcn.006864bc
pop ecx
push ebp
call fcn.006865b0
pop ecx
call fcn.00686404
test al, al
je 0x686df3
push 0
push 0
push 0
push 0
push esi
call sub.user32.dll_PeekMessageW
test eax, eax
jne 0x6867d1
call fcn.00686404
test al, al
jne 0x6867bd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x686e1d
mov eax, dword [ebp - 0x10]
call fcn.00685bf8
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc