Function at 0x10056960
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x2c
mov eax, dword [0x10132f1c]
xor eax, esp
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push edi
mov edi, dword [esp + 0x38]
test edi, edi
mov dword [esp + 4], ecx
jne 0x10056990
push eax
call fcn.10056600
add esp, 4
mov edi, eax
mov ebx, ebx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x100569ab
pop edi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100aa646
add esp, 0x2c
ret
push ebx
push ebp
push esi
push 5
push edi
call fcn.10033aa0
add esp, 8
test eax, eax
je 0x10056a3c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, eax
mov bl, bl
push 0
push edi
call fcn.10033a60
add esp, 8
mov ebx, eax
mov bh, bh
push 1
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov edi, edi
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
mov ebx, ebx
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
push edx
pop edx
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push ebp
call ebx
test eax, eax
je 0x10056a3c
push ebp
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10056a3c
mov esi, ebp
mov dl, dl
push ebp
call ebx
test eax, eax
je 0x10056a3c
jmp 0x10056a20
cmp esi, edi
je 0x10056a38
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
mov edi, edi
push esi
call ebx
test eax, eax
jne 0x10056a20
jmp 0x10056a3c
mov edi, ebp
mov cl, cl
mov eax, dword [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10056a43
sub eax, edx
mov ebx, eax
mov dl, dl
lea ebp, [ebx + ebx + 2]
push ebp
call fcn.100aa0a8
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
push ecx
pop ecx
test esi, esi
jne 0x10056a7e
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100aa646
add esp, 0x2c
ret
push ebp
push 0
push esi
call fcn.100aacb0
add esp, 0xc
push ebx
pop ebx
mov edx, dword [esp + 0x10]
add ebx, 1
push ebx
push esi
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, ebx
mov eax, esi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10056ab0
sub eax, edx
sar eax, 1
mov ch, ch
xchg ebx, eax
xchg ebx, eax
test eax, eax
jle 0x10056b4f
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
mov esi, esi
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov ebx, ebx
push eax
push eax
push 0x20
lea eax, [esp + 0x24]
push eax
push 1
push esi
push 0
push 0
call ebx
mov ah, ah
mov dword [esp + 0x10], 0
mov esi, esi
mov eax, dword [esp + 0x18]
xor edx, edx
mov dh, al
lea ecx, [esp + 0x10]
push ecx
push 0x9c4
push 1
movzx eax, ah
push 1
or edx, eax
push edx
push 0x286
push edi
call fcn.10033a10
add esp, 0x1c
xchg ebx, eax
xchg ebx, eax
add esi, 2
sub ebp, 1
jne 0x10056ad3
mov esi, dword [esp + 0x14]
push esi
call fcn.100aa16b
add esp, 4
mov ebx, ebx
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
pop ebx
pop edi
xor ecx, esp
mov eax, 1
call fcn.100aa646
add esp, 0x2c
ret