Function at 0x10075530
Capabilities:
Log keystrokes

Disassembly:
push 0xffffffffffffffff
push 0x101d4a71
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10293044]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
xor ebx, ebx
xor ebp, ebp
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x34], ebp
mov esi, dword [esp + 0x3c]
mov eax, dword [esi + 0x18]
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
mov ecx, dword [esi + 0x18]
push ecx
call edi
test eax, eax
je 0x100757f3
cmp dword [esi + 0x30], ebp
je 0x100757f3
mov edx, dword [esp + 0x40]
push edx
call edi
test eax, eax
jne 0x10075599
mov dword [esp + 0x40], ebp
mov esi, dword [esp + 0x44]
cmp esi, ebp
mov dword [esp + 0x18], ebp
je 0x100755c9
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call edx
mov byte [esp + 0x34], 1
mov ebx, 1
mov dword [esp + 0x1c], ebx
cmp dword [eax], ebp
mov byte [esp + 0x16], bl
jne 0x100755ce
mov byte [esp + 0x16], 0
mov dword [esp + 0x34], ebp
test bl, 1
je 0x100755ed
and ebx, 0xfffffffe
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x20]
cmp ecx, ebp
je 0x100755ed
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
cmp byte [esp + 0x16], 0
je 0x10075639
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call edx
mov byte [esp + 0x34], 2
mov ecx, dword [eax]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov edi, eax
mov dword [esp + 0x18], edi
mov byte [esp + 0x34], 0
mov ecx, dword [esp + 0x20]
cmp ecx, ebp
je 0x1007562a
mov eax, dword [ecx]
mov edx, dword [eax + 4]
call edx
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10075639
mov dword [esp + 0x18], ebp
mov byte [esp + 0x16], 0
mov byte [esp + 0x17], 0
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, dword [esp + 0x40]
mov ebp, eax
cmp edi, ebp
mov eax, dword [esp + 0x3c]
mov ebx, dword [eax + 0x18]
mov dword [esp + 0x28], ebx
je 0x100756b0
cmp ebx, ebp
je 0x10075798
test ebp, ebp
je 0x100756b0
test edi, edi
je 0x10075798
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10075798
push 0
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call edi
push 0
push ebx
mov esi, eax
call edi
push 0
push ebp
mov dword [esp + 0x2c], eax
call edi
cmp esi, eax
mov cl, 1
je 0x100756a6
mov cl, byte [esp + 0x16]
cmp dword [esp + 0x24], eax
jne 0x100756d8
mov al, 1
jmp 0x100756dc
cmp ebx, ebp
je 0x10075798
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
call edi
mov esi, eax
xor eax, eax
test ebp, ebp
je 0x100756cf
push eax
push ebp
call edi
cmp eax, esi
jne 0x100756ec
jmp 0x10075794
mov al, byte [esp + 0x17]
test cl, cl
je 0x10075794
test al, al
jne 0x10075794
mov esi, dword [esp + 0x40]
test esi, esi
je 0x10075794
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10075756
push esi
call dword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
jne 0x10075756
call fcn.10073100
test al, al
jne 0x10075756
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0
mov ecx, esi
push ecx
mov ebp, eax
call edi
mov edi, eax
xor bl, bl
cmp ebp, edi
je 0x1007573d
push 1
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
setne bl
mov esi, dword [esp + 0x28]
call fcn.101c72c0
test bl, bl
je 0x1007575d
push 0
push edi
push ebp
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1007575d
mov esi, ebx
call fcn.101c72c0
mov edx, dword [esp + 0x3c]
mov esi, dword [edx + 0x30]
test esi, esi
je 0x10075794
push ecx
mov ecx, dword [esp + 0x48]
test ecx, ecx
mov eax, esp
mov dword [esp + 0x44], esp
mov dword [eax], ecx
je 0x1007577f
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
mov byte [esp + 0x38], 3
mov eax, dword [esi]
add eax, 0x4c
mov byte [esp + 0x38], 0
mov eax, dword [eax]
mov ecx, esi
call eax
mov esi, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
test ebp, ebp
je 0x100757d1
mov edi, dword [esp + 0x18]
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push edi
call ebx
test eax, eax
je 0x100757d1
test edi, edi
je 0x100757c7
push edi
call ebx
test eax, eax
je 0x100757c7
push edi
call dword [sym.imp.USER32.dll_IsHungAppWindow]
test eax, eax
je 0x100757cd
mov byte [ebp], 1
jmp 0x100757d1
mov byte [ebp], 0
mov edi, dword [esp + 0x3c]
call fcn.10075bb0
mov dword [esp + 0x34], 0xffffffff
test esi, esi
je 0x100757ef
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
mov al, 1
jmp 0x1007580c
mov dword [esp + 0x34], 0xffffffff
mov ecx, dword [esp + 0x44]
cmp ecx, ebp
je 0x1007580a
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 0x10