Function at 0x10a8340
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x784]
xor ebx, ebx
push ebx
push 0xe
push edx
push edi
call fcn.01052b60
push 0x8dd9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x10a83ab
mov ecx, 0x14
mov eax, 0x53
mov dword [esi], 0x11
mov dword [esi + 0x1c], ebx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x140
mov dword [esi + 0x10], 0x64
mov dword [esi + 0x14], ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x8dbc], ebx
mov dword [esi + 0x8da8], 0xe
mov dword [esi + 0x8dac], ebx
mov dword [esi + 0x8db0], ebx
mov eax, dword [edi + 0x7c]
cmp dword [eax], ebx
jne 0x10a83d2
mov dword [eax], esi
jmp 0x10a83db
mov eax, dword [eax + 4]
mov dword [eax + 0x8dd4], esi
mov ecx, dword [edi + 0x7c]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 4], esi
mov dword [edx + 4], esi
mov eax, dword [edi + 4]
mov ecx, dword [eax + 0x29c]
call ecx
push ebx
push ebx
push esi
xor eax, 0x80001cc
push edi
mov dword [esi + 0x1c], eax
mov dword [esi + 0x88], ebx
call fcn.01042680
push 0x8dd9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
cmp esi, ebx
je 0x10a84c4
mov edx, dword [ebp + 0xc]
push ebx
mov dword [esi], 0xf
mov dword [esi + 0x20], 0x10a8240
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ebx
push ecx
push 0x21
push 0x140
push 0xc3
push 0x14
push 0x40800001
push ebx
push 0x1012b00
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 0x1c], eax
cmp eax, ebx
je 0x10a84c4
push 0xd
push ebx
push ebx
push edi
call fcn.01042a90
cmp eax, ebx
je 0x10a84c4
mov edx, dword [eax + 0xc]
mov dword [esi + 0x134], edx
cmp byte [esi + 0x28], bl
je 0x10a84aa
push 0xc
push 0x400
push ebx
push edi
call fcn.01042a90
cmp eax, ebx
je 0x10a84a2
mov eax, dword [eax + 0xc]
mov dword [esi + 0x130], eax
push esi
call fcn.01044a90
jmp 0x10a84b0
push esi
call fcn.01044a60
mov ecx, dword [esi + 0x1c]
lea eax, [esi + 0x28]
push eax
push 0x106feb0
push ecx
push esi
push edi
call fcn.01041310
mov dword [esi + 0x8dbc], ebx
mov dword [esi + 0x8da8], 0xe
mov dword [esi + 0x8dac], ebx
mov dword [esi + 0x8db0], ebx
mov eax, dword [edi + 0x7c]
cmp dword [eax], ebx
jne 0x10a84eb
mov dword [eax], esi
jmp 0x10a84f4
mov edx, dword [eax + 4]
mov dword [edx + 0x8dd4], esi
mov eax, dword [edi + 0x7c]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], esi
mov dword [ecx + 8], esi
mov edx, dword [edi]
mov eax, dword [edx]
mov ecx, dword [eax + 0x788]
mov eax, dword [edi + 0x64]
mov esi, dword [edi + 0x90]
sub eax, 0x3f
mov dword [ebp - 0xc], eax
mov eax, dword [edi + 0x60]
cdq
sub eax, edx
lea edx, [ebp - 4]
push edx
mov ebx, eax
push 0x23a
sar ebx, 1
push esi
mov dword [ebp - 8], ecx
sub ebx, 0x47
mov dword [ebp + 8], 0
call fcn.01041ff0
test eax, eax
je 0x10a8553
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push eax
push esi
mov dword [ebp + 8], ecx
call fcn.01041e80
push 0x8dd9
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x10a8620
mov edx, dword [ebp + 0xc]
mov dword [esi], 5
mov dword [esi + 0x450], edx
mov edx, dword [ebp - 8]
mov dword [esi + 0x1c], 0x23a
mov dword [esi + 0x20], 0x23b
mov dword [esi + 0x24], eax
mov dword [esi + 0x44c], 0x10a8240
mov dword [esi + 0x454], eax
mov dword [esi + 0x458], 0xb
cmp edx, eax
je 0x10a85cd
lea ecx, [esi + 0x2c]
cmp ecx, eax
je 0x10a85cd
push 0x1ff
push edx
push ecx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
mov dword [esi + 0x28], 1
mov dword [esi + 0x430], 6
mov dword [esi + 0x434], 0x616161
mov dword [esi + 0x438], eax
mov dword [esi + 0x43c], eax
mov dword [esi + 0x440], 8
mov dword [esi + 0x444], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], 0x8e
mov dword [esi + 0x10], edx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ecx
mov dword [esi + 0x8dbc], eax
mov dword [esi + 0x8da8], 0xe
mov dword [esi + 0x8dac], eax
mov dword [esi + 0x8db0], eax
mov ecx, dword [edi + 0x7c]
cmp dword [ecx], eax
jne 0x10a8647
mov dword [ecx], esi
jmp 0x10a8650
mov ecx, dword [ecx + 4]
mov dword [ecx + 0x8dd4], esi
mov edx, dword [edi + 0x7c]
push eax
push eax
push 0xe
push edi
mov dword [edx + 4], esi
call fcn.01045c00
mov eax, dword [edi + 8]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call ebx
mov esi, dword [edi + 8]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x10a8681
push 9
push esi
call ebx
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [edi + 8]
mov edx, dword [edi]
push ecx
add edx, 0x293b0
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov edi, dword [edi + 8]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
cmp ebx, edi
je 0x10a86f4
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
mov ebx, eax
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x10a86f4
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push ebx
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8