Function at 0x1000803f
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x40
mov eax, 0x10178e9f
call fcn.10145d80
mov esi, ecx
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
je 0x100084f1
mov eax, dword [ebp + 8]
sub eax, 0x200
je 0x10008436
dec eax
mov dword [esi + 0x50], ebx
je 0x10008427
dec eax
jne 0x100084f1
lea ecx, [esi + 0x64]
push 0x1019f188
call fcn.1000425b
mov dword [ebp + 0xc], ebx
lea eax, [ebp + 0xc]
push eax
mov ecx, 0x101f84b0
mov dword [ebp - 4], 3
call fcn.100e53b3
cmp dword [ebp + 0xc], ebx
je 0x100084f1
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
call fcn.101186b5
pop ecx
pop ecx
mov edi, 0x101f84e8
mov ecx, edi
mov byte [ebp - 4], 4
call fcn.10053722
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x101f844c
call fcn.1003bc9a
test eax, eax
jne 0x1000818e
cmp dword [ebp + 8], ebx
je 0x1000818e
mov ecx, edi
call fcn.10051f5a
test eax, eax
je 0x1000818e
mov ecx, edi
call fcn.10053a21
cmp eax, ebx
je 0x10008147
mov ecx, edi
call fcn.10051f5a
test eax, eax
je 0x10008147
mov eax, dword [esi + 0x84]
cmp eax, ebx
mov dword [esi + 0x78], 1
je 0x1000812d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x84], ebx
push ebx
push 0x5dc
push 0x2710
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [esi + 0x84], eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push eax
mov byte [ebp - 4], 5
call dword [ecx + 0x48]
cmp eax, ebx
mov eax, dword [ebp - 0x14]
jne 0x10008180
cmp eax, ebx
je 0x10008180
push eax
lea ecx, [ebp - 0x1c]
call fcn.100066d9
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
mov byte [ebp - 4], 6
jne 0x1000819e
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov byte [ebp - 4], 4
je 0x1000818e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x10]
call fcn.10003b75
mov eax, dword [ebp + 0xc]
jmp 0x100084e3
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x100081cb
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100081cb
push dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.100066f8
mov eax, dword [ebp - 0x28]
cmp eax, ebx
jne 0x100081de
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
mov byte [ebp - 4], 5
je 0x1000817d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1000817d
mov dword [ebp - 0x18], ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push eax
mov byte [ebp - 4], 8
call dword [ecx + 0x28]
cmp eax, ebx
jne 0x1000840c
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x1000840c
mov dword [ebp - 0x24], ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x24]
push edx
push eax
mov byte [ebp - 4], 9
call dword [ecx + 0x38]
push dword [ebp - 0x24]
lea ecx, [ebp + 8]
call fcn.10007b11
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
mov byte [ebp - 4], 0xa
call fcn.101186b5
pop ecx
pop ecx
lea eax, [ebp - 0x34]
push eax
mov ecx, 0x101f847c
mov byte [ebp - 4], 0xb
call fcn.1003bce4
test eax, eax
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
je 0x100083c5
push 0x1019f180
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
push 0x1019f17c
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
push str.INPUT
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
push str.EMBED
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
push str.OBJECT
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
push str.AREA
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
push 0x1019f140
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
push str.IFRAME
push dword [ebp + 8]
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x1000830a
lea ecx, [ebp - 0x34]
call fcn.10003b75
lea ecx, [ebp + 8]
call fcn.10003b75
push dword [ebp - 0x24]
call edi
jmp 0x100083e1
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.1000669b
mov eax, dword [ebp - 0x30]
cmp eax, ebx
je 0x10008352
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push eax
mov byte [ebp - 4], 0xd
call dword [ecx + 0x20]
push dword [ebp - 0x20]
lea ecx, [ebp - 0x48]
call fcn.10007b11
push eax
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 0xe
call fcn.10007845
lea ecx, [ebp - 0x48]
call fcn.10003b75
push dword [ebp - 0x20]
call edi
push dword [ebp - 0x18]
lea ecx, [ebp - 0x40]
call fcn.10006717
cmp dword [ebp - 0x40], ebx
je 0x100083a3
mov eax, dword [esi + 0x64]
cmp dword [eax - 8], ebx
jne 0x100083a3
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
lea edx, [ebp - 0x2c]
push edx
push eax
mov byte [ebp - 4], 0x10
call dword [ecx + 0x20]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
call fcn.10007b11
push eax
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 0x11
call fcn.10007845
lea ecx, [ebp - 0x4c]
call fcn.10003b75
push dword [ebp - 0x2c]
call edi
mov eax, dword [ebp - 0x40]
cmp eax, ebx
mov byte [ebp - 4], 0xc
je 0x100083b4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x30]
cmp eax, ebx
mov byte [ebp - 4], 0xb
je 0x100083c5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [ebp - 0x34]
mov dword [esi + 0x50], 1
call fcn.10003b75
lea ecx, [ebp + 8]
call fcn.10003b75
push dword [ebp - 0x24]
call edi
mov eax, dword [ebp - 0x18]
cmp eax, ebx
mov byte [ebp - 4], 7
je 0x100083f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x28]
cmp eax, ebx
mov byte [ebp - 4], 6
je 0x100081cb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100081cb
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x101f847c
call fcn.1003bce4
test eax, eax
jne 0x100083e1
mov dword [esi + 0x50], 1
jmp 0x100083e1
mov dword [esi + 0x80], 1
jmp 0x100084f1
xor eax, eax
inc eax
push eax
mov dword [esi + 0x80], eax
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x100084f1
mov dword [ebp + 8], ebx
lea eax, [ebp + 8]
push eax
mov ecx, 0x101f84b0
mov dword [ebp - 4], ebx
call fcn.100e53b3
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x100084f1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x20], ebx
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
push eax
mov byte [ebp - 4], 1
call dword [ecx + 0x48]
cmp eax, ebx
mov eax, dword [ebp - 0x20]
jne 0x100084d3
cmp eax, ebx
je 0x100084d5
push eax
lea ecx, [ebp - 0x38]
call fcn.100066d9
mov eax, dword [ebp - 0x38]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x100084d0
mov ecx, dword [eax]
lea edx, [ebp - 0x44]
push edx
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x100084b9
mov eax, dword [ebp - 0x44]
cmp eax, dword [edi + 8]
je 0x100084bf
mov dword [esi + 0x80], ebx
mov eax, dword [ebp - 0x38]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x100084d0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x100084e0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x100084f1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.10145e58
ret 8