Function at 0x1018c76
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x9c69
mov ebx, ecx
xor edi, edi
cmp eax, esi
mov dword [ebp - 4], ebx
jg 0x1018dff
je 0x1018db3
cmp eax, 0x418
je 0x1019051
cmp eax, 0x419
je 0x1018fdc
cmp eax, 0x41a
je 0x1018eac
cmp eax, 0x755b
je 0x1018d64
lea ecx, [esi - 0x28]
cmp eax, ecx
je 0x1018d4f
cmp eax, 0x9c66
jle 0x1018d45
cmp eax, 0x9c68
jg 0x1018d45
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x18]
mov ecx, ebx
call fcn.01018bec
mov ebx, eax
cmp ebx, edi
je 0x1018d31
xor esi, esi
cmp dword [ebp - 0x10], edi
jbe 0x1018d22
xor eax, eax
cmp dword [ebp + 8], 0x9c67
setne al
dec eax
and eax, 3
add eax, 3
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
push dword [ebx + esi*4]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
inc esi
cmp esi, dword [ebp - 0x10]
jb 0x1018d10
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push dword [ebp + 8]
push edi
call fcn.0100561e
push eax
call fcn.0101af5a
mov ebx, dword [ebp - 4]
mov dword [ebx + 0x10], edi
pop edi
pop esi
pop ebx
leave
ret 4
push edi
push ecx
push 0x111
push dword [0x101e098]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1018d45
lea eax, [ebp + 8]
push eax
push dword [ebx + 0x18]
call fcn.01018bec
mov esi, eax
cmp esi, edi
je 0x1018d81
push dword [ebp + 8]
mov ecx, ebx
push esi
call fcn.01018047
push esi
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
cmp esi, edi
je 0x1018da7
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push 0x755b
jmp 0x1018e9b
lea eax, [ebp + 8]
push eax
push dword [ebx + 0x18]
call fcn.01018bec
mov ebx, eax
cmp ebx, edi
je 0x1018dd1
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
push ebx
call fcn.01018047
push ebx
push dword [ebp + 8]
push edi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CascadeWindows]
cmp ebx, edi
je 0x1018df7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push esi
jmp 0x1018d36
sub eax, 0x9c6a
je 0x10190f1
dec eax
dec eax
je 0x1019051
dec eax
je 0x1018fdc
dec eax
je 0x1018eac
dec eax
je 0x1018e2c
sub eax, 0x54
jne 0x1018d45
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.01018bec
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1018e96
mov esi, dword [eax]
push esi
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_HungWindowFromGhostWindow]
cmp eax, edi
je 0x1018e50
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 8], edi
je 0x1018e85
cmp dword [ebp + 8], 0x9cc3
push dword [ebp - 8]
push eax
jne 0x1018e74
push 0x405
jmp 0x1018e79
push 0x401
push dword [0x101e098]
call dword [sym.imp.USER32.dll_PostMessageW]
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push dword [ebp + 8]
push edi
call fcn.0100561e
push eax
call fcn.0101af5a
jmp 0x1018d45
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.01018bec
or dword [ebp - 0x18], 0xffffffff
push 0x11
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ebx, ax
shr ebx, 0x10
and ebx, 1
cmp dword [ebp - 0x10], edi
je 0x1018d42
cmp ebx, edi
je 0x1018ee3
add dword [ebp + 8], 0x10000
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0x1c], edi
jbe 0x1018fc6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + ecx*4]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 8]
push ecx
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], edi
call esi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_HungWindowFromGhostWindow]
cmp eax, edi
je 0x1018f1f
lea ecx, [ebp - 8]
push ecx
push eax
call esi
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 8], eax
je 0x1018fb7
push 0x1c
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp esi, edi
jne 0x1018f4a
lea esi, [ebp - 0x38]
mov dword [ebp - 0x18], edi
jmp 0x1018f51
mov dword [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi + 8], edi
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
cmp dword [ebp - 0x18], edi
je 0x1018fa8
push edi
push 0x11
push esi
push fcn.0101838d
mov dword [esi + 0x18], 1
call dword [sym.imp.SHLWAPI.dll_SHCreateThread]
test eax, eax
jne 0x1018fb1
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1018fb1
push esi
mov dword [esi + 0x18], edi
call fcn.0101838d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x1c]
jb 0x1018eef
push dword [ebp - 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1018d42
lea eax, [ebp - 0x1c]
push eax
push 1
call fcn.01018bec
mov esi, eax
cmp esi, edi
je 0x1018e96
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
push ebx
push esi
call fcn.01018047
dec ebx
cmp ebx, edi
jl 0x1019019
push 0x4003
push edi
push edi
push edi
push edi
push edi
push dword [esi + ebx*4]
call dword [sym.imp.USER32.dll_SetWindowPos]
dec ebx
jns 0x1019003
lea eax, [ebp - 0x1c]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x1019032
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 4]
jmp 0x1018e96
lea eax, [ebp - 0x1c]
push eax
push dword [ebx + 0x18]
call fcn.01018bec
mov esi, eax
cmp esi, edi
je 0x1018e96
push dword [esi]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x101907d
push 9
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindowAsync]
push dword [esi]
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x10190ae
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1018d45
push 0xfffffffffffffff0
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x8000000
jne 0x10190e4
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
test byte [0x101e458], 1
je 0x10190eb
push 6
push dword [0x101e098]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x10190eb
push edi
call dword [sym.imp.USER32.dll_MessageBeep]
push esi
jmp 0x1018e88
lea eax, [ebp + 8]
push eax
push dword [ebx + 0x18]
call fcn.01018bec
mov esi, eax
cmp esi, edi
je 0x101910e
push dword [ebp + 8]
mov ecx, ebx
push esi
call fcn.01018047
push esi
push dword [ebp + 8]
push edi
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TileWindows]
cmp esi, edi
je 0x1019135
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push edi
push 0x9c6a
jmp 0x1018e9b