Function at 0x100a94d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
jne 0x100a966e
push edi
push 0x10
call esi
movzx edi, ax
push 0x11
and edi, 0x8000
call esi
movzx edx, ax
mov eax, dword [ebp + 0xc]
and edx, 0x8000
lea ecx, [eax - 0xd]
cmp ecx, 0x66
ja case.0x100a951d.14
movzx ecx, byte [ecx + 0x100a97f8]
jmp dword [ecx*4 + 0x100a97cc]
cmp eax, 0x73
je case.0x100a951d.14
mov esi, dword [ebp + 8]
test byte [esi + 0x1844], 4
je 0x100a9553
cmp eax, 0x26
jne 0x100a9553
push edi
mov ecx, esi
call fcn.100a8db0
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, esi
push edi
test edx, edx
je 0x100a956c
call fcn.100a8e20
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
call fcn.100a8a90
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
test byte [esi + 0x1844], 4
je 0x100a95a4
cmp eax, 0x28
jne 0x100a95a4
push edi
mov ecx, esi
call fcn.100a8b00
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, esi
push edi
test edx, edx
je 0x100a95bd
call fcn.100a8ec0
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
call fcn.100a8bf0
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
test edx, edx
je 0x100a95f9
mov eax, dword [esi]
push 0
push 0
push 0
push esi
call dword [eax + 0x198]
mov ecx, esi
call fcn.100aa9b0
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
push edi
mov ecx, esi
call fcn.100a8c60
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
test edx, edx
je 0x100a9647
mov eax, dword [esi + 0x182c]
test eax, eax
je 0x100a9647
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esi]
push 0
push eax
push eax
push esi
call dword [ecx + 0x198]
mov ecx, esi
call fcn.100aa9b0
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
push edi
mov ecx, esi
call fcn.100a8b70
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push edi
call fcn.100a8d40
mov ecx, dword [ebp + 8]
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov ecx, dword [ebp + 8]
push edi
call fcn.100a8cd0
mov ecx, dword [ebp + 8]
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
test dword [esi + 0x1844], 0x800
jne case.0x100a951d.14
test edi, edi
je 0x100a96a1
test edx, edx
jne case.0x100a951d.14
mov eax, dword [esi + 0x185c]
cmp eax, dword [esi + 0x1860]
je 0x100a96c7
mov ecx, esi
test edi, edi
je 0x100a972f
call fcn.100a9450
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov eax, dword [esi]
push 0
push 0
push 0xffffffffffffffff
push esi
test edi, edi
je 0x100a96f7
call dword [eax + 0x198]
push 1
mov ecx, esi
call fcn.100a8a90
mov ecx, esi
call fcn.100a9170
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
test edx, edx
je 0x100a971e
call dword [eax + 0x198]
push 1
mov ecx, esi
call fcn.100a8b70
mov ecx, esi
call fcn.100a9170
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
call dword [eax + 0x198]
push 1
mov ecx, esi
call fcn.100a8bf0
mov ecx, esi
call fcn.100a9170
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
test edi, edi
je 0x100a976c
mov esi, dword [ebp + 8]
test dword [esi + 0x1844], 0x800
jne case.0x100a951d.14
mov ecx, esi
call fcn.100a9b30
mov ecx, esi
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
test edx, edx
je case.0x100a951d.14
mov ecx, dword [ebp + 8]
call fcn.100a9190
mov ecx, dword [ebp + 8]
call fcn.100ab290
pop edi
pop esi
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test dword [eax + 0x1844], 0x1000
jne case.0x100a951d.14
push dword [eax + 0x1498]
call dword [sym.imp.USER32.dll_GetParent]
pop edi
pop esi
mov dword [ebp + 0x14], 0
mov dword [ebp + 0x10], 0
mov dword [ebp + 0xc], 0x400
mov dword [ebp + 8], eax
pop ebp
jmp dword [sym.imp.USER32.dll_SendMessageW]