Function at 0x101f1c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x103a858], edi
je 0x101f1e4
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
jmp 0x101f48e
mov ebx, dword [ebp + 0xc]
cmp ebx, 0xf
ja 0x101f27a
je 0x101f20f
mov eax, ebx
dec eax
jne 0x101f484
push 0x80000000
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x101f472
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
push ebx
call fcn.0100cc4b
mov esi, eax
cmp esi, edi
je 0x101f26a
mov edi, dword [esi + 4]
push 1
pop edx
mov ecx, esi
call fcn.01024f2d
push dword [ebp - 0x50]
push esi
call fcn.01025608
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.010255e5
cmp dword [esi + 0x74], 0
je 0x101f25a
push 1
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowScrollBar]
push edi
push esi
call fcn.01025608
xor edx, edx
mov ecx, esi
call fcn.01024f2d
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x101f472
cmp ebx, 0x20
ja 0x101f2ba
je 0x101f29a
cmp ebx, 0x14
jne 0x101f484
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0101f61d
jmp 0x101f4ba
cmp word [ebp + 0x14], 1
jne 0x101f484
push dword [ebp + 8]
call fcn.0100cc4b
test eax, eax
je 0x101f484
jmp 0x101f472
mov eax, 0x200
cmp ebx, eax
ja 0x101f3f0
je 0x101f42c
mov eax, ebx
mov ecx, 0x113
sub eax, ecx
je 0x101f3df
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
dec eax
mov edi, 0x8000
je 0x101f352
dec eax
jne 0x101f484
cmp word [ebp + 0x10], 8
jne 0x101f372
push 0x11
call esi
test di, ax
je 0x101f30a
push 9
call esi
test di, ax
jne 0x101f311
push 0
call fcn.0101ec86
cmp word [ebp + 0x10], 8
jne 0x101f372
cmp dword [0x1038d64], 0
je 0x101f352
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0101968c
push 0x23
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
and dword [0x1038d64], 0
jmp 0x101f472
cmp word [ebp + 0x10], 8
jne 0x101f372
push 0x11
call esi
test di, ax
je 0x101f36b
push 9
call esi
test di, ax
jne 0x101f372
push 0
call fcn.0101ec86
push dword [ebp + 8]
call fcn.0100cc4b
mov esi, eax
test esi, esi
je 0x101f472
movzx eax, word [ebp + 0x10]
push eax
call fcn.0101fa55
test eax, eax
mov dword [ebp + 0xc], eax
je 0x101f472
xor eax, eax
cmp ebx, 0x115
sete al
push esi
inc eax
push dword [ebp + 8]
mov edi, eax
call fcn.0101fa90
mov ebx, eax
test ebx, ebx
je 0x101f472
cmp dword [ebp + 0xc], 0x14
je 0x101f3ce
push 1
push edi
push dword [ebp + 0xc]
push esi
call fcn.0102542d
jmp 0x101f3dc
mov eax, dword [ebp + 0x10]
push edi
shr eax, 0x10
push eax
push esi
call fcn.010255aa
push ebx
jmp 0x101f458
push dword [ebp + 0x10]
push ecx
push dword [ebp + 8]
call fcn.0101ff71
jmp 0x101f472
mov eax, 0x311
cmp ebx, eax
ja 0x101f476
je 0x101f463
cmp ebx, 0x201
je 0x101f426
mov eax, 0x202
cmp ebx, eax
je 0x101f42c
jbe 0x101f484
cmp ebx, 0x204
jbe 0x101f426
cmp ebx, 0x205
je 0x101f42c
cmp ebx, 0x206
jne 0x101f484
push edi
call fcn.0101ec86
push dword [ebp + 8]
call fcn.0100cc4b
mov esi, eax
cmp esi, edi
je 0x101f472
push esi
push dword [ebp + 8]
call fcn.0101fa90
mov edi, eax
test edi, edi
je 0x101f472
push dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push ebx
push eax
push esi
call fcn.01024f41
push edi
push esi
push dword [ebp + 8]
call fcn.0101faad
jmp 0x101f472
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.010238b2
xor eax, eax
jmp 0x101f4ba
mov ecx, ebx
mov eax, 0x706c
sub ecx, eax
je 0x101f4a3
dec ecx
je 0x101f496
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x101f4ba
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x706d
jmp 0x101f4aa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
leave
ret 0x10