Function at 0x10124f8b
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x50
mov eax, 0x101b5ec5
call fcn.10178db5
mov ebx, ecx
mov dword [ebp - 0x3c], ebx
cmp byte [ebx + 0x2c8], 0
je 0x10124fac
mov byte [ebx + 0x2c8], 0
cmp dword [ebx + 0x35c], 0
je 0x101253d6
mov eax, dword [ebx]
mov esi, dword [eax + 0x19c]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, ebx
call esi
push eax
mov ecx, 0x1021f9f4
call fcn.100eea21
mov dword [ebp - 0x40], eax
test eax, eax
jne 0x10124feb
cmp dword [0x1021f9f8], eax
je 0x101253ec
mov eax, dword [ebx + 0x35c]
mov edi, dword [ebx + 0x358]
mov dword [ebp - 0x38], eax
mov eax, dword [ebx]
mov esi, dword [eax + 0x38c]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, ebx
call esi
mov ecx, ebx
call fcn.1012433b
mov edx, dword [ebp - 0x38]
mov esi, eax
mov dword [ebp - 0x34], esi
cmp edi, edx
jne 0x1012504f
mov ecx, edx
sub ecx, 8
je 0x10125301
sub ecx, 1
je 0x10125108
sub ecx, 0xa
je 0x1012505b
mov eax, dword [ebx]
push edx
mov esi, dword [eax + 0x37c]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, ebx
call esi
mov ecx, ebx
call fcn.1004cc9f
jmp 0x101253e4
mov esi, dword [0x10229744]
test esi, esi
jne 0x10125072
mov ecx, ebx
call fcn.1004d510
mov esi, eax
test esi, esi
je 0x101250ef
push esi
push 0x101d69c8
call fcn.100464e9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1012508f
mov ecx, dword [edi]
mov esi, dword [ecx + 0x218]
jmp 0x101250da
push esi
push 0x101d6438
call fcn.100464e9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x101250ac
mov ecx, dword [edi]
mov esi, dword [ecx + 0x1f8]
jmp 0x101250da
push esi
push 0x101d6fd8
call fcn.100464e9
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x101250d2
push esi
push 0x101d7390
call fcn.100464e9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x101250ef
mov ecx, dword [edi]
mov esi, dword [ecx + 0x210]
push ebx
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, edi
call esi
test eax, eax
je 0x1012504f
mov eax, dword [ebx]
mov esi, dword [eax + 0x2dc]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, ebx
call esi
jmp 0x1012504f
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10125289
mov eax, dword [ebx]
mov esi, dword [eax + 0x340]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, ebx
call esi
test eax, eax
je 0x10125286
mov eax, dword [ebx + 0xa4]
xor esi, esi
push esi
push esi
push 0xb
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebx + 0x2f8], esi
jne 0x101251f2
push 0xa
lea ecx, [ebp - 0x5c]
call fcn.1005d363
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 4], esi
call fcn.10156339
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x101251e4
mov ebx, dword [ebp - 0x34]
push dword [ecx + 8]
mov ecx, dword [ecx]
push 0x1021fc34
mov dword [ebp - 0x34], ecx
call fcn.100464e9
mov edi, eax
pop ecx
pop ecx
mov dword [ebp - 0x38], edi
mov ecx, dword [edi]
mov esi, dword [ecx + 0x340]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, edi
call esi
test eax, eax
je 0x101251da
mov eax, dword [edi]
mov edi, dword [eax + 0x368]
mov eax, dword [ebx]
mov esi, dword [eax + 0x194]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, ebx
call esi
push 0
push 0
push eax
push 1
mov ecx, edi
call dword [0x101bb9b4]
mov ecx, dword [ebp - 0x38]
call edi
mov ecx, dword [ebp - 0x34]
test ecx, ecx
jne 0x10125179
mov ebx, dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1005d389
jmp 0x10125226
mov edi, dword [ebx + 0x330]
mov eax, dword [edi]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, edi
call esi
push eax
push 0x101e5e08
call fcn.100464e9
pop ecx
pop ecx
test eax, eax
je 0x10125226
push 0
mov ecx, eax
call fcn.10159ae9
mov eax, dword [ebx + 0xa4]
push 0
push 1
push 0xb
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebx + 0xa4]
push 0x101d0500
call fcn.100464e9
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10125269
mov ecx, dword [edi]
push 1
mov esi, dword [ecx + 0x178]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, edi
call esi
mov eax, dword [ebx + 0xa4]
push 0x181
push 0
push 0
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_RedrawWindow]
jmp 0x101253e4
mov esi, dword [ebp - 0x34]
mov edi, dword [ebp - 0x40]
test edi, edi
je 0x101253e4
test esi, esi
je 0x101253e4
mov eax, dword [esi]
mov edi, dword [edi + 0x11c]
mov esi, dword [eax + 0x194]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, dword [ebp - 0x34]
call esi
test edi, eax
je 0x101253e4
mov eax, dword [ebx]
mov edi, dword [eax + 0x368]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov esi, dword [eax + 0x194]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, dword [ebp - 0x34]
call esi
push 1
push 0
push eax
xor eax, eax
mov ecx, edi
cmp dword [ebx + 0x2f8], eax
sete al
push eax
call dword [0x101bb9b4]
mov ecx, ebx
call edi
jmp 0x101253e4
cmp dword [0x10229868], 0
je 0x101253e4
push 8
mov ecx, ebx
call fcn.1012428b
mov edi, eax
mov dword [ebp - 0x3c], edi
test edi, edi
je 0x101253e4
mov ecx, dword [edi]
lea eax, [ebp - 0x30]
push eax
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, edi
call esi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x20]
mov ecx, ebx
push eax
call fcn.10054d95
push dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.100547f5
mov dword [edi + 0x14], 1
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x40], eax
call fcn.10051f1a
test eax, 0x400000
je 0x1012539f
sub esi, dword [ebp - 0x30]
add esi, dword [ebp - 0x28]
mov eax, dword [ebx]
push dword [ebp - 0x40]
mov edi, dword [ebx + 0x20]
push esi
mov esi, dword [eax + 0x2e4]
mov ecx, esi
call dword [0x101bb9b4]
mov ecx, ebx
call esi
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x101253e4
mov eax, dword [ebp - 0x3c]
mov ecx, ebx
push eax
and dword [eax + 0x14], 0
call fcn.101268a1
jmp 0x101253e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1007f81f
call fcn.10178d64
ret 0xc
call fcn.10043e16
int3