Function at 0x1008a590
Capabilities:
Log keystrokes

Disassembly:
sub esp, 0x34
mov eax, dword [0x101b23cc]
xor eax, esp
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x40]
test ebp, ebp
mov dword [esp + 0x10], eax
mov dword [esp + 4], ecx
jne 0x1008a5c4
push eax
call fcn.10089b10
add esp, 4
mov ebp, eax
mov edi, edi
push ebp
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x1008a5df
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100fc49a
add esp, 0x34
ret
push ebx
push esi
push edi
push 5
push ebp
call fcn.10052960
add esp, 8
test eax, eax
je 0x1008a66c
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
mov esi, eax
mov al, al
push 0
push ebp
call fcn.10052920
add esp, 8
mov edi, eax
push eax
pop eax
push 1
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, eax
call dword [sym.imp.USER32.dll_GetFocus]
mov ebx, eax
nop
push 0
push edi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov bl, bl
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push ebx
call edi
test eax, eax
je 0x1008a66c
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x1008a66c
mov esi, ebx
mov ch, ch
push ebx
call edi
test eax, eax
je 0x1008a66c
mov edi, edi
cmp esi, ebp
je 0x1008a668
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
push edx
pop edx
push esi
call edi
test eax, eax
jne 0x1008a650
jmp 0x1008a66c
mov ebp, ebx
xchg ebx, eax
xchg ebx, eax
mov eax, dword [esp + 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x1008a673
sub eax, edx
mov esi, eax
push ebx
pop ebx
lea edi, [esi + esi + 2]
push edi
call fcn.100fbefc
mov ebx, eax
add esp, 4
mov dword [esp + 0x14], ebx
nop
test ebx, ebx
jne 0x1008a6ad
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.100fc49a
add esp, 0x34
ret
push edi
push 0
push ebx
call fcn.100fcf90
add esp, 0xc
mov dl, dl
mov edx, dword [esp + 0x10]
add esi, 1
push esi
push ebx
push 0xffffffffffffffff
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
push eax
pop eax
mov eax, ebx
lea edx, [eax + 2]
jmp 0x1008a6e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1008a6e0
sub eax, edx
sar eax, 1
mov dword [esp + 0x18], eax
mov esi, esi
mov dh, dh
xor ebx, ebx
test eax, eax
jle 0x1008a7b2
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
jmp 0x1008a710
mov al, al
xor eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov ch, ch
push eax
push eax
push 0x20
lea eax, [esp + 0x2c]
push eax
push 1
push esi
push 0
push 0
call edi
push ebx
pop ebx
mov dword [esp + 0x10], 0
mov edi, edi
mov eax, dword [esp + 0x20]
xor edx, edx
mov dh, al
lea ecx, [esp + 0x10]
push ecx
push 0x9c4
push 1
movzx eax, ah
push 1
or edx, eax
push edx
push 0x286
push ebp
call fcn.100528d0
add esp, 0x1c
push eax
pop eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x37fc]
test eax, eax
je 0x1008a7a2
mov edx, dword [esp + 0x18]
add edx, 0xffffffff
cmp ebx, edx
jge 0x1008a7a2
push eax
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov edx, edx
add ebx, 1
add esi, 2
cmp ebx, dword [esp + 0x18]
jl 0x1008a710
mov eax, dword [esp + 0x14]
push eax
call fcn.100fbfbf
add esp, 4
mov ah, ah
mov ecx, dword [esp + 0x40]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
mov eax, 1
call fcn.100fc49a
add esp, 0x34
ret