Function at 0x103fbdf
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8
mov ecx, dword [0x1097440]
mov eax, dword [ecx]
push ebx
push esi
push edi
push 0x108e254
push 0x108e250
call dword [eax + 0xc]
mov ecx, dword [0x1098298]
push 0x100a048
mov dword [ebp - 8], 0xe
call fcn.010427ca
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x103fd10
movzx eax, byte [0x108e268]
push eax
push 0x100d1ec
mov ecx, esi
call fcn.0105b707
test eax, eax
push 0xffffffffffffffff
setg al
push 0x100d1c8
mov ecx, esi
mov byte [0x108e268], al
call fcn.0105b707
test eax, eax
push 0xe
setg al
push 0x100d1a8
mov ecx, esi
mov byte [0x109750f], al
call fcn.0105b75c
push 0x100d188
mov ecx, esi
mov dword [ebp - 8], eax
call fcn.0105b9b1
push 0xa
push 0x100d16c
mov ecx, esi
mov dword [ebp - 0xc], eax
call fcn.0105b75c
push 0x55
push 0x100d148
mov ecx, esi
mov dword [0x108e270], eax
call fcn.0105b75c
push 1
push 0x100d124
mov ecx, esi
mov dword [str.d_n], eax
call fcn.0105b707
test eax, eax
jne 0x103fcbf
mov byte [0x109750b], bl
push dword [0x108e274]
mov ecx, esi
push 0x100c77c
call fcn.0105b75c
push dword [0x108e278]
mov ecx, esi
push 0x100c790
mov dword [0x108e274], eax
call fcn.0105b75c
mov dword [0x108e278], eax
movzx eax, byte [0x1097530]
push eax
push 0x100d100
mov ecx, esi
call fcn.0105b707
test eax, eax
setne al
mov byte [0x1097530], al
cmp dword [ebp - 0xc], ebx
jne 0x103fd37
push 0x200
call fcn.010347af
pop ecx
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x103fd37
push 0x100
push eax
push 0x3e9
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
call dword [sym.imp.USER32.dll_GetDC]
push 0x48
push 0x5a
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_MulDiv]
push dword [ebp - 0x10]
mov esi, eax
push ebx
neg esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x190
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateFontW]
push dword [ebp - 0xc]
mov dword [0x109752c], eax
call fcn.0103479e
pop ecx
push ebx
mov byte [ebp - 1], bl
mov dword [ebp - 0x6c], 3
mov dword [ebp - 0x68], 0x103e177
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
call edi
mov ecx, dword [0x1097440]
mov dword [ebp - 0x5c], eax
mov eax, dword [ecx]
call dword [eax + 0x1c]
mov esi, 0x7f00
test eax, eax
je 0x103fdcf
mov ecx, dword [0x1097440]
mov eax, dword [ecx]
call dword [eax + 0x1c]
push eax
push ebx
call edi
push eax
jmp 0x103fdd1
push esi
push ebx
call dword [sym.imp.USER32.dll_LoadIconW]
push esi
push ebx
mov dword [ebp - 0x58], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x54], eax
cmp byte [0x109750b], bl
je 0x103fdf7
push 4
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x103fdff
push 0xc
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov dword [ebp - 0x50], eax
cmp byte [0x109750b], bl
jne 0x103fe1a
mov ecx, dword [0x1097440]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov dword [ebp - 0x4c], eax
jmp 0x103fe1d
mov dword [ebp - 0x4c], ebx
mov eax, dword [0x1097428]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
cmp byte [0x109750b], bl
je 0x103fe50
push 0x1097518
mov byte [0x109750c], 1
call dword [sym.imp.USER32.dll_GetCursorPos]
push ebx
call dword [sym.imp.USER32.dll_ShowCursor]
mov eax, 0x80000000
xor esi, esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
cmp byte [0x1097531], bl
je 0x103fe84
cmp byte [0x109750b], bl
jne 0x103fea9
mov ecx, dword [0x109753c]
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x1097540]
mov esi, 0x1000000
mov dword [ebp - 8], ecx
cmp byte [0x109750b], bl
jne 0x103fea9
xor eax, eax
cmp byte [0x108e268], bl
setne al
dec eax
and eax, 0x10000
xor eax, 0xcf0000
or eax, esi
or eax, 0x2000000
push ebx
push ebx
mov esi, eax
call edi
push eax
mov eax, dword [0x1097428]
push ebx
push ebx
push dword [0x108e254]
push dword [0x108e250]
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push eax
push ebx
call esi
mov dword [0x1097430], eax
cmp eax, ebx
jne 0x103ff05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100d0a8
push 0x100c8c4
push 0x1ed
push 0x10
call fcn.01054409
add esp, 0x14
xor al, al
jmp 0x104029a
cmp byte [0x109750b], bl
je 0x103ff27
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push ebx
push 0x103d484
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [0x1097504], eax
or dword [ebp - 0x14], 0xffffffff
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], 8
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push ebx
push ebx
call edi
push eax
push ebx
push dword [0x1097430]
push dword [0x108e254]
push dword [0x108e250]
push ebx
push ebx
push 0x4000000b
push ebx
push 0x100d094
push ebx
call esi
push 0x100d050
mov dword [0x1097434], eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
movzx eax, ax
mov dword [ebp - 8], eax
cmp ax, bx
je 0x103ffb1
mov esi, dword [sym.imp.USER32.dll_SetPropW]
movzx eax, ax
push 0x10000
push eax
push dword [0x1097430]
call esi
movzx eax, word [ebp - 8]
push 0x10000
push eax
push dword [0x1097434]
call esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
mov ecx, dword [0x1097440]
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp eax, ebx
jbe 0x104000a
cmp byte [0x109750b], bl
jne 0x1040012
push ebx
push ecx
mov eax, esp
push 0x2000000
push 0x50000000
push ebx
push ecx
mov dword [eax], 0x3f2
mov eax, esp
mov dword [eax], ebx
push dword [0x1097430]
mov ecx, 0x1097548
call fcn.0103fb7b
push 0x103
push ebx
push ebx
push dword [0x1097430]
mov dword [0x1097500], eax
call dword [sym.imp.USER32.dll_RedrawWindow]
cmp byte [0x109750b], bl
je 0x1040023
push dword [0x108e25c]
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x1097524], eax
mov ecx, dword [0x1097440]
mov eax, dword [ecx]
call dword [eax + 0x24]
cmp eax, ebx
je 0x1040058
push ebx
push eax
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [0x1097510], eax
cmp byte [0x109750b], bl
je 0x1040058
push eax
call fcn.0103c7c2
cmp byte [0x108e269], bl
jne 0x1040072
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x10400ae
lea eax, [ebp - 1]
push eax
push 0x1097538
push 0x1097534
call fcn.0103dd8a
mov eax, dword [0x108e250]
cmp byte [ebp - 1], bl
je 0x104009f
add eax, eax
mov dword [0x108e288], eax
mov eax, dword [0x108e254]
add eax, eax
jmp 0x10400a9
mov dword [0x108e288], eax
mov eax, dword [0x108e254]
mov dword [0x108e28c], eax
cmp byte [0x109750b], bl
jne 0x10401d8
push dword [0x1097500]
lea eax, [ebp - 8]
push dword [0x1097430]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [0x108e28c]
push dword [0x108e288]
call fcn.010552ab
push 0xa
pop ecx
xor eax, eax
mov dword [ebp - 0x44], ebx
lea edi, [ebp - 0x40]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push dword [0x1097430]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [0x1097534]
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x28], eax
mov eax, dword [0x1097538]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
push dword [0x1097430]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.USER32.dll_SetWindowPlacement]
cmp byte [0x1097508], bl
je 0x104026c
cmp dword [0x1097500], ebx
je 0x104026c
lea eax, [ebp - 0xa8]
push eax
push dword [0x1097430]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x1097440]
mov eax, dword [ecx]
call dword [eax + 0x44]
xor ecx, ecx
push 4
pop edx
mov edi, eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.010347af
mov edx, dword [ebp - 0xa0]
sub edx, dword [ebp - 0xa8]
pop ecx
mov ecx, dword [0x1097440]
mov esi, eax
mov eax, dword [ecx]
push esi
push edi
push edx
call dword [eax + 0x14]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0x404
push dword [0x1097500]
call edi
push ebx
push ebx
push 5
push dword [0x1097500]
call edi
push 0x103
push ebx
push ebx
push dword [0x1097500]
call dword [sym.imp.USER32.dll_RedrawWindow]
push esi
call fcn.0103479e
pop ecx
jmp 0x104026c
mov esi, dword [0x1097430]
push 9
pop ecx
xor eax, eax
push ebx
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
push 0x100ca80
mov dword [ebp - 0x40], 0x28
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, ebx
je 0x1040201
mov esi, eax
lea eax, [ebp - 0x40]
push eax
push 2
push esi
call dword [sym.imp.USER32.dll_MonitorFromWindow]
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
push 0xa
pop ecx
xor eax, eax
mov dword [ebp - 0x98], ebx
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
push dword [0x1097430]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x98]
push eax
push dword [0x1097430]
mov dword [ebp - 0x90], ebx
call dword [sym.imp.USER32.dll_SetWindowPlacement]
call fcn.0103e08c
push ebx
push dword [0x1097434]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.0103d373
push 1
push dword [0x108e254]
push dword [0x108e250]
call fcn.0103d52a
mov al, 1
pop edi
pop esi
pop ebx
leave
ret