Function at 0x1010edf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
mov edi, eax
mov dword [ebp - 4], 0
mov edx, edi
sub edx, dword [esi + 4]
cmp edx, dword [esi + 8]
jbe 0x1010ee45
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x1010ee1f
mov ecx, dword [ecx]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1010ee22
sub ecx, edx
sar ecx, 1
cmp ecx, 0x80
jle 0x1010ee42
mov ecx, esi
call fcn.1010ed60
jmp 0x1010ee45
mov dword [esi + 0x24], ecx
cmp dword [esi], 0
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [esi + 4], edi
je 0x1010ee7d
push 0x11
call ebx
test ax, ax
js 0x1010ee65
push 0x12
call ebx
test ax, ax
jns 0x1010ee7d
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x3c]
test eax, eax
je 0x1010ee7d
cmp word [eax], 0
je 0x1010ee7d
mov ecx, esi
call fcn.1010ed60
push dword [ebp + 0xc]
mov ecx, esi
call fcn.1010f060
mov eax, dword [ebp + 8]
push 0x11
mov edi, dword [eax + 4]
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
call ebx
test ax, ax
jns 0x1010eead
cmp edi, 0x30
jb 0x1010eea5
cmp edi, 0x39
jbe 0x1010eece
lea eax, [edi - 0x41]
cmp eax, 0x19
jbe 0x1010eece
cmp dword [ebp + 0xc], 0x100
jne 0x1010eed2
lea eax, [edi - 0x70]
cmp eax, 0x17
jbe 0x1010eece
lea eax, [edi - 1]
cmp eax, 0xc
jbe 0x1010eece
lea eax, [edi - 0x21]
cmp eax, 0xe
ja 0x1010eed2
xor eax, eax
jmp 0x1010eee2
mov ecx, dword [esi]
push dword [ebp + 8]
mov eax, dword [ecx]
call dword [eax + 0x34]
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [ecx]
mov eax, dword [eax + 0x3c]
cmp eax, sym.HncOfficeFramework.dll_public_virtual:_unsigned_short_int_const____thiscall_CHDCEditBase::GetWindowTextW_void_const
jne 0x1010efe8
mov eax, dword [ecx + 4]
mov edi, dword [eax + 4]
test edi, edi
je 0x1010ef25
mov edi, dword [edi + 0x5c]
test edi, edi
je 0x1010ef25
cmp dword [edi + 0x6c], 0
je 0x1010ef20
lea eax, [edi + 0x68]
push eax
call sym.HncOfficeFramework.dll_public:_void___thiscall_CHDCEditBase::GetWindowTextW_class_CHncStringW__const
mov dword [edi + 0x6c], 0
mov edi, dword [edi + 0x68]
jmp 0x1010ef27
xor edi, edi
cmp dword [esi + 0x20], 8
lea ecx, [esi + 0xc]
jb 0x1010ef33
mov ecx, dword [esi + 0xc]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1010ef5b
test dx, dx
je 0x1010ef57
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1010ef5b
add eax, 4
add ecx, 4
test dx, dx
jne 0x1010ef35
xor eax, eax
jmp 0x1010ef60
sbb eax, eax
or eax, 1
test eax, eax
mov eax, dword [ebp + 0x14]
je 0x1010efcb
mov dword [eax], 1
mov ecx, edi
mov eax, dword [ebp + 0x10]
lea edx, [ecx + 2]
mov dword [eax], 1
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1010ef80
sub ecx, edx
sar ecx, 1
cmp ecx, dword [esi + 0x1c]
je 0x1010efa9
mov eax, dword [esi + 0x24]
xor ecx, ecx
mov edx, 1
cmp word [edi + eax*2 + 2], cx
cmove ecx, edx
mov dword [ebp - 4], ecx
mov edx, edi
lea ecx, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1010efb0
sub edx, ecx
lea ecx, [esi + 0xc]
sar edx, 1
push edx
push edi
call fcn.10002470
jmp 0x1010efd1
mov dword [eax], 0
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
lea eax, [edi + eax*2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
call eax
mov edi, eax
jmp 0x1010ef27