Function at 0x1000ee75
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
cmp dword [0x102398ac], 0
push ebx
push ebp
mov ebp, dword [esp + 0x18]
mov ebx, dword [ebp + 4]
mov ecx, dword [ebp]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], edi
je 0x1000eed3
mov edx, dword [0x1023a38c]
cmp ecx, edx
je 0x100ed8e3
cmp ecx, dword [0x1023a33c]
je 0x1006d074
cmp ecx, dword [0x1023a3dc]
je 0x1006d052
cmp ecx, dword [0x1023a364]
je 0x1002e763
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
cmp ebx, 0x100
jne 0x1000eed3
jmp 0x101127b6
mov eax, ebx
sub eax, 0x100
je 0x101125a6
dec eax
dec eax
je 0x10112673
dec eax
dec eax
jne 0x1000eed3
jmp 0x10112566
cmp ebx, 0x100
jne 0x1000eed3
jmp 0x10112534
mov eax, ebx
sub eax, 0x100
je 0x101122f8
dec eax
je 0x1000eed3
sub eax, 3
jne 0x1000eed3
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, 0x90
cmp esi, 0x28
je 0x101122a8
cmp esi, 0x26
je 0x101122a8
push ebx
call edi
test ax, ax
jne 0x101122b9
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
mov eax, dword [0x1023a164]
cmp esi, eax
je 0x1000eed3
jmp 0x101122d4
push ebx
call edi
test ax, ax
jne 0x100ed91d
jmp 0x101126bf
mov eax, dword [0x1023a3dc]
xor edi, edi
push edi
push edi
push 0x1069
mov dword [ebp], eax
call fcn.1018f6ec
jmp 0x1000eed3
cmp edi, eax
je 0x1000eed3
call fcn.1000ae10
cmp edi, eax
je 0x1000eed3
cmp dword [ebp + 8], 0x73
jne 0x101124ee
jmp 0x1000eed3
cmp esi, 0x26
ja 0x10112421
je 0x1011244d
cmp esi, 0x14
ja 0x10112381
cmp esi, 0x10
jae 0x1000eed3
sub esi, 3
je 0x1000eed3
sub esi, 6
je 0x1011232f
sub esi, 3
je 0x1000eed3
dec esi
jmp 0x1011239f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1011234d
push dword [0x1023a33c]
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x101124ee
push dword [0x1023a3dc]
call dword [sym.imp.USER32.dll_SetFocus]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
push edi
push edi
push 0xe
push dword [0x1023a3dc]
call esi
push eax
push edi
push 0xb1
push dword [0x1023a3dc]
call esi
jmp 0x101124ee
cmp esi, 0x1b
je 0x1000eed3
cmp esi, 0x20
jbe 0x101124aa
cmp esi, 0x24
jbe 0x1000eed3
cmp esi, 0x25
jne 0x101124aa
test dword [0x102398a4], 0x4000
je 0x1000eed3
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
push edi
push edi
push 0x188
push ecx
call esi
push edi
mov ebx, eax
push ebx
push 0x199
push dword [0x1023a38c]
call esi
push eax
call fcn.1000d156
cmp dword [eax + 8], 0xffffffff
jne 0x1000eed3
mov ecx, dword [esp + 0x20]
cmp ecx, 0x25
je 0x101123f6
cmp ecx, 0x6d
jne 0x101123fc
test byte [eax + 0x34], 2
je 0x10112415
cmp ecx, 0x27
je 0x10112406
cmp ecx, 0x6b
jne 0x1011240c
test byte [eax + 0x34], 2
jne 0x10112415
cmp ecx, 0xd
jne 0x1000eed3
push ebx
push eax
call fcn.1018fb9f
jmp 0x101124ee
cmp esi, 0x6b
ja 0x10112484
je 0x101123a5
cmp esi, 0x27
je 0x101123a5
cmp esi, 0x28
je 0x1011244d
cmp esi, 0x29
je 0x1000eed3
cmp esi, 0x2c
jbe 0x101124aa
cmp esi, 0x2f
jmp 0x101124a4
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
push edi
push edi
push 0x188
push edx
call esi
cmp dword [esp + 0x20], 0x28
jne 0x10112469
inc eax
jmp 0x1011246e
dec eax
jns 0x1011246e
mov eax, edi
push edi
push eax
push 0x186
push dword [0x1023a38c]
call esi
call fcn.10190939
jmp 0x101124ee
cmp esi, 0x6d
je 0x101123a5
cmp esi, 0x73
je 0x101126bf
cmp esi, 0x8f
jbe 0x101124aa
cmp esi, 0x91
jbe 0x1000eed3
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
xor ecx, ecx
test ax, ax
sets cl
push 0x10
mov dword [esp + 0x18], ecx
call ebx
mov esi, dword [esp + 0x20]
xor ebx, ebx
test ax, ax
lea eax, [esi - 0x41]
sets bl
cmp eax, 0x19
ja 0x101124fc
test ebx, ebx
je 0x10112510
mov edi, dword [esp + 0x14]
test edi, edi
je 0x10112500
push esi
call fcn.1018f4ed
test eax, eax
je 0x101124f6
xor eax, eax
inc eax
jmp 0x1000eed5
mov esi, dword [esp + 0x20]
jmp 0x10112500
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x1011250c
test edi, edi
jne 0x1000eed3
mov edi, dword [esp + 0x18]
call fcn.101908ae
test eax, eax
jne 0x1011266f
cmp esi, 0x20
jb 0x1011266f
push edi
push esi
push 0x100
call fcn.1018f6ec
jmp 0x101124ee
cmp esi, 9
je 0x1011255b
cmp esi, 0xd
je 0x10112551
cmp esi, 0x1b
jne 0x1000eed3
call fcn.1018fce7
jmp 0x1000eed3
call fcn.1000d445
jmp 0x1000eed3
push dword [0x1023a364]
jmp 0x10112342
cmp esi, 0xc
je 0x101124ee
cmp esi, 0x20
jbe 0x1000eed3
cmp esi, 0x25
jbe 0x101124ee
cmp esi, 0x26
je 0x101126bf
cmp esi, 0x27
je 0x101124ee
cmp esi, 0x28
je 0x101126bf
cmp esi, 0x2d
je 0x101124ee
jmp 0x1000eed3
cmp esi, 0x24
ja 0x10112618
cmp esi, 0x21
jae 0x10112634
cmp esi, 9
je 0x101125f6
cmp esi, 0xd
je 0x101125cd
cmp esi, 0x1b
jne 0x1011262c
call fcn.1018fce7
jmp 0x101124ee
cmp dword [0x1023a8a4], 0
jne 0x101125df
cmp dword [0x1023aee0], 1
jbe 0x101125e6
or dword [0x102398a4], 4
call fcn.1000d445
push dword [0x1023a38c]
jmp 0x10112342
call fcn.1000d445
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [0x1023a38c]
js 0x10112612
mov eax, dword [0x1023a33c]
push eax
jmp 0x10112342
mov eax, esi
sub eax, 0x26
je 0x10112634
dec eax
dec eax
je 0x10112634
sub eax, 0x4b
je 0x101126bf
lea eax, [esi - 0x41]
cmp eax, 0x19
ja 0x10112673
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
xor ebx, ebx
test ax, ax
push 0x11
sets bl
call esi
xor ecx, ecx
test ax, ax
sets cl
test ebx, ebx
je 0x1011266b
test ecx, ecx
je 0x1011266b
push dword [esp + 0x20]
call fcn.1018f4ed
test eax, eax
jne 0x101125e6
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x10]
mov edi, dword [0x102398a0]
cmp edi, 3
je 0x1011269b
cmp edi, 5
je 0x1011269b
cmp edi, 4
je 0x1011269b
cmp edi, 2
je 0x1011269b
cmp edi, 1
je 0x1011269b
cmp edi, 6
jne 0x1000eed3
call fcn.101908ae
test eax, eax
je 0x1011275f
cmp edi, 1
jne 0x101126e6
mov eax, dword [0x10239884]
mov dword [ebp], eax
call fcn.10018be0
jmp 0x1000eed3
mov eax, dword [0x102398a0]
cmp eax, 3
je 0x101126dd
cmp eax, 5
je 0x101126dd
cmp eax, 4
je 0x101126dd
cmp eax, 1
je 0x101126dd
cmp eax, 2
jne 0x101126e2
call fcn.10190a72
xor edi, edi
jmp 0x10112753
cmp esi, 0x41
jb 0x101126f0
cmp esi, 0x5a
jbe 0x1011270d
lea eax, [esi - 0x30]
cmp eax, 9
ja 0x1011278f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x1011278f
call fcn.1015692e
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, eax
lea eax, [esp + 0x20]
push eax
push ebx
push 0x18f
push dword [0x1023a404]
call esi
xor edi, edi
cmp eax, 0xffffffff
je 0x10112753
cmp ebx, eax
je 0x10112753
push edi
push eax
push 0x186
push dword [0x1023a404]
call esi
or dword [0x102398a4], 4
call fcn.10190993
push edi
push edi
push 0x1069
jmp 0x1011252d
cmp edi, 2
je 0x10112773
cmp edi, 3
je 0x10112773
cmp edi, 5
je 0x10112773
cmp edi, 4
jne 0x1011279c
cmp esi, 0x26
je 0x10112787
cmp esi, 0x28
je 0x10112787
cmp esi, 0x22
je 0x10112787
cmp esi, 0x21
jne 0x1011279c
cmp ebx, 0x102
je 0x1011279c
mov eax, dword [0x1023a404]
mov dword [ebp], eax
jmp 0x1000eed3
push 0
push 0xffffffffffffffff
push 0x186
push dword [0x1023a404]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x1000eed3
cmp esi, 9
jne 0x1000eed3
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov eax, dword [0x1023a33c]
js 0x10112612
mov eax, dword [0x1023a38c]
jmp 0x10112612