Function at 0x1000c9a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x38
mov eax, dword [0x10037040]
xor eax, esp
mov dword [esp + 0x34], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov byte [esp + 0x16], 0
call fcn.1000bf60
test al, al
jne 0x1000c9d8
mov ecx, esi
call fcn.1000c210
test al, al
je 0x1000cae3
mov ecx, esi
call fcn.1000bf60
test al, al
jne 0x1000c9f2
mov ecx, esi
call fcn.1000c210
test al, al
je 0x1000cae3
mov ecx, esi
call fcn.1000bf60
test al, al
jne 0x1000ca0c
mov ecx, esi
call fcn.1000c210
test al, al
je 0x1000cae3
movzx eax, word [edi]
test ax, ax
je 0x1000cadb
mov esi, dword [sym.imp.USER32.dll_keybd_event]
mov ecx, eax
push ecx
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
mov dword [esp + 0x1c], eax
shr eax, 8
mov cl, al
mov dword [esp + 0x18], eax
and cl, 1
mov byte [esp + 0x17], cl
je 0x1000ca4e
push 0
push 0
push 0
push 0x10
call esi
mov eax, dword [esp + 0x18]
mov cl, al
and cl, 2
mov byte [esp + 0x16], cl
je 0x1000ca67
push 0
push 0
push 0
push 0x11
call esi
mov eax, dword [esp + 0x18]
and al, 4
mov dword [esp + 0x18], eax
je 0x1000ca79
push 0
push 0
push 0
push 0x12
call esi
mov al, byte [esp + 0x1c]
push 0
push 0
push 0
push eax
mov dword [esp + 0x2c], eax
call esi
push 0
push 2
push 0
push dword [esp + 0x28]
call esi
cmp byte [esp + 0x18], 0
je 0x1000caa7
push 0
push 2
push 0
push 0x12
call esi
cmp byte [esp + 0x16], 0
je 0x1000cab8
push 0
push 2
push 0
push 0x11
call esi
cmp byte [esp + 0x17], 0
je 0x1000cac9
push 0
push 2
push 0
push 0x10
call esi
movzx eax, word [edi + 2]
add edi, 2
mov ecx, eax
test ax, ax
jne 0x1000ca20
mov al, 1
mov byte [esp + 0x16], al
jmp 0x1000cae7
mov al, byte [esp + 0x16]
cmp dword [0x10037ac0], 2
jg 0x1000cceb
mov eax, dword [0x10037abc]
test eax, eax
je 0x1000cb0b
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x10037abc]
cmp dword [0x10037ab8], 0
je 0x1000ccdc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
push eax
movaps xmmword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [esp + 0x2c]
push eax
movzx eax, word [esp + 0x2e]
push eax
movzx eax, word [esp + 0x30]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x32]
push eax
movzx eax, word [esp + 0x34]
push eax
push str._04d__02d__02d__02d:_02d:_02d
push dword [0x10037ab8]
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0x20
test eax, eax
je 0x1000ccd7
push str._C:UserseladeSourceReposAudyxAudyxNoahAudyxPluginNativeUIAutomationClientuiautomation.cpp
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push 0x10032cb8
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push 0xea
push 0x100333c4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push 0x10032cbc
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push str.AutomationElement::manualSetText
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push 0x10032b7c
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push 0x100333f0
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push 0x10032b7c
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push str.Returning
push 0x100333b4
push eax
call fcn.1000b7b0
mov ecx, dword [0x10037ab8]
add esp, 0xc
test ecx, ecx
je 0x1000ccd7
cmp byte [esp + 0x16], 0
mov edx, str.false
mov eax, str.true
cmove eax, edx
push eax
push 0x100333b4
push ecx
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push 0x100333c8
push 0x100333b4
push eax
call fcn.1000b7b0
mov eax, dword [0x10037ab8]
add esp, 0xc
test eax, eax
je 0x1000ccd7
push eax
call fcn.10016a24
add esp, 4
mov eax, dword [0x10037abc]
test eax, eax
je 0x1000cce7
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [esp + 0x16]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
xor ecx, esp
call fcn.1000e942
mov esp, ebp
pop ebp
ret 4