Function at 0xaa98d5
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x10
mov eax, 0xaffc41
call fcn.00af8df7
mov esi, ecx
mov dword [ebp - 0x14], esi
test esi, esi
je 0xaa98ee
lock inc dword [esi + 0x10]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ebx
cmp edi, 0x82
je 0xb55c5b
mov eax, 0x113
cmp edi, eax
ja 0xaa9978
je 0xb55e0e
cmp edi, 0x3d
jbe 0xaa9954
cmp edi, 0x4e
je 0xb55df1
cmp edi, 0xff
ja 0xb55d44
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
mov edx, edi
push dword [ebp + 0x10]
call fcn.00aa99c3
mov ebx, eax
test esi, esi
je 0xaa994a
push esi
call fcn.00a623d0
mov eax, ebx
call fcn.00af8dc0
ret 0x14
je 0xb55ca3
mov eax, edi
sub eax, 7
je 0xb55c7c
sub eax, 1
je 0xb55c70
sub eax, 7
jne 0xaa992e
jmp 0xb55e1f
mov eax, edi
sub eax, 0x200
je 0xb55e8b
sub eax, 1
je 0xb55e7c
sub eax, 1
je 0xb55e6d
dec eax
sub eax, 1
je 0xb55e4f
sub eax, 1
je 0xb55e40
sub eax, 0x9e
je 0xb55e2e
sub eax, 0x75
jne 0xaa992e
jmp 0xb55e1f
push dword [ebp + 0x18]
mov edx, 0xaa98b0
call fcn.00a4b2af
mov ecx, dword [ebp + 8]
jmp 0xaa9905
mov ecx, esi
call fcn.00b9edd4
jmp 0xaa992e
mov ecx, esi
call fcn.00b9edd4
push ecx
push ecx
push dword [esi + 0x30]
mov ecx, esi
mov byte [esi + 0x4f], 1
call fcn.00ba0442
push ebx
push ebx
push dword [esi + 0x30]
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
jmp 0xaa992e
cmp dword [ebp + 0x14], 0xfffffffc
jne 0xaa992e
cmp dword [esi + 0xc4], ebx
jne 0xb55d2b
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00a398c6
lea eax, [ebp - 0x10]
push eax
push 0x9f073c
push 0xfffffffffffffffc
push 0x9ef194
push dword [ebp + 8]
call dword [sym.imp.OLEACC.dll_CreateStdAccessibleProxyW]
test eax, eax
js 0xb55d23
push 0xc96c04
push 0x24
call fcn.00ab4242
pop ecx
pop ecx
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0xb55d09
push 1
push esi
push dword [ebp - 0x10]
mov ecx, eax
call fcn.00b9ec4f
mov ebx, eax
mov byte [ebp - 4], 1
mov eax, dword [esi + 0xc4]
test eax, eax
je 0xb55d1d
push eax
call fcn.00a36be0
mov dword [esi + 0xc4], ebx
lea ecx, [ebp - 0x10]
call fcn.00a398c6
push dword [esi + 0xc4]
push dword [ebp + 0x10]
push 0x9f08e8
call dword [sym.imp.OLEACC.dll_LresultFromObject]
jmp 0xaa993e
cmp edi, 0x102
jbe 0xb55d5b
lea eax, [edi - 0x104]
cmp eax, 2
ja 0xaa992e
cmp edi, 0x101
jne 0xb55d7d
cmp dword [ebp + 0x10], 0x20
je 0xb55d6f
cmp dword [ebp + 0x10], 0xd
jne 0xb55da6
push 1
mov ecx, esi
call fcn.00b9ee1d
jmp 0xaa9940
cmp edi, 0x100
je 0xb55d8d
cmp edi, 0x104
jne 0xb55da6
cmp dword [ebp + 0x10], 0x5d
je 0xb55dca
cmp dword [ebp + 0x10], 0x79
jne 0xb55da6
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0xb55dca
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [esi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetParent]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
test eax, eax
je 0xaa9940
jmp 0xaa992e
push 3
pop eax
cmp dword [esi + 0x24], eax
je 0xb55de0
push ebx
push ebx
push dword [esi + 0x30]
mov dword [esi + 0x24], eax
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
push ecx
push ecx
push dword [ebp + 8]
mov ecx, esi
call fcn.00ba04cd
jmp 0xaa9940
mov eax, dword [ebp + 0x14]
cmp dword [eax + 8], 0xfffffdf7
jne 0xaa9940
push ecx
mov ecx, esi
call fcn.00ba0961
jmp 0xaa993e
push ecx
push dword [ebp + 0x10]
push ecx
mov ecx, esi
call fcn.00ba0894
jmp 0xaa993e
push ecx
push ecx
push ecx
mov ecx, esi
call fcn.00ba07f3
jmp 0xaa993e
push ecx
push ecx
push ecx
mov ecx, esi
mov byte [esi + 0x50], bl
call fcn.00ba03ce
jmp 0xaa992e
push ecx
push ecx
push ecx
mov ecx, esi
call fcn.00ba04cd
jmp 0xaa993e
push 3
pop eax
cmp dword [esi + 0x24], eax
je 0xb55e65
push ebx
push ebx
push dword [esi + 0x30]
mov dword [esi + 0x24], eax
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
xor ebx, ebx
inc ebx
jmp 0xaa9940
push ecx
push ecx
push ecx
mov ecx, esi
call fcn.00ba0385
jmp 0xaa993e
push ecx
push ecx
push ecx
mov ecx, esi
call fcn.00ba02b7
jmp 0xaa993e
push ecx
push ecx
push ecx
mov ecx, esi
mov byte [esi + 0x50], 1
call fcn.00ba0442
jmp 0xaa992e