Function at 0x101dd0b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
xor ecx, ecx
cmp dword [0x1039550], ecx
je 0x101dd32
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x101e03d
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x201
cmp ebx, eax
push esi
push edi
ja 0x101df70
je 0x101df96
mov eax, 0x113
cmp ebx, eax
ja 0x101de3a
je 0x101de29
mov eax, ebx
dec eax
je 0x101de15
sub eax, 0xe
je 0x101ddaa
sub eax, 5
je 0x101dd9a
sub eax, 0xc
jne 0x101dfed
cmp word [ebp + 0x14], 1
jne 0x101dfed
push dword [ebp + 8]
call fcn.0100c72a
test eax, eax
je 0x101dfed
jmp 0x101e038
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0101d44d
jmp 0x101e03a
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
push ebx
call fcn.0100c72a
mov esi, eax
test esi, esi
je 0x101de05
mov edi, dword [esi + 4]
xor edx, edx
inc edx
mov ecx, esi
call fcn.01024851
push dword [ebp - 0x50]
push esi
call fcn.01024afe
lea eax, [ebp - 0x48]
push eax
push esi
call fcn.01024adc
cmp dword [esi + 0x74], 0
je 0x101ddf5
push 1
push 1
push ebx
call dword [sym.imp.USER32.dll_ShowScrollBar]
push edi
push esi
call fcn.01024afe
xor edx, edx
mov ecx, esi
call fcn.01024851
lea eax, [ebp - 0x50]
push eax
push ebx
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x101e038
push 0x80000000
push ecx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x101e038
push dword [ebp + 0x10]
mov edi, dword [ebp + 8]
push eax
call fcn.0101d6fb
jmp 0x101e038
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov eax, ebx
sub eax, 0x114
mov edi, 0x8000
je 0x101deb5
dec eax
je 0x101de5b
sub eax, 0xeb
jmp 0x101df92
cmp word [ebp + 0x10], 8
jne 0x101ded5
push 0x11
call esi
test di, ax
je 0x101de74
push 9
call esi
test di, ax
jne 0x101de7b
push 0
call fcn.0101dc0e
cmp dword [0x1037d40], 0
je 0x101debc
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.0101906f
push 0x23
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
and dword [0x1037d40], 0
jmp 0x101e038
cmp word [ebp + 0x10], 8
jne 0x101ded5
push 0x11
call esi
test di, ax
je 0x101dece
push 9
call esi
test di, ax
jne 0x101ded5
push 0
call fcn.0101dc0e
push dword [ebp + 8]
call fcn.0100c72a
test eax, eax
mov dword [ebp + 0xc], eax
je 0x101e038
movzx eax, word [ebp + 0x10]
sub eax, 0
je 0x101df21
dec eax
je 0x101df1d
dec eax
je 0x101df18
dec eax
je 0x101df14
dec eax
je 0x101df10
dec eax
dec eax
je 0x101df0c
dec eax
jne 0x101e038
push 6
jmp 0x101df23
push 5
jmp 0x101df23
push 0x14
jmp 0x101df23
push 2
jmp 0x101df23
xor edi, edi
inc edi
jmp 0x101df24
push 4
jmp 0x101df23
push 3
pop edi
push dword [ebp + 0xc]
xor eax, eax
push dword [ebp + 8]
cmp ebx, 0x115
sete al
inc eax
mov esi, eax
call fcn.0101d4d2
mov ebx, eax
test ebx, ebx
je 0x101e038
cmp edi, 0x14
je 0x101df5a
push 1
push esi
push edi
push dword [ebp + 0xc]
call fcn.010248fb
jmp 0x101df6a
mov eax, dword [ebp + 0x10]
push esi
shr eax, 0x10
push eax
push dword [ebp + 0xc]
call fcn.01024aa3
push ebx
push dword [ebp + 0xc]
jmp 0x101dfcd
mov eax, 0x206
cmp ebx, eax
ja 0x101dfd7
je 0x101df96
add eax, 0xfffffffc
cmp ebx, eax
je 0x101df9c
jbe 0x101dfed
cmp ebx, 0x204
jbe 0x101df96
cmp ebx, 0x205
je 0x101df9c
jmp 0x101dfed
push ecx
call fcn.0101dc0e
push dword [ebp + 8]
call fcn.0100c72a
mov esi, eax
test esi, esi
je 0x101e038
push esi
push dword [ebp + 8]
call fcn.0101d4d2
mov edi, eax
test edi, edi
je 0x101e038
push dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push ebx
push eax
push esi
call fcn.01024b4f
push edi
push esi
push dword [ebp + 8]
call fcn.0101d4ef
jmp 0x101e038
mov ecx, ebx
mov eax, 0x311
sub ecx, eax
je 0x101e029
sub ecx, 0x6d5b
je 0x101e01c
dec ecx
je 0x101dfff
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x101e03a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x706d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x101e03a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x706c
jmp 0x101e00a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.01021254
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x10