Function at 0x1003fd90
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x68
mov eax, dword [0x10080040]
xor eax, esp
mov dword [esp + 0x64], eax
mov eax, dword [0x1014e66c]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp dword [eax + 0x74], 0
je 0x1003fe47
mov ecx, dword [esi + 0x48]
test ecx, ecx
je 0x1003fe47
mov eax, dword [ecx + 8]
add ecx, 8
mov eax, dword [eax + 8]
call eax
cmp dword [eax + 0x14], 0xf7
jne 0x1003fe47
mov eax, dword [0x1014e68c]
cmp byte [eax + 0xcf], 0
je 0x1003fe47
cmp byte [eax], 0
je 0x1003fe47
cmp byte [eax + 0x94], 0
je 0x1003fe47
mov ecx, dword [0x1014e66c]
mov ecx, dword [ecx + 0x74]
call fcn.10003270
test al, al
je 0x1003fe47
mov eax, dword [0x1014e66c]
cmp dword [eax + 0x78], 0
je 0x1003fe47
mov eax, dword [0x1014e68c]
movzx eax, word [eax + 2]
test ax, ax
je 0x1003fe47
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1003fe47
cmp dword [0x1014d158], 0
jne 0x1003fe5c
push 0x10070874
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [0x1014d158], eax
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.100672f0
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x1014d158]
jne 0x1003fe47
mov ecx, dword [0x1014e66c]
mov ecx, dword [ecx + 0x78]
call fcn.10056120
test al, al
je 0x1003fe47
mov eax, dword [0x1014e66c]
lea ecx, [esp + 0x18]
push esi
push ecx
mov dword [esp + 0x20], 0
push dword [eax + 0x78]
mov dword [esp + 0x28], 0
push dword [eax + 0x74]
mov dword [esp + 0x30], 0
call fcn.10040cd0
test al, al
je 0x1003fe47
mov eax, dword [0x1014e66c]
mov ecx, esi
push dword [eax + 0x74]
call fcn.1003e370
test al, al
je 0x1003fe47
mov ecx, dword [esi + 0x48]
add ecx, 8
mov eax, dword [ecx]
mov eax, dword [eax + 8]
call eax
cmp dword [eax + 0x14], 0xf7
jne 0x1003fe47
mov eax, dword [0x1014e66c]
mov ecx, esi
push edi
push dword [eax + 0x78]
push dword [eax + 0x74]
call fcn.1003e980
mov ecx, dword [0x1014e66c]
lea eax, [esp + 0x2c]
push eax
mov ecx, dword [ecx + 0x74]
call fcn.10003380
mov ecx, dword [esi + 0x48]
lea eax, [esp + 0x38]
push eax
call fcn.10002dc0
mov eax, dword [0x1014e68c]
xor esi, esi
cvttss2si edi, dword [eax + 0xd4]
test edi, edi
jle 0x1003fe47
movd xmm2, edi
cvtdq2ps xmm2, xmm2
movss dword [esp + 0x14], xmm2
xorps xmm0, xmm0
cvtsi2ss xmm0, esi
movaps xmm1, xmm0
movss dword [esp + 0xc], xmm0
addss xmm1, xmm0
movss xmm0, dword [0x10076e28]
divss xmm1, xmm2
subss xmm0, xmm1
cvtps2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_acos_precise
cvtsd2ss xmm0, xmm0
cvtss2sd xmm0, xmm0
movsd qword [esp + 0x18], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sin_precise
cvtsd2ss xmm0, xmm0
movss dword [esp + 0x10], xmm0
movss xmm0, dword [esp + 0xc]
mulss xmm0, dword [0x10076e70]
movss dword [esp + 0xc], xmm0
cvtps2pd xmm0, xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_cos_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
mulss xmm1, dword [esp + 0x10]
mulss xmm1, dword [0x10076f1c]
addss xmm1, dword [esp + 0x38]
movss dword [esp + 0x2c], xmm1
movss xmm1, dword [esp + 0xc]
cvtps2pd xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sin_precise
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movsd xmm0, qword [esp + 0x18]
mulss xmm1, dword [esp + 0x10]
mulss xmm1, dword [0x10076f1c]
addss xmm1, dword [esp + 0x3c]
movss dword [esp + 0x30], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_cos_precise
mov eax, dword [0x1014e66c]
lea ecx, [esp + 0x44]
cvtsd2ss xmm0, xmm0
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x48], 0
push ecx
mov byte [esp + 0x70], 0
push dword [eax + 0x78]
mulss xmm0, dword [0x10076f1c]
addss xmm0, dword [esp + 0x4c]
movss dword [esp + 0x40], xmm0
xorps xmm0, xmm0
movups xmmword [esp + 0x54], xmm0
movups xmmword [esp + 0x64], xmm0
push dword [eax + 0x74]
call fcn.10040cd0
test al, al
je 0x1004006b
lea eax, [esp + 0x44]
push eax
call fcn.100405e0
movzx eax, al
xorps xmm1, xmm1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
comiss xmm0, xmm1
jb 0x1004006b
movss xmm1, dword [0x10076e84]
comiss xmm1, xmm0
jae 0x1004007f
inc esi
cmp esi, edi
jge 0x1003fe47
movss xmm2, dword [esp + 0x14]
jmp 0x1003ff32
mov ecx, dword [esp + 0x6c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.100672f0
mov esp, ebp
pop ebp
ret 4