Function at 0x1000d9f0
Capabilities:
Access peb ldr_data
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035891
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x1006200c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x100c9544]
push dword [ebp + 0x10]
movss xmm0, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov eax, dword [eax + 0x14]
push ecx
movss dword [esp], xmm0
push esi
mov eax, dword [eax + 0x48]
call eax
mov ecx, dword [0x100c9388]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x100c9394]
push eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [0x100c9394]
mov dword [ebp - 0x30], eax
push dword [eax + 0xb38]
mov edx, dword [ecx]
mov edx, dword [edx + 0x10]
call edx
mov ecx, eax
test ecx, ecx
jne 0x1000da75
mov dword [ebp - 0x34], eax
jmp 0x1000da7f
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
mov dword [ebp - 0x34], eax
mov ecx, dword [0x100c96cc]
test ecx, ecx
je 0x1000e4f3
mov byte [0x102ca4f1], 1
mov edx, dword [ecx]
push esi
mov eax, dword [edx + 0x20]
call eax
cmp byte [0x100c9196], 0
mov esi, eax
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
je 0x1000dac6
push 1
call edi
test ax, ax
jne 0x1000dabf
push 2
call edi
test ax, ax
je 0x1000dac6
and dword [esi + 0x24], 0xfffff1e6
movss xmm0, dword [esi + 0x1c]
lea edi, [esi + 0xc]
movss dword [0x102bb920], xmm0
movss xmm0, dword [esi + 0x18]
movss dword [0x102bb924], xmm0
movss xmm0, dword [edi]
movss dword [0x102bb934], xmm0
movss xmm0, dword [edi + 4]
movss dword [0x102bb938], xmm0
movss xmm0, dword [edi + 8]
movss dword [0x102bb93c], xmm0
movss xmm0, dword [edi]
movss dword [0x102bb928], xmm0
movss xmm0, dword [edi + 4]
movss dword [0x102bb92c], xmm0
movss xmm0, dword [edi + 8]
movss dword [0x102bb930], xmm0
call fcn.1002f130
cmp byte [0x100c9196], 0
je 0x1000db44
and dword [esi + 0x24], 0xfffff7fe
inc dword [0x100c96c4]
cmp byte [0x100e57c8], 0
je 0x1000dc2d
push 0x75
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1006221c]
test ax, ax
mov edx, 1
cmovne ecx, edx
push 0x76
mov dword [0x1006221c], ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000db94
lea eax, [ebp - 0x28]
mov word [0x100c97ec], 1
mov dword [0x100c97e8], eax
push 0x77
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000dbb2
lea eax, [ebp - 0x28]
mov word [0x100c97ec], 0x100
mov dword [0x100c97e8], eax
push 0x78
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1006221c]
test ax, ax
mov edx, 2
cmovne ecx, edx
push 0x79
mov dword [0x1006221c], ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1006221c]
xor edx, edx
test ax, ax
push 0x7a
cmovne ecx, edx
mov dword [0x1006221c], ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1006221c]
test ax, ax
mov edx, 3
cmovne ecx, edx
sub esp, 0xc
mov dword [0x1006221c], ecx
mov ecx, esp
movq xmm0, qword [edi]
mov eax, dword [edi + 8]
push dword [ebp - 0x30]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
mov ecx, 0x10062210
push esi
call fcn.1002b8b0
mov ecx, dword [ebp - 0x30]
call fcn.10003180
cmp dword [eax], 0
jne 0x1000e4f3
cmp byte [0x100e51dc], 0
je 0x1000dc9d
cmp byte [0x102ca5f0], 0
jne 0x1000dc5f
cmp byte [0x102ca5b8], 0
je 0x1000dc5f
or dword [esi + 0x24], 2
jmp 0x1000dc96
test byte [esi + 0x24], 2
je 0x1000dc8f
mov ecx, dword [ebp - 0x30]
call fcn.10002eb0
test byte [eax], 1
je 0x1000dc82
mov al, 1
mov byte [0x102ca5b8], 1
mov byte [0x102ca5f0], al
jmp 0x1000dc9d
and dword [esi + 0x24], 0xfffffffd
xor al, al
mov byte [0x102ca5f0], al
jmp 0x1000dc9d
mov byte [0x102ca5f0], 0
mov byte [0x102ca5b8], 0
push dword [ebp - 0x30]
mov ecx, 0x100cb27c
push esi
call fcn.1002b470
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
call eax
cmp byte [0x100e51e2], 0
mov ecx, dword [ebp - 0x30]
movss xmm2, dword [eax]
movss xmm1, dword [eax + 4]
movss xmm0, dword [eax + 8]
addss xmm2, dword [ecx + 0xd4]
addss xmm1, dword [ecx + 0xd8]
addss xmm0, dword [ecx + 0xdc]
movss dword [0x100ca10c], xmm2
movss dword [0x100ca110], xmm1
movss dword [0x100ca114], xmm0
je 0x1000dd0f
mov eax, dword [ebp - 0x34]
push eax
push ecx
push esi
mov ecx, 0x102bb97c
call fcn.10031c40
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x4a4]
call eax
mov dword [ebp - 0x2c], eax
test eax, eax
jns 0x1000dd30
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x35], 0
jmp 0x1000dd63
cmp eax, 0x1d
jle 0x1000dd42
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x35], 0
jmp 0x1000dd63
mov ecx, eax
cmp eax, 0x18
je 0x1000dd5f
mov dword [ebp - 0x2c], ecx
cmp ecx, 9
je 0x1000dd5f
mov dword [ebp - 0x2c], ecx
cmp ecx, 4
je 0x1000dd5f
mov byte [ebp - 0x35], 0
jmp 0x1000dd63
mov byte [ebp - 0x35], 1
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx]
mov eax, dword [eax + 0x4a4]
call eax
test eax, eax
js case.0x1000dd8d.0
cmp eax, 0x1d
jg case.0x1000dd8d.0
cmp eax, 0x1c
ja case.0x1000dd8d.1
movzx eax, byte [eax + 0x1000e518]
jmp dword [eax*4 + 0x1000e510]
mov eax, dword [esi + 0x24]
mov ecx, dword [ebp - 0x34]
cmp byte [0x100e4f7b], 0
je 0x1000df02
cmp dword [ecx + 0x6fc], 0
jle 0x1000df02
test al, 0x20
jne 0x1000df02
movq xmm0, qword [edi]
mov eax, dword [edi + 8]
movq qword [ebp - 0x48], xmm0
movss xmm0, dword [esi + 0x1c]
movss dword [ebp - 0x2c], xmm0
movss xmm0, dword [esi + 0x18]
movss dword [ebp - 0x28], xmm0
movss xmm0, dword [ecx + 0x6b8]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
movss dword [ebp - 0x3c], xmm0
call fcn.10022020
mov eax, dword [eax]
inc eax
movd xmm0, eax
mov eax, dword [0x100c9390]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [eax + 0x1c]
comiss xmm0, dword [ebp - 0x3c]
jb 0x1000deb5
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x6fc], 0
jle 0x1000deb5
mov al, 1
jmp 0x1000deb7
cmp dword [ebp - 0x2c], 0x1c
jne 0x1000de7b
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
movss xmm0, dword [eax + 0x6b8]
movss dword [ebp - 0x3c], xmm0
call fcn.10022020
mov eax, dword [eax]
inc eax
movd xmm0, eax
mov eax, dword [0x100c9390]
cvtdq2ps xmm0, xmm0
mulss xmm0, dword [eax + 0x1c]
comiss xmm0, dword [ebp - 0x3c]
jb 0x1000de6d
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x6fc], 0
jg 0x1000de7b
mov eax, dword [esi + 0x24]
test eax, 0x801
je 0x1000dd97
cmp byte [ebp - 0x35], 0
je 0x1000e321
mov eax, dword [esi + 0x24]
test al, 1
jne 0x1000e321
mov ecx, dword [ebp - 0x34]
movsd xmm0, qword [str.333333]
movss xmm1, dword [ecx + 0x77c]
cvtps2pd xmm1, xmm1
comisd xmm0, xmm1
jbe 0x1000e321
jmp 0x1000dd9a
xor al, al
test byte [esi + 0x24], 1
je 0x1000deca
test al, al
jne 0x1000deca
mov byte [0x102ca4f1], 1
jmp 0x1000df02
movss xmm0, dword [ebp - 0x48]
mov byte [0x102ca4f1], 0
movss dword [edi], xmm0
movss xmm0, dword [ebp - 0x44]
movss dword [edi + 4], xmm0
movss xmm0, dword [ebp - 0x40]
movss dword [edi + 8], xmm0
movss xmm0, dword [ebp - 0x2c]
movss dword [esi + 0x1c], xmm0
movss xmm0, dword [ebp - 0x28]
movss dword [esi + 0x18], xmm0
cmp byte [0x100e5144], 0
je 0x1000df17
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push esi
call fcn.10030450
cmp byte [0x100e4f74], 0
je 0x1000e0ce
push dword [ebp - 0x30]
movq xmm0, qword [edi]
mov ecx, 0x100c9940
mov eax, dword [edi + 8]
push esi
movq qword [ebp - 0x48], xmm0
mov dword [ebp - 0x40], eax
call fcn.10004e20
cmp byte [0x100e4f7e], 0
je 0x1000e0ce
movss xmm2, dword [edi]
subss xmm2, dword [ebp - 0x48]
movss xmm3, dword [0x1005e574]
movss xmm6, dword [0x1005e6b0]
comiss xmm2, xmm3
movaps xmm0, xmm2
movss dword [ebp - 0x3c], xmm2
mulss xmm0, dword [0x1005e348]
movss dword [ebp - 0x2c], xmm0
ja 0x1000df93
movss xmm5, dword [0x1005e60c]
comiss xmm5, xmm2
ja 0x1000df93
xorps xmm4, xmm4
jmp 0x1000dffb
xorps xmm2, xmm2
comiss xmm2, xmm0
jbe 0x1000dfa3
xorps xmm0, xmm6
movss dword [ebp - 0x2c], xmm0
fld dword [ebp - 0x2c]
push ecx
fstp dword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
movss xmm2, dword [ebp - 0x3c]
xorps xmm4, xmm4
movss xmm3, dword [0x1005e574]
add esp, 4
comiss xmm4, xmm2
movss xmm5, dword [0x1005e60c]
movss xmm6, dword [0x1005e6b0]
fstp dword [ebp - 0x2c]
movss xmm0, dword [ebp - 0x2c]
mulss xmm0, dword [0x1005e5a4]
jbe 0x1000dff2
addss xmm0, xmm2
movss dword [ebp - 0x3c], xmm0
jmp 0x1000dffb
subss xmm2, xmm0
movss dword [ebp - 0x3c], xmm2
movss xmm1, dword [esi + 0x10]
movss xmm7, dword [ebp - 0x44]
subss xmm1, xmm7
comiss xmm1, xmm3
movaps xmm0, xmm1
movss dword [ebp - 0x28], xmm1
mulss xmm0, dword [0x1005e348]
movss dword [ebp - 0x2c], xmm0
ja 0x1000e028
comiss xmm5, xmm1
jbe 0x1000e078
comiss xmm4, xmm0
jbe 0x1000e035
xorps xmm0, xmm6
movss dword [ebp - 0x2c], xmm0
fld dword [ebp - 0x2c]
push ecx
fstp dword [esp]
call sub.api_ms_win_crt_math_l1_1_0.dll_roundf
movss xmm1, dword [ebp - 0x28]
xorps xmm2, xmm2
movss xmm3, dword [0x1005e574]
add esp, 4
comiss xmm2, xmm1
movss xmm7, dword [ebp - 0x44]
fstp dword [ebp - 0x2c]
movss xmm0, dword [ebp - 0x2c]
mulss xmm0, dword [0x1005e5a4]
jbe 0x1000e074
addss xmm1, xmm0
jmp 0x1000e078
subss xmm1, xmm0
mov eax, dword [0x100e4f94]
cmp eax, 0xb4
jge 0x1000e093
movd xmm3, eax
cvtdq2ps xmm3, xmm3
addss xmm3, dword [0x100e50a0]
movss xmm0, dword [ebp - 0x3c]
comiss xmm3, xmm0
jbe 0x1000e0b6
movaps xmm2, xmm3
xorps xmm2, xmmword [0x1005e6b0]
comiss xmm0, xmm2
jbe 0x1000e0b6
comiss xmm3, xmm1
jbe 0x1000e0b6
comiss xmm1, xmm2
ja 0x1000e0ce
movss xmm0, dword [ebp - 0x48]
movss dword [edi], xmm0
movss xmm0, dword [ebp - 0x40]
movss dword [edi + 4], xmm7
movss dword [edi + 8], xmm0
test byte [esi + 0x24], 1
je 0x1000e29c
push dword [ebp - 0x34]
push dword [ebp - 0x30]
call fcn.10031640
test al, al
je 0x1000e24a
mov eax, dword [0x100c99dc]
cmp eax, 0xffffffff
je 0x1000e0fc
inc dword [eax*4 + 0x100c96d8]
mov edx, dword [0x100c9390]
mov ecx, 1
cmp dword [edx + 0x14], ecx
jle 0x1000e11e
mov eax, 0x100cb3a4
inc dword [eax]
inc ecx
add eax, 0xd0
cmp ecx, dword [edx + 0x14]
jl 0x1000e111
mov cl, byte [0x100e5144]
mov byte [0x102ca4f2], 0
mov byte [0x102ca4f0], 1
mov dword [0x102ca4ec], 0
test cl, cl
je 0x1000e14d
cmp byte [0x100e5146], 0
jne 0x1000e14d
mov al, 1
jmp 0x1000e14f
xor al, al
test cl, cl
je 0x1000e15b
test al, al
je 0x1000e1fb
cmp byte [0x100e513c], 0
je 0x1000e197
mov ecx, dword [esi + 4]
call fcn.1002df10
and eax, 0x7fffffff
mov dword [esi + 0x34], eax
cmp al, 0x8d
je 0x1000e197
nop dword [eax + eax]
inc dword [esi + 4]
mov ecx, dword [esi + 4]
call fcn.1002df10
and eax, 0x7fffffff
mov dword [esi + 0x34], eax
cmp al, 0x8d
jne 0x1000e180
cmp byte [0x100e513d], 0
je 0x1000e1fb
mov eax, dword [0x100e5140]
sub eax, 1
je 0x1000e1de
sub eax, 1
je 0x1000e1c9
sub eax, 1
movzx eax, byte [0x100e5165]
push eax
push dword [ebp - 0x34]
push ecx
push edi
push esi
jne 0x1000e1ec
call fcn.10025b80
jmp 0x1000e1f1
movzx eax, byte [0x100e5165]
push eax
push dword [ebp - 0x34]
push ecx
push edi
push esi
call fcn.10026c20
jmp 0x1000e1f1
movzx eax, byte [0x100e5165]
push eax
push dword [ebp - 0x34]
push ecx
push edi
push esi
call fcn.100265c0
push ecx
push dword [ebp - 0x30]
push esi
call fcn.10030aa0
cmp dword [0x100e5138], 0
je 0x1000e321
cmp dword [0x100c99dc], 0xffffffff
je 0x1000e321
call fcn.100321e0
imul eax, dword [0x100c99dc], 0x7580
addss xmm0, dword [eax + 0x100e5810]
mov eax, dword [0x100c9390]
divss xmm0, dword [eax + 0x1c]
addss xmm0, dword [0x1005e3f8]
cvttss2si eax, xmm0
mov dword [esi + 8], eax
jmp 0x1000e321
cmp byte [0x100e4f7c], 0
je 0x1000e269
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
jmp 0x1000e27c
push dword [0x100e51ac]
mov ecx, dword [ebp - 0x30]
mov edx, esi
call fcn.1000d3a0
add esp, 4
cmp byte [0x100e515e], 0
je 0x1000e293
push ecx
mov ecx, dword [ebp - 0x30]
mov edx, esi
call fcn.1000d850
add esp, 4
and dword [esi + 0x24], 0xfffffffe
jmp 0x1000e321
cmp byte [0x100e4f7c], 0
je 0x1000e2bb
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
jmp 0x1000e2ce
push dword [0x100e51ac]
mov ecx, dword [ebp - 0x30]
mov edx, esi
call fcn.1000d3a0
add esp, 4
cmp byte [0x100e515e], 0
je 0x1000e2e5
push ecx
mov ecx, dword [ebp - 0x30]
mov edx, esi
call fcn.1000d850
add esp, 4
cmp byte [0x100e51e5], 0
je 0x1000e321
push 0x46
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x1000e30b
cmp byte [0x100e51e6], 0
sete al
mov byte [0x100e51e6], al
jmp 0x1000e310
mov al, byte [0x100e51e6]
test al, al
je 0x1000e321
test byte [esi + 0x24], 1
jne 0x1000e321
mov dword [esi + 8], 0x7fffffff
cmp byte [0x100e51dd], 0
je 0x1000e3fc
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10062724]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1033143c]
cmp eax, dword [ecx + 4]
jle 0x1000e3cd
push 0x1033143c
call fcn.10032d27
add esp, 4
cmp dword [0x1033143c], 0xffffffff
jne 0x1000e3cd
mov dword [ebp - 4], 0
mov cl, 0x6e
mov dword [ebp - 0x20], 0x31020d6e
xor eax, eax
mov dword [ebp - 0x1c], 0x50d0f0c
mov dword [ebp - 0x18], 0xb0b1e1d
mov word [ebp - 0x14], 0xa
nop word [eax + eax]
xor byte [ebp + eax - 0x1f], cl
inc eax
cmp eax, 0xc
jae 0x1000e39f
mov cl, byte [ebp - 0x20]
jmp 0x1000e390
mov ecx, dword [0x100c9374]
lea edx, [ebp - 0x1f]
mov byte [ebp - 0x13], 0
push edx
mov eax, dword [ecx]
mov eax, dword [eax + 0x1c]
call eax
push 0x1033143c
mov dword [0x1033145c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.10032cdd
add esp, 4
push 0x20
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1033145c]
test ax, ax
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
je 0x1000e3f5
push 0
call eax
mov edx, dword [ebp - 0x30]
mov ecx, esi
call fcn.10030f90
jmp 0x1000e3fc
push 0x190
call eax
push ecx
push esi
mov esi, dword [ebp - 0x30]
mov ecx, 0x102bb950
push esi
call fcn.1002ea80
push esi
push ecx
mov ecx, 0x100cb27c
call fcn.1002b680
cmp byte [0x100e515c], 0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
je 0x1000e43d
push 0x56
call esi
test al, 1
je 0x1000e43d
cmp byte [0x100e515d], 0
sete byte [0x100e515d]
push 0x4a
call esi
test al, 1
je 0x1000e453
cmp byte [0x100c917c], 0
sete byte [0x100c917c]
push 0x4e
call esi
test al, 1
je 0x1000e469
cmp byte [0x100c917d], 0
sete byte [0x100c917d]
cmp byte [0x102ca4f1], 0
movss xmm0, dword [edi]
je 0x1000e49a
movss dword [0x100ca01c], xmm0
movss xmm0, dword [edi + 4]
movss dword [0x100ca020], xmm0
movss xmm0, dword [edi + 8]
movss dword [0x100ca024], xmm0
jmp 0x1000e4bc
movss dword [0x100ca034], xmm0
movss xmm0, dword [edi + 4]
movss dword [0x100ca038], xmm0
movss xmm0, dword [edi + 8]
movss dword [0x100ca03c], xmm0
mov eax, dword [0x100e51ec]
test eax, eax
jne 0x1000e4d4
movq xmm0, qword [0x100ca01c]
mov eax, dword [0x100ca024]
jmp 0x1000e4e6
cmp eax, 1
jne 0x1000e4f3
movq xmm0, qword [0x100ca034]
mov eax, dword [0x100ca03c]
mov dword [0x100ca0fc], eax
movq qword [0x100ca0f4], xmm0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100328be
mov esp, ebp
pop ebp
ret 0x10