Function at 0x1000b1b3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x74
mov eax, dword [0x1008c3cc]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [0x10094354]
mov ecx, dword [ebp + 8]
mov dword [0x10154584], eax
mov eax, dword [0x10094358]
push ebx
mov dword [0x1015458c], eax
mov eax, dword [0x10094360]
push esi
mov dword [0x10154580], eax
mov eax, dword [0x100943b0]
push edi
lea edx, [esp + 0x64]
mov dword [0x10154588], eax
mov eax, dword [ecx]
push edx
push ecx
mov dword [esp + 0x30], ecx
call dword [eax + 0xc0]
mov eax, dword [esp + 0x6c]
shr eax, 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
push 0x225a8116
addsd xmm0, qword [eax*8 + 0x10079f60]
mov eax, dword [esp + 0x74]
shr eax, 1
lea ecx, [esp + 0x3c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movss dword [esp + 0x18], xmm1
addsd xmm0, qword [eax*8 + 0x10079f60]
cvtpd2ps xmm1, xmm0
movss dword [esp + 0x14], xmm1
call fcn.100020b0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xorps xmm0, xmm0
movq qword [esp + 0x38], xmm0
mov word [esp + 0x40], 0
mov byte [esp + 0x42], 0
test eax, eax
je 0x1000b960
mov edi, dword [eax + 0x1592320]
mov dword [esp + 0x38], edi
test edi, edi
je 0x1000b960
mov al, byte [edi + 0x208]
cmp al, 0x10
jae 0x1000b0fc
movzx eax, al
imul eax, eax, 0xd80
mov al, byte [eax + edi + 0x214]
jmp 0x1000b0fe
or al, 0xff
movsx eax, al
imul eax, eax, 0xd80
lea edx, [edi + 0x208]
add edx, eax
mov dword [esp + 0x18], edx
je 0x1000b960
cmp word [edx + 0x44], 0
jle 0x1000b960
lea ecx, [edx + 0xe]
lea esi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000b130
sub ecx, esi
cmp ecx, 2
jbe 0x1000b960
cmp dword [edx + 8], 0
je 0x1000b960
cmp dword [0x10154584], 0
jle 0x1000b960
cmp byte [0x100905a8], al
jne 0x1000b960
mov eax, dword [0x1015458c]
dec eax
cmp eax, 5
ja case.default.0x1000b170
jmp dword [eax*4 + 0x1000b974]
mov dword [0x1015457c], 5
jmp 0x1000b1c9
mov dword [0x1015457c], 2
jmp 0x1000b1c9
mov dword [0x1015457c], 0xa
jmp 0x1000b1c9
mov dword [0x1015457c], 0x11
jmp 0x1000b1c9
mov dword [0x1015457c], 0x17
jmp 0x1000b1c9
mov dword [0x1015457c], 0x1c
jmp 0x1000b1c9
mov dword [0x1015457c], 6
movss xmm3, dword [0x10079f50]
or ebx, 0xffffffff
xor esi, esi
movss dword [esp + 0x20], xmm3
add edi, 0x210
push 6
push dword [edi]
lea eax, [esp + 0x34]
push eax
call fcn.10002230
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x2c]
call fcn.10002380
test al, al
je 0x1000b368
movss xmm6, dword [esp + 0x14]
movss xmm5, dword [esp + 0x10]
movaps xmm2, xmm6
divss xmm2, dword [0x10079f3c]
movaps xmm1, xmm5
divss xmm1, dword [0x10079f3c]
mulss xmm2, dword [0x10079f2c]
mulss xmm1, dword [0x10079f2c]
mov eax, dword [0x10154580]
movss dword [esp + 0x24], xmm2
movss dword [esp + 0x1c], xmm1
xorps xmm3, xmm3
cmp eax, 1
jne 0x1000b283
movaps xmm0, xmm6
subss xmm0, dword [esp + 0x2c]
movaps xmm1, xmm5
subss xmm1, dword [esp + 0x30]
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
cvtps2pd xmm0, xmm0
call fcn.1005a480
xorps xmm3, xmm3
cvtsd2ss xmm3, xmm0
jmp 0x1000b307
test eax, eax
jne 0x1000b31f
mov eax, dword [edi]
movq xmm0, qword [eax + 4]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x18]
movq qword [esp + 0x58], xmm0
mov eax, dword [eax + 8]
movss xmm1, dword [esp + 0x5c]
movq xmm0, qword [eax + 4]
movss xmm2, dword [esp + 0x58]
mov eax, dword [eax + 0xc]
movq qword [esp + 0x4c], xmm0
subss xmm2, dword [esp + 0x4c]
subss xmm1, dword [esp + 0x50]
movss xmm0, dword [esp + 0x60]
mov dword [esp + 0x54], eax
subss xmm0, dword [esp + 0x54]
mulss xmm2, xmm2
mulss xmm1, xmm1
mulss xmm0, xmm0
addss xmm2, xmm1
addss xmm2, xmm0
cvtps2pd xmm0, xmm2
call fcn.1005a480
xorps xmm3, xmm3
cvtsd2ss xmm3, xmm0
divss xmm3, dword [0x10079f3c]
movss xmm6, dword [esp + 0x14]
movss xmm5, dword [esp + 0x10]
movss xmm2, dword [esp + 0x24]
movss xmm1, dword [esp + 0x1c]
movss xmm4, dword [esp + 0x2c]
movaps xmm0, xmm6
subss xmm0, xmm2
comiss xmm4, xmm0
jb 0x1000b368
addss xmm2, xmm6
comiss xmm2, xmm4
jb 0x1000b368
movss xmm2, dword [esp + 0x30]
movaps xmm0, xmm5
subss xmm0, xmm1
comiss xmm2, xmm0
jb 0x1000b368
addss xmm1, xmm5
comiss xmm1, xmm2
jb 0x1000b368
movss xmm0, dword [esp + 0x20]
comiss xmm0, xmm3
jbe 0x1000b368
movss dword [esp + 0x20], xmm3
mov ebx, esi
inc esi
add edi, 0xd80
cmp esi, 0x10
jl 0x1000b1e2
cmp ebx, 0xffffffff
jle 0x1000b960
mov esi, dword [esp + 0x38]
imul ebx, ebx, 0xd80
add esi, 0x208
add esi, ebx
je 0x1000b960
mov ecx, esi
call fcn.10002140
test al, al
je 0x1000b960
mov eax, dword [esi + 8]
test eax, eax
je 0x1000b960
cmp word [esi + 0x44], 0
jle 0x1000b960
mov ebx, dword [esp + 0x18]
cmp esi, ebx
je 0x1000b960
push dword [0x1015457c]
push eax
lea eax, [esp + 0x54]
push eax
call fcn.10002230
lea eax, [esp + 0x4c]
push eax
push dword [esp + 0x2c]
call fcn.10002380
test al, al
je 0x1000b960
movss xmm0, dword [esp + 0x4c]
subss xmm0, dword [esp + 0x14]
mov eax, dword [0x10154588]
movss dword [esp + 0x14], xmm0
movss xmm0, dword [esp + 0x50]
subss xmm0, dword [esp + 0x10]
movss dword [esp + 0x10], xmm0
cmp eax, 1
jne 0x1000b6ec
push dword [0x1015457c]
lea eax, [esp + 0x50]
push dword [esi + 8]
push eax
call fcn.10002230
push 6
push dword [ebx + 8]
mov esi, eax
lea eax, [esp + 0x60]
push eax
call fcn.10002230
movq xmm0, qword [esi]
mov ecx, dword [esi + 8]
sub esp, 0xc
mov edx, esp
sub esp, 0xc
movq qword [edx], xmm0
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
mov dword [edx + 8], ecx
mov ecx, esp
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
call fcn.10002500
add esp, 0x18
test al, al
je 0x1000b960
mov eax, dword [0x10154584]
dec eax
cmp eax, 4
ja case.default.0x1000b48c
jmp dword [eax*4 + 0x1000b98c]
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
test eax, eax
jne 0x1000b960
mov eax, dword [0x10154584]
dec eax
cmp eax, 4
ja case.default.0x1000b703
jmp dword [eax*4 + 0x1000b9a0]
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
jmp 0x1000b957
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000b960
fld dword [esp + 0x10]
push 0
fnstcw word [esp + 0x14]
push 0
movzx eax, word [esp + 0x18]
or eax, 0xc00
mov dword [esp + 0x40], eax
fldcw word [esp + 0x40]
fistp qword [esp + 0x40]
mov eax, dword [esp + 0x40]
push eax
fldcw word [esp + 0x1c]
fld dword [esp + 0x20]
fnstcw word [esp + 0x1c]
movzx eax, word [esp + 0x1c]
or eax, 0xc00
mov dword [esp + 0x44], eax
fldcw word [esp + 0x44]
fistp qword [esp + 0x44]
mov eax, dword [esp + 0x44]
fldcw word [esp + 0x1c]
push eax
push 1
call dword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1003cd0a
mov esp, ebp
pop ebp
ret 4