Function at 0x100514d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [0x1012a815], 0
je 0x10052153
push ebx
mov ebx, 1
cmp dword [0x1014a068], ebx
jne 0x1005214b
push 2
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1005214b
push 0x41
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1005214b
push 0x39
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1005214b
push 0x48
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1005214b
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100515a3
push 0x4d
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100515a3
push 0xe
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1005214b
push 0xd
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100515e9
push 8
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
je 0x100515e9
push 0x4e
mov eax, 0x861110
call eax
mov edx, 0x85ec20
mov ecx, eax
call edx
test al, al
jne 0x1005214b
mov eax, dword [0x879340c]
fld dword [0x10133f78]
xor ecx, ecx
fstp dword [ebp - 4]
fld dword [0x10133f7c]
cmp eax, 0x280
setge cl
fstp dword [ebp - 8]
xor edx, edx
push esi
push edi
dec ecx
and ecx, eax
mov eax, dword [0x8793410]
cmp eax, 0x1e0
setge dl
mov dword [ebp - 0x20], ecx
fild dword [ebp - 0x20]
fstp dword [ebp - 0x14]
dec edx
and edx, eax
mov eax, dword [0xe61e5c]
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
fstp dword [ebp - 0x10]
fild dword [0xe61e5c]
test eax, eax
jns 0x10051648
fadd dword [0x100b7030]
fld qword [0x100b7568]
mov ecx, dword [0xe61e58]
fmul st(1), st(0)
sub esp, 0x10
fxch st(1)
fdiv qword [0x100b7560]
fdivr qword [0x100b7558]
fstp dword [ebp - 0x20]
fld dword [ebp - 0x20]
fstp dword [esp + 0xc]
fild dword [0xe61e58]
test ecx, ecx
jns 0x10051681
fadd dword [0x100b7030]
fmulp st(1)
fdiv qword [0x100b7550]
fdivr qword [0x100b7548]
fstp dword [ebp - 0x20]
fld dword [ebp - 0x20]
fstp dword [esp + 8]
fld dword [ebp - 8]
fstp dword [esp + 4]
fld dword [ebp - 4]
fstp dword [esp]
call fcn.10050ee0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
test al, al
je 0x100516ef
cmp byte [0x10133f74], 0
jne 0x100516fc
push ebx
call esi
mov edx, 0x8000
test dx, ax
je 0x100516ef
fld dword [ebp - 0x14]
mov byte [0x10133f74], bl
call fcn.100ac0e0
fld dword [ebp - 0x10]
mov word [0x10133f88], ax
call fcn.100ac0e0
mov word [0x10133f8a], ax
jmp 0x100516fc
cmp byte [0x10133f74], 0
je 0x100517bb
movsx eax, word [0x10133f88]
fld dword [ebp - 0x14]
movsx ecx, word [0x10133f8a]
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
fsubp st(1)
fadd dword [0x10133f78]
fstp dword [ebp - 4]
fld dword [ebp - 0x10]
fild dword [ebp - 0x20]
fsubp st(1)
fadd dword [0x10133f7c]
fstp dword [ebp - 8]
fld dword [0x100b7540]
fcom dword [ebp - 4]
fnstsw ax
test ah, 0x41
jne 0x10051747
fstp dword [ebp - 4]
jmp 0x10051749
fstp st(0)
fld dword [ebp - 4]
fcomp qword [0x100b7538]
fnstsw ax
test ah, 0x41
jne 0x10051762
fld dword [0x100b7534]
fstp dword [ebp - 4]
fld dword [0x100b71f4]
fld dword [ebp - 8]
fcom st(1)
fnstsw ax
test ah, 5
jp 0x1005177b
fstp st(0)
fstp dword [ebp - 8]
jmp 0x10051795
fstp st(1)
fld dword [0x100b7530]
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 5
jp 0x10051793
fstp dword [ebp - 8]
jmp 0x10051795
fstp st(0)
push ebx
call esi
mov edx, 0x8000
test dx, ax
jne 0x100517bb
fld dword [ebp - 4]
mov byte [0x10133f74], 0
fstp dword [0x10133f78]
fld dword [ebp - 8]
fstp dword [0x10133f7c]
fldz
push ecx
fst dword [esp]
mov eax, 0x637c60
fld1
push ebx
push ebx
sub esp, 0x20
fst dword [esp + 0x1c]
fstp dword [esp + 0x18]
fst dword [esp + 0x14]
fstp dword [esp + 0x10]
fld dword [0x100b7648]
fstp dword [esp + 0xc]
fld dword [0x100b7c30]
fstp dword [esp + 8]
fld dword [0x1012a804]
fadd qword [0x100b7300]
fstp dword [ebp - 0x20]
fld dword [ebp - 0x20]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b7138]
fstp dword [ebp - 0x20]
fld dword [ebp - 0x20]
fstp dword [esp]
push 0x7a121
call eax
fld dword [0x1012a804]
fadd qword [0x100b72f0]
add esp, 0x28
mov eax, 0x1ae
mov ecx, 0x10123c90
fstp dword [ebp - 0x20]
fld dword [ebp - 0x20]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b8298]
fstp dword [ebp - 0x20]
fld dword [ebp - 0x20]
fstp dword [esp]
call fcn.1004eed0
mov eax, 0x1ae
mov ecx, 0x10123c90
call fcn.10051040
test al, al
je 0x10051897
fld dword [0x1012a944]
sub esp, 8
fstp dword [esp + 4]
mov edx, 0x96323232
fld dword [0x1012a940]
mov eax, 0x1ae
mov ecx, 0x10123c90
fstp dword [esp]
call fcn.10051300
fld dword [ebp - 8]
call fcn.100ac0e0
fld dword [ebp - 4]
mov edi, eax
mov dword [ebp - 0xc], edi
call fcn.100ac0e0
push 5
mov ecx, 0x100e4cc8
mov esi, eax
call fcn.1003e200
push eax
push 0xd2
lea edx, [esi + 0xa]
push edx
lea ecx, [edi + 0xa]
push 0xff19bdff
mov ebx, 3
call fcn.10050e40
mov eax, dword [0x106868a0]
add esp, 0x10
push eax
push 6
mov ecx, 0x100e4cc8
lea edi, [esi + 0x1e]
call fcn.1003e200
mov ecx, dword [ebp - 0xc]
push eax
push 0xd2
push edi
add ecx, 0x23
push 0xffffffffffffffff
mov ebx, 1
call fcn.10050e40
add esp, 0x14
push 0xe
mov ecx, 0x100e4cc8
mov dword [ebp - 0x10], eax
call fcn.1003e200
mov ecx, dword [ebp - 0x10]
push eax
push 0xd2
push edi
push 0xff19bdff
call fcn.10050e40
add esp, 0x10
push 7
mov ecx, 0x100e4cc8
mov dword [ebp - 0x10], eax
call fcn.1003e200
mov ecx, dword [ebp - 0x10]
push eax
push 0xd2
push edi
push 0xffffffffffffffff
call fcn.10050e40
add esp, 0x10
push 8
mov ecx, 0x100e4cc8
mov dword [ebp - 0x10], eax
call fcn.1003e200
mov ecx, dword [ebp - 0x10]
push eax
push 0xd2
push edi
push 0xffffffffffffffff
call fcn.10050e40
fld dword [ebp - 4]
fadd qword [0x100b7518]
fsub qword [0x100b6f18]
fstp dword [ebp - 0x20]
fld1
fstp dword [esp + 0xc]
fld dword [0x100b7510]
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b7190]
fstp dword [ebp - 0x1c]
fld dword [ebp - 0x1c]
fstp dword [esp + 4]
fld dword [ebp - 0x20]
fstp dword [esp]
push 0x11760
mov ecx, 0x790b50
call ecx
mov ecx, dword [ebp - 0xc]
push str.Loi
push 0xd2
push edi
add ecx, 0x5d
push 0xff19bdff
call fcn.10050e40
mov edi, dword [ebp - 0xc]
push 0x100b38c0
lea eax, [esi + 0x50]
push 0xd2
push eax
add edi, 0x5d
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
push str.Drop
lea eax, [esi + 0x82]
push 0xd2
push eax
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
add esp, 0x44
push str.Thi_Gian
lea eax, [esi + 0xaa]
push 0xd2
push eax
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
mov eax, dword [0x1014a06c]
add esp, 0x10
cmp eax, ebx
jb 0x10051a43
cmp eax, 3
jbe 0x10051a4d
mov eax, 3
mov dword [0x1014a06c], eax
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp eax, ecx
jle 0x10051ba2
fld dword [ebp - 4]
mov edx, dword [ebp - 0xc]
fadd qword [0x100b7300]
add edx, 0x69
mov dword [ebp - 0x14], ecx
mov edi, 0x100d959c
fst dword [ebp - 0x24]
mov dword [ebp - 0x10], edx
fld dword [ebp - 8]
fadd qword [0x100b7260]
fstp qword [ebp - 0x30]
fadd qword [0x100b7a10]
fstp dword [ebp - 0x28]
lea esp, [esp]
mov ecx, dword [ebp - 0x10]
lea eax, [edi + 0x18]
push eax
push 0xd2
lea eax, [esi + 0x1e]
push eax
push 0xffffffffffffffff
mov ebx, 1
call fcn.10050e40
mov ecx, dword [edi]
push ecx
mov ecx, dword [ebp - 0x10]
push str._d__
push 0xd2
lea eax, [esi + 0x50]
push eax
push 0xffffffffffffffff
call fcn.10050e40
mov edx, dword [edi + 4]
mov ecx, dword [ebp - 0x10]
push edx
push str._d__
push 0xd2
lea eax, [esi + 0x82]
push eax
push 0xffffffffffffffff
call fcn.10050e40
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 0x10]
push eax
push str._d_day_s_
push 0xd2
lea eax, [esi + 0xaa]
push eax
push 0xffffffffffffffff
call fcn.10050e40
fild dword [ebp - 0x14]
add esp, 0x4c
sub esp, 0x10
fadd qword [ebp - 0x30]
mov ecx, 0x790b50
fadd qword [0x100b7708]
fsub qword [0x100b70f0]
fstp dword [ebp - 0x18]
fld dword [0x100b6fa8]
fstp dword [esp + 0xc]
fld dword [0x100b7a88]
fstp dword [esp + 8]
fld dword [ebp - 0x18]
fstp dword [esp + 4]
fld dword [ebp - 0x24]
fstp dword [esp]
push 0x7b5e
call ecx
fld dword [0x100b6fa8]
fstp dword [esp + 0x10]
add esp, 4
fld dword [0x100b7a88]
mov edx, 0x790b50
fstp dword [esp + 8]
fld dword [ebp - 0x18]
fstp dword [esp + 4]
fld dword [ebp - 0x28]
fstp dword [esp]
push 0x7b5e
call edx
mov ecx, dword [ebp - 0x1c]
mov eax, 0xc
add dword [ebp - 0x14], eax
add dword [ebp - 0x10], eax
mov eax, dword [0x1014a06c]
inc ecx
add esp, 0x14
add edi, 0x3c
mov dword [ebp - 0x1c], ecx
cmp ecx, eax
jl 0x10051a90
test eax, eax
je 0x10051d73
mov eax, 0x1af
mov ecx, 0x10123c90
call fcn.10051040
sub esp, 0x10
test al, al
mov ecx, 0x10123c90
mov eax, 0x1af
je 0x10051d00
cmp byte [0x1012a994], 0
je 0x10051c0b
fld dword [0x100b8074]
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b7418]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
jmp 0x10051c3d
fld dword [0x100b734c]
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b7418]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp]
call fcn.10050f40
mov edi, dword [ebp - 0xc]
push 0xa
mov ecx, 0x100e4cc8
add edi, 0x8e
call fcn.1003e200
push eax
push 0xd2
lea eax, [esi + 0x1e]
push eax
push 0xff19bdff
mov ebx, 1
mov ecx, edi
call fcn.10050e40
mov eax, dword [0x100d95a8]
add esp, 0x10
push eax
push 0xb
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea ecx, [esi + 0x46]
push ecx
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
mov edx, dword [0x100d95ac]
add esp, 0x14
push edx
push 0xc
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea eax, [esi + 0x78]
push eax
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
mov ecx, dword [0x100d95b0]
add esp, 0x14
push ecx
push 0xd
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea edx, [esi + 0xa0]
push edx
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
add esp, 0x14
jmp 0x10051d34
fldz
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b7418]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp]
call fcn.10050f40
push 0x100d95b4
push 9
mov ecx, 0x100e4cc8
call fcn.1003e200
fld dword [ebp - 8]
fadd qword [0x100b8278]
push eax
push 0xa0
call fcn.100ac0e0
lea ecx, [esi + 0x5a]
push ecx
push 0xffffffffffffffff
mov ebx, 1
mov ecx, eax
call fcn.10050e40
mov eax, dword [0x1014a06c]
add esp, 0x14
cmp eax, 1
jbe 0x10051f45
mov eax, 0x1b0
mov ecx, 0x10123c90
call fcn.10051040
sub esp, 0x10
test al, al
mov ecx, 0x10123c90
mov eax, 0x1b0
je 0x10051ed2
cmp byte [0x1012a9d4], 0
je 0x10051ddd
fld dword [0x100b8074]
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b74d8]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
jmp 0x10051e0f
fld dword [0x100b734c]
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b74d8]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp]
call fcn.10050f40
mov edi, dword [ebp - 0xc]
push 0xa
mov ecx, 0x100e4cc8
add edi, 0x8e
call fcn.1003e200
push eax
push 0xd2
lea eax, [esi + 0x1e]
push eax
push 0xff19bdff
mov ebx, 1
mov ecx, edi
call fcn.10050e40
mov edx, dword [0x100d95e4]
add esp, 0x10
push edx
push 0xb
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea eax, [esi + 0x46]
push eax
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
mov ecx, dword [0x100d95e8]
add esp, 0x14
push ecx
push 0xc
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea edx, [esi + 0x78]
push edx
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
mov eax, dword [0x100d95ec]
add esp, 0x14
push eax
push 0xd
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea ecx, [esi + 0xa0]
push ecx
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
add esp, 0x14
jmp 0x10051f06
fldz
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b74d8]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp]
call fcn.10050f40
push 0x100d95f0
push 9
mov ecx, 0x100e4cc8
call fcn.1003e200
fld dword [ebp - 8]
fadd qword [0x100b8290]
push eax
push 0xa0
call fcn.100ac0e0
lea edx, [esi + 0x5a]
push edx
push 0xffffffffffffffff
mov ebx, 1
mov ecx, eax
call fcn.10050e40
mov eax, dword [0x1014a06c]
add esp, 0x14
cmp eax, 2
jbe 0x10052112
mov eax, 0x1b1
mov ecx, 0x10123c90
call fcn.10051040
sub esp, 0x10
test al, al
mov ecx, 0x10123c90
mov eax, 0x1b1
je 0x100520a4
cmp byte [0x1012aa14], 0
je 0x10051faf
fld dword [0x100b8074]
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b7690]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
jmp 0x10051fe1
fld dword [0x100b734c]
fstp dword [esp + 0xc]
fldz
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b7690]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp]
call fcn.10050f40
mov edi, dword [ebp - 0xc]
push 0xa
mov ecx, 0x100e4cc8
add edi, 0x8e
call fcn.1003e200
push eax
push 0xd2
lea eax, [esi + 0x1e]
push eax
push 0xff19bdff
mov ebx, 1
mov ecx, edi
call fcn.10050e40
mov eax, dword [0x100d9620]
add esp, 0x10
push eax
push 0xb
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea ecx, [esi + 0x46]
push ecx
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
mov edx, dword [0x100d9624]
add esp, 0x14
push edx
push 0xc
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea eax, [esi + 0x78]
push eax
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
mov ecx, dword [0x100d9628]
add esp, 0x14
push ecx
push 0xd
mov ecx, 0x100e4cc8
call fcn.1003e200
push eax
push 0xd2
lea edx, [esi + 0xa0]
push edx
push 0xff19bdff
mov ecx, edi
call fcn.10050e40
add esp, 0x14
jmp 0x100520d8
fldz
fst dword [esp + 0xc]
fstp dword [esp + 8]
fld dword [ebp - 8]
fadd qword [0x100b7690]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp + 4]
fld dword [ebp - 4]
fadd qword [0x100b77d0]
fstp dword [ebp - 0x28]
fld dword [ebp - 0x28]
fstp dword [esp]
call fcn.10050f40
push 0x100d962c
push 9
mov ecx, 0x100e4cc8
call fcn.1003e200
fld dword [ebp - 8]
fadd qword [0x100b8288]
push eax
push 0xa0
call fcn.100ac0e0
add esi, 0x5a
push esi
push 0xffffffffffffffff
mov ebx, 1
mov ecx, eax
call fcn.10050e40
add esp, 0x14
fld1
sub esp, 0x10
fstp dword [esp + 0xc]
mov eax, 0x790b50
fld dword [0x100b7510]
fstp dword [esp + 8]
fld dword [0x100b7a34]
fstp dword [esp + 4]
fld dword [ebp - 0x20]
fstp dword [esp]
push 0x11760
call eax
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [0x1012a815], 0
pop ebx
mov esp, ebp
pop ebp
ret