Function at 0x1008e2e0
Capabilities:
Log keystrokes via application hook

Disassembly:
cmp byte [0x100f27aa], 0
push esi
push edi
jne 0x1008e354
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
xor esi, esi
push esi
push 1
push 0x100f2aec
call ebx
test eax, eax
je 0x1008e325
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0x20
jae 0x1008e311
push 0
jmp 0x1008e313
push 1
call edi
push 0
push 1
push 0x100f2aec
inc esi
call ebx
test eax, eax
jne 0x1008e308
cmp dword [0x100f2af0], 0
pop ebx
jne 0x1008e340
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov dword [0x100f2af0], eax
push 0
push 0x100f2aec
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov byte [0x100f27aa], 1
mov ecx, dword [0x100f27ec]
test ecx, ecx
je 0x1008e36f
xor edx, edx
call fcn.10095be5
mov dword [0x100f27ec], 0
mov ecx, dword [0x100f27e0]
test ecx, ecx
je 0x1008e38a
xor edx, edx
call fcn.10095be5
mov dword [0x100f27e0], 0
mov ecx, dword [0x100f27e8]
test ecx, ecx
je 0x1008e3a5
xor edx, edx
call fcn.10095be5
mov dword [0x100f27e8], 0
mov ecx, dword [0x100f1d48]
test ecx, ecx
je 0x1008e3c0
xor edx, edx
call fcn.10095be5
mov dword [0x100f1d48], 0
mov ecx, dword [0x100f27d4]
test ecx, ecx
je 0x1008e3db
xor edx, edx
call fcn.10095be5
mov dword [0x100f27d4], 0
mov ecx, dword [0x100f27c4]
test ecx, ecx
je 0x1008e3f6
xor edx, edx
call fcn.10095be5
mov dword [0x100f27c4], 0
mov ecx, dword [0x100f27cc]
test ecx, ecx
je 0x1008e411
xor edx, edx
call fcn.10095be5
mov dword [0x100f27cc], 0
mov ecx, dword [0x100f27bc]
test ecx, ecx
je 0x1008e42c
xor edx, edx
call fcn.10095be5
mov dword [0x100f27bc], 0
mov ecx, dword [0x100f27b0]
test ecx, ecx
je 0x1008e447
xor edx, edx
call fcn.10095be5
mov dword [0x100f27b0], 0
mov ecx, dword [0x100f2804]
test ecx, ecx
je 0x1008e462
xor edx, edx
call fcn.10095be5
mov dword [0x100f2804], 0
mov ecx, dword [0x100f27a4]
test ecx, ecx
je 0x1008e47d
xor edx, edx
call fcn.10095be5
mov dword [0x100f27a4], 0
mov ecx, dword [0x100f279c]
test ecx, ecx
je 0x1008e498
xor edx, edx
call fcn.10095be5
mov dword [0x100f279c], 0
mov ecx, dword [0x100f2788]
test ecx, ecx
je 0x1008e4b3
xor edx, edx
call fcn.10095be5
mov dword [0x100f2788], 0
mov ecx, dword [0x100f2790]
test ecx, ecx
je 0x1008e4ce
xor edx, edx
call fcn.10095be5
mov dword [0x100f2790], 0
mov ecx, dword [0x100f2778]
test ecx, ecx
je 0x1008e4e9
xor edx, edx
call fcn.10095be5
mov dword [0x100f2778], 0
mov ecx, dword [0x100f2780]
test ecx, ecx
je 0x1008e504
xor edx, edx
call fcn.10095be5
mov dword [0x100f2780], 0
mov ecx, dword [0x100f2770]
test ecx, ecx
je 0x1008e51f
xor edx, edx
call fcn.10095be5
mov dword [0x100f2770], 0
mov ecx, dword [0x100f1d38]
test ecx, ecx
je 0x1008e53a
xor edx, edx
call fcn.10095be5
mov dword [0x100f1d38], 0
mov ecx, dword [0x100f2748]
mov edx, 0x1008d350
add ecx, 0x5fad20
push 0x100f27dc
mov dword [0x100f27ec], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27ec]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d380
add ecx, 0x30a780
push 0x100f27e4
mov dword [0x100f27e0], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27e0]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d410
add ecx, 0x3a6aa0
push 0x100f27d0
mov dword [0x100f27e8], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27e8]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x10022900
add ecx, 0x4c1550
push 0x100f1d44
mov dword [0x100f1d48], ecx
call fcn.10095aa4
mov ecx, dword [0x100f1d48]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d450
add ecx, 0x62a580
push 0x100f27d8
mov dword [0x100f27d4], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27d4]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d460
add ecx, 0x6036b0
push 0x100f27c8
mov dword [0x100f27c4], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27c4]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d5b0
add ecx, 0x337320
push 0x100f27b8
mov dword [0x100f27cc], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27cc]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d670
add ecx, 0x5bc6a0
push 0x100f27c0
mov dword [0x100f27bc], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27bc]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d680
add ecx, 0x332c20
push 0x100f27b4
mov dword [0x100f27b0], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27b0]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008d860
push 0x100f27ac
lea eax, [ecx + 0x603440]
add ecx, 0x6c6aa0
mov dword [0x100f276c], eax
mov dword [0x100f2804], ecx
call fcn.10095aa4
mov ecx, dword [0x100f2804]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008dce0
add ecx, 0x61ef00
push 0x100f2798
mov dword [0x100f27a4], ecx
call fcn.10095aa4
mov ecx, dword [0x100f27a4]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008dd60
add ecx, 0x2f8500
push 0x100f27a0
mov dword [0x100f279c], ecx
call fcn.10095aa4
mov ecx, dword [0x100f279c]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008df00
add ecx, 0x601de0
push 0x100f278c
mov dword [0x100f2788], ecx
call fcn.10095aa4
mov ecx, dword [0x100f2788]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008e0a0
add ecx, 0x601e10
push 0x100f2794
mov dword [0x100f2790], ecx
call fcn.10095aa4
mov ecx, dword [0x100f2790]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008e2b0
add ecx, 0x3625f0
push 0x100f277c
mov dword [0x100f2778], ecx
call fcn.10095aa4
mov ecx, dword [0x100f2778]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008e2c0
add ecx, 0x35e780
push 0x100f2784
mov dword [0x100f2780], ecx
call fcn.10095aa4
mov ecx, dword [0x100f2780]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1008e2d0
add ecx, 0x372f50
push 0x100f2774
mov dword [0x100f2770], ecx
call fcn.10095aa4
mov ecx, dword [0x100f2770]
mov edx, 1
call fcn.10095be5
mov ecx, dword [0x100f2748]
mov edx, 0x1001e200
add ecx, 0x3412f0
push 0x100f1d34
mov dword [0x100f1d38], ecx
call fcn.10095aa4
mov edx, 1
mov ecx, dword [0x100f1d38]
call fcn.10095be5
call fcn.10028010
cmp dword [0x100f26ec], 0
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jne 0x1008e8e8
call edi
push eax
push dword [0x100f26fc]
push 0x1008d150
push 2
call esi
mov dword [0x100f26ec], eax
cmp dword [0x100f26e8], 0
jne 0x1008e908
call edi
push eax
push dword [0x100f26fc]
push 0x1008d010
push 7
call esi
mov dword [0x100f26e8], eax
pop edi
mov byte [0x100f26ce], 0
pop esi
ret