Function at 0x100799e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b3762
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x18], ebx
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
cmp edi, 0xd
jne 0x10079b81
test cl, cl
je 0x10079bae
push 0x11
call eax
mov ecx, 0x8000
test cx, ax
jne 0x10079ba2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x10079ba2
mov ecx, dword [esi + 0x3dd0]
cmp byte [ecx + 0xed0], 1
jne 0x10079aa1
lea eax, [esp + 0x30]
push eax
call fcn.100723b0
mov dword [esp + 0x58], ebx
mov edx, str.com.chaoxing.mobile
mov ebx, 1
mov ecx, eax
mov dword [esp + 0x18], ebx
call fcn.10011a60
mov byte [esp + 0x17], bl
test al, al
jne 0x10079aa6
mov byte [esp + 0x17], 0
mov dword [esp + 0x58], 0xffffffff
test bl, 1
je 0x10079abf
lea ecx, [esp + 0x30]
and ebx, 0xfffffffe
call fcn.10003610
mov ecx, dword [esi + 0x3dd0]
mov eax, dword [ecx + 0xed0]
shr eax, 0x1e
and al, 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x30]
push eax
call fcn.100723b0
mov ecx, eax
mov edx, dword [ecx + 0x10]
or ebx, 2
cmp dword [ecx + 0x14], 0x10
mov dword [esp + 0x18], edx
jb 0x10079af2
mov ecx, dword [ecx]
mov eax, 0x14
cmp edx, eax
cmovb eax, edx
mov edx, str.com.tencent.tmgp.wec
push eax
call fcn.100110c0
add esp, 4
test eax, eax
jne 0x10079b26
mov ecx, dword [esp + 0x18]
cmp ecx, 0x14
jae 0x10079b1c
or eax, 0xffffffff
jmp 0x10079b24
xor eax, eax
cmp ecx, 0x14
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x10079b54
mov eax, dword [esi + 0x3dd0]
cmp byte [eax + 0xed0], 0
je 0x10079b54
cmp byte [esp + 0x17], 0
jne 0x10079b54
cmp byte [esp + 0x20], 0
mov byte [esp + 0x17], 1
je 0x10079b59
mov byte [esp + 0x17], 0
mov dword [esp + 0x58], 0xffffffff
test bl, 2
je 0x10079b6f
lea ecx, [esp + 0x30]
call fcn.10003610
cmp byte [esp + 0x17], 0
je 0x10079ba2
mov eax, dword [esi - 4]
lea ecx, [esi - 4]
call dword [eax + 0x24]
jmp 0x10079ba2
cmp edi, 9
jne 0x10079baa
test cl, cl
je 0x10079bae
cmp byte [ebp + 0x14], bl
je 0x10079baa
mov eax, dword [ebp + 0xc]
shr eax, 0x1e
test al, 1
jne 0x10079ba5
mov eax, dword [esi - 4]
lea ecx, [esi - 4]
call dword [eax + 0x28]
mov ecx, dword [ebp + 0x10]
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
test cl, cl
jne 0x10079c12
push 0xa5
call eax
mov ecx, 0x8000
test cx, ax
je 0x10079c12
cmp edi, 0x78
je 0x10079bd3
cmp edi, 0x79
je 0x10079bd3
cmp edi, 0x7a
je 0x10079bd3
cmp edi, 0x7b
jne 0x10079c12
mov ecx, dword [esp + 0x1c]
lea esi, [edi - 0x77]
xor eax, eax
mov dword [esp + 0x24], 0x2710
cmp esi, dword [0x100ec62c]
push 0xc
cmove esi, eax
mov dword [esp + 0x2c], 0xa
lea eax, [esp + 0x28]
mov dword [esp + 0x30], esi
push eax
add ecx, 0xc
call fcn.100041a0
mov dword [0x100ec62c], esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3dd4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0x44]
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100ab974
mov esp, ebp
pop ebp
ret 0x10