Function at 0x10146a7
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4b4
mov eax, dword [0x101ed2c]
push ebx
push esi
push edi
push 0xb
pop ecx
mov esi, 0x1001c18
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 4], eax
push 0xd
xor eax, eax
pop ecx
xor ebx, ebx
lea edi, [ebp - 0x3a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7f
xor eax, eax
pop ecx
mov word [ebp - 0x268], bx
lea edi, [ebp - 0x266]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7f
xor eax, eax
cmp dword [0x101ecc8], 2
mov word [ebp - 0x468], bx
pop ecx
lea edi, [ebp - 0x466]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x4b4]
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x484], ebx
mov dword [ebp - 0x474], ebx
mov byte [ebp - 0x470], bl
mov byte [ebp - 0x46f], bl
mov byte [ebp - 0x46e], bl
mov byte [ebp - 0x46d], bl
mov byte [ebp - 0x46c], bl
mov byte [ebp - 0x46b], 5
mov dword [ebp - 0x4a0], 0xc
mov dword [ebp - 0x498], ebx
mov dword [ebp - 0x49c], eax
mov edi, 0xf003f
jne 0x10144f1
lea eax, [ebp - 0x484]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x10144dd
call fcn.0101426e
cmp eax, ebx
mov dword [ebp - 0x480], eax
je 0x10144dd
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 0x494], esi
je 0x10144dd
push 1
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test eax, eax
je 0x10144dd
push ebx
push esi
lea eax, [ebp - 0x4b4]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
test eax, eax
je 0x10144dd
mov esi, 0x400
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x474], eax
je 0x1014551
push 2
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
test eax, eax
je 0x10144dd
push dword [ebp - 0x494]
mov esi, dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
push edi
push 2
push dword [ebp - 0x474]
call esi
test eax, eax
je 0x10144dd
push dword [ebp - 0x484]
push edi
push 2
push dword [ebp - 0x474]
call esi
test eax, eax
je 0x10144dd
push ebx
push dword [ebp - 0x474]
lea eax, [ebp - 0x4b4]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
test eax, eax
jne 0x10144f1
mov edi, 0x100
push edi
lea eax, [ebp - 0x268]
push eax
push 8
jmp 0x10146a4
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x4a0]
push eax
push edi
push ebx
push 0x1001be4
push ebx
lea eax, [ebp - 0x68]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1014695
cmp dword [ebp - 0x490], 1
je 0x101453b
cmp dword [ebp - 0x490], 2
jne 0x1014695
mov edi, 0x1f8
push edi
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [0x101ee10], eax
jne 0x1014565
mov edi, 0x100
push edi
lea eax, [ebp - 0x268]
push eax
push 7
jmp 0x10146a4
push 4
pop eax
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x47c], eax
push 0x1001bd0
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x488]
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x478]
call esi
test eax, eax
je 0x10145b5
mov dword [ebp - 0x48c], ebx
push 0x1001bc0
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x488], 3
mov dword [ebp - 0x47c], edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x47c]
push eax
push dword [0x101ee10]
lea eax, [ebp - 0x488]
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x478]
call esi
test eax, eax
jne 0x1014606
cmp dword [ebp - 0x48c], 3
jae 0x101475b
push edi
push 0x101c020
push 3
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x47c]
push eax
push dword [0x101ee10]
lea eax, [ebp - 0x488]
push eax
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x478]
mov dword [ebp - 0x47c], edi
call esi
push ebx
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardType]
cmp eax, 1
je 0x1014681
cmp eax, 2
je 0x1014673
jle 0x1014681
cmp eax, 6
jle 0x1014681
cmp eax, 7
jne 0x1014681
mov eax, dword [0x101ee10]
mov dword [eax + 0x24], SetSecurityDescriptorDacl
jmp 0x101468d
mov eax, dword [0x101ee10]
mov dword [eax + 0x24], BitBlt
jmp 0x101468d
mov eax, dword [0x101ee10]
mov dword [eax + 0x24], BitBlt
cmp esi, ebx
je 0x1014719
mov edi, 0x100
push edi
lea eax, [ebp - 0x268]
push eax
push 6
push dword [0x101ee0c]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
call esi
push edi
lea eax, [ebp - 0x468]
push eax
push 1
push dword [0x101ee0c]
call esi
push 0x10
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x268]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp dword [ebp - 0x484], ebx
je 0x10146ef
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [ebp - 0x480], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1014705
push dword [ebp - 0x480]
call esi
cmp dword [ebp - 0x474], ebx
je 0x1014715
push dword [ebp - 0x474]
call esi
xor eax, eax
jmp 0x1014794
push 4
pop esi
push 0x1001bd0
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x488], esi
mov dword [ebp - 0x47c], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0x48c]
push eax
push esi
push ebx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x478]
mov dword [ebp - 0x48c], 3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [ebp - 0x480]
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
call esi
cmp dword [ebp - 0x474], ebx
je 0x1014791
push dword [ebp - 0x474]
call esi
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101a8d9
leave
ret