Function at 0x10003720
Capabilities:
Access peb ldr_data
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100da5c6
mov eax, dword fs:[0]
push eax
sub esp, 0x130
push ebx
push esi
push edi
mov eax, dword [0x1010502c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ecx], ebx
mov dword [ebp - 0x30], eax
mov eax, dword [0x10107740]
mov edi, dword [eax + 8]
mov ecx, dword [edi]
mov esi, dword [ecx + 0xc]
mov ecx, dword [eax + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
push eax
mov ecx, edi
call esi
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
test edx, edx
je 0x10004008
mov ecx, dword [0x100f5188]
mov cl, byte [ecx + edx]
test cl, cl
jne 0x10004008
mov eax, dword [0x100f465c]
mov al, byte [eax + edx]
test al, al
je 0x100037b9
mov eax, dword [0x100f50e0]
mov ecx, dword [eax + edx]
mov eax, dword [0x100f311c]
cmp ecx, dword [eax + edx]
ja 0x10004008
mov eax, dword [0x100f51e8]
mov edx, dword [edx + eax]
test edx, edx
je 0x10004008
mov eax, dword [0x10107740]
push edx
mov ecx, dword [eax + 8]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x10004008
mov edi, dword [ebp - 0x30]
push esi
push edi
call fcn.10003090
cmp byte [0x101058e0], bl
je 0x100037ff
mov dword [edi + 0x14], ebx
mov byte [0x101058e0], bl
cmp byte [0x101058e1], bl
je 0x10003837
mov eax, dword [0x10107740]
lea edx, [ebp - 0x2c]
movss xmm0, dword [edi + 0xc]
movss xmm1, dword [edi + 0x10]
push edx
mov ecx, dword [eax + 4]
movss dword [ebp - 0x2c], xmm0
movss dword [ebp - 0x28], xmm1
mov dword [ebp - 0x24], ebx
mov eax, dword [ecx]
mov eax, dword [eax + 0x50]
call eax
mov byte [0x101058e1], bl
cmp byte [0x101058d6], bl
jne 0x1000384f
cmp byte [0x101058d7], bl
jne 0x1000384f
cmp byte [0x101058d8], bl
je 0x10003859
mov ecx, dword [ebp - 0x1c]
push esi
push edi
call fcn.10004200
cmp byte [0x10105758], bl
jne 0x10003879
cmp byte [0x101055b8], bl
jne 0x10004008
cmp byte [0x101055bb], bl
jne 0x10004008
cmp dword [0x101055bc], ebx
je 0x10003887
push ecx
call fcn.100046b0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10106354]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x10106390]
cmp eax, dword [ecx + 4]
jle 0x100038db
push 0x10106390
call fcn.100d8ed3
add esp, 4
cmp dword [0x10106390], 0xffffffff
jne 0x100038db
push str.client.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add eax, 0x151a0
push 0x10106390
mov dword [0x10106394], eax
call fcn.100d8e89
add esp, 4
mov eax, dword [0x10106394]
mov ecx, esi
call eax
lea esi, [eax + 0x56]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [eax + 0x144], 9
je 0x10003b46
mov eax, dword [0x100f5118]
mov ecx, dword [ebp - 0x20]
mov al, byte [eax + ecx]
test al, al
jne 0x10003b46
test dword [edi + 0x24], 0x2000
jne 0x10003b46
cmp byte [0x10105757], bl
jne 0x1000397d
push str.Claws
lea ecx, [ebp - 0x138]
call fcn.10007b20
mov dword [ebp - 4], 0
mov ebx, 1
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b46
push str.Huge_Claws
lea ecx, [ebp - 0x120]
call fcn.10007b20
mov dword [ebp - 4], ebx
mov edx, esi
mov ebx, 3
mov ecx, eax
mov dword [ebp - 0x18], ebx
call fcn.10007000
test al, al
jne 0x10003b46
push str.Pipe_Bomb
lea ecx, [ebp - 0x108]
call fcn.10007b20
mov dword [ebp - 4], 2
or ebx, 4
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b46
push str.Molotov
lea ecx, [ebp - 0xf0]
call fcn.10007b20
mov dword [ebp - 4], 3
or ebx, 8
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b46
push str.__Vomit_Jar__
lea ecx, [ebp - 0xd8]
call fcn.10007b20
mov dword [ebp - 4], 4
or ebx, 0x10
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b46
cmp byte [0x10105756], al
jne 0x10003a6b
push str.BaseMelee
lea ecx, [ebp - 0xc0]
call fcn.10007b20
mov dword [ebp - 4], 5
or ebx, 0x20
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b46
push str._chainsaw_
lea ecx, [ebp - 0xa8]
call fcn.10007b20
mov dword [ebp - 4], 6
or ebx, 0x40
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b46
push str.BaseMelee
lea ecx, [ebp - 0x90]
call fcn.10007b20
mov dword [ebp - 4], 7
or ebx, 0x80
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b1e
push str._chainsaw_
lea ecx, [ebp - 0x78]
call fcn.10007b20
mov dword [ebp - 4], 8
or ebx, 0x100
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b1e
push str.Claws
lea ecx, [ebp - 0x60]
call fcn.10007b20
mov dword [ebp - 4], 9
or ebx, 0x200
mov edx, esi
mov dword [ebp - 0x18], ebx
mov ecx, eax
call fcn.10007000
test al, al
jne 0x10003b1e
push str.Huge_Claws
lea ecx, [ebp - 0x48]
call fcn.10007b20
mov edx, esi
mov ecx, eax
or ebx, 0x400
call fcn.10007000
test al, al
jne 0x10003b1e
mov eax, dword [0x100f5108]
mov ecx, dword [ebp - 0x20]
cmp dword [eax + ecx], 1
jl 0x10003b46
cmp byte [0x1010638d], 0
jne 0x10003b46
cmp byte [0x1010638c], 0
jne 0x10003b46
cmp byte [0x1010638b], 0
jne 0x10003b46
cmp byte [0x1010638a], 0
mov byte [ebp - 0x11], 0
je 0x10003b4a
mov byte [ebp - 0x11], 1
test ebx, 0x400
je 0x10003b9e
mov ecx, dword [ebp - 0x34]
and ebx, 0xfffffbff
cmp ecx, 0x10
jb 0x10003b8c
mov edx, dword [ebp - 0x48]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003b82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
mov dword [ebp - 4], 8
test ebx, 0x200
je 0x10003bf9
mov ecx, dword [ebp - 0x4c]
and ebx, 0xfffffdff
cmp ecx, 0x10
jb 0x10003be7
mov edx, dword [ebp - 0x60]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003bdd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
mov dword [ebp - 4], 7
test ebx, 0x100
je 0x10003c54
mov ecx, dword [ebp - 0x64]
and ebx, 0xfffffeff
cmp ecx, 0x10
jb 0x10003c42
mov edx, dword [ebp - 0x78]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003c38
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0xf
mov byte [ebp - 0x78], 0
mov dword [ebp - 4], 6
test bl, bl
jns 0x10003cb1
mov ecx, dword [ebp - 0x7c]
and ebx, 0xffffff7f
cmp ecx, 0x10
jb 0x10003c9c
mov edx, dword [ebp - 0x90]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003c92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0xf
mov byte [ebp - 0x90], 0
mov dword [ebp - 4], 5
test bl, 0x40
je 0x10003d15
mov ecx, dword [ebp - 0x94]
and ebx, 0xffffffbf
cmp ecx, 0x10
jb 0x10003cfa
mov edx, dword [ebp - 0xa8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003cf0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0xf
mov byte [ebp - 0xa8], 0
mov dword [ebp - 4], 4
test bl, 0x20
je 0x10003d79
mov ecx, dword [ebp - 0xac]
and ebx, 0xffffffdf
cmp ecx, 0x10
jb 0x10003d5e
mov edx, dword [ebp - 0xc0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003d54
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0xf
mov byte [ebp - 0xc0], 0
mov dword [ebp - 4], 3
test bl, 0x10
je 0x10003ddd
mov ecx, dword [ebp - 0xc4]
and ebx, 0xffffffef
cmp ecx, 0x10
jb 0x10003dc2
mov edx, dword [ebp - 0xd8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003db8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0xc4], 0xf
mov byte [ebp - 0xd8], 0
mov dword [ebp - 4], 2
test bl, 8
je 0x10003e41
mov ecx, dword [ebp - 0xdc]
and ebx, 0xfffffff7
cmp ecx, 0x10
jb 0x10003e26
mov edx, dword [ebp - 0xf0]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003e1c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0xf
mov byte [ebp - 0xf0], 0
mov dword [ebp - 4], 1
test bl, 4
je 0x10003ea5
mov ecx, dword [ebp - 0xf4]
and ebx, 0xfffffffb
cmp ecx, 0x10
jb 0x10003e8a
mov edx, dword [ebp - 0x108]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003e80
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xf4], 0xf
mov byte [ebp - 0x108], 0
mov dword [ebp - 4], 0
test bl, 2
je 0x10003f05
mov ecx, dword [ebp - 0x10c]
and ebx, 0xfffffffd
cmp ecx, 0x10
jb 0x10003eea
mov edx, dword [ebp - 0x120]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003ee0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003f3d
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x10c], 0xf
mov byte [ebp - 0x120], 0
mov dword [ebp - 4], 0xffffffff
test bl, 1
je 0x10003f68
mov ecx, dword [ebp - 0x124]
cmp ecx, 0x10
jb 0x10003f4d
mov edx, dword [ebp - 0x138]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10003f43
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10003f43
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.100d8ffc
add esp, 8
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0xf
mov byte [ebp - 0x138], 0
cmp byte [ebp - 0x11], 0
jne 0x10004008
cmp dword [0x101055bc], 0
je 0x10003f8a
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push ebx
push edi
call fcn.10004bb0
jmp 0x10003ff8
test byte [edi + 0x24], 1
jne 0x10003fa3
push dword [0x101055c0]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
bt ax, 0xf
jae 0x10003ff5
cmp byte [0x10105608], 0
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
je 0x10003fbb
push ebx
push edi
mov ecx, esi
call fcn.10006800
cmp dword [0x101056a8], 2
jne 0x10003ff8
mov eax, dword [esi]
add eax, dword [0x100f5178]
movq xmm0, qword [eax]
movq qword [ebp - 0x2c], xmm0
movss xmm0, dword [edi + 0xc]
subss xmm0, dword [ebp - 0x2c]
movss dword [edi + 0xc], xmm0
movss xmm0, dword [edi + 0x10]
subss xmm0, dword [ebp - 0x28]
movss dword [edi + 0x10], xmm0
jmp 0x10003ff8
mov ebx, dword [ebp - 0x20]
cmp byte [0x101055f3], 0
je 0x10004008
push ebx
push edi
call fcn.10004020
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4