Function at 0x10068bf0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
cmp byte [0x101e29e5], 0
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
je 0x10068c1c
mov byte [0x101e29e5], 0
mov word [esi + 7], 1
jmp 0x10069199
cmp byte [esi + 7], 0
je 0x10068d3d
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101e14f0]
mov edi, dword [0x101e094c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101e29f0]
cmp eax, dword [ecx + 4]
jle 0x10068c75
push 0x101e29f0
call fcn.100b5535
add esp, 4
cmp dword [0x101e29f0], 0xffffffff
jne 0x10068c75
mov eax, dword [0x101e2924]
push 0x101e29f0
mov dword [0x101e29e8], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e29e8]
movss xmm0, dword [eax + edi]
mov eax, dword [0x101e1d20]
subss xmm0, dword [eax + 0x10]
andps xmm0, xmmword [0x1016dda0]
comiss xmm0, dword [0x1016d4f8]
jb 0x10068d1e
cmp byte [esi + 0x1c], 0
jne 0x10068d1e
mov eax, dword [0x101e2528]
cmp byte [eax + 0x64764], 0
jne 0x10068d1e
mov eax, dword [0x101e1d50]
cmp dword [eax + 0x4cb0], 0
jne 0x10068d1e
mov eax, dword [0x101dfe94]
inc eax
cmp eax, 3
ja case.default.0x10068cca
jmp dword [eax*4 + 0x100691c4]
mov al, 1
jmp 0x10068cff
push dword [0x101dfe90]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
jmp 0x10068cff
push dword [0x101dfe90]
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10068cff
xor al, al
mov byte [esi + 3], al
mov dword [esi + 0x34], 0
mov byte [esi + 7], 0
mov byte [esi + 1], 1
mov dword [esi + 0x30], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101e07bc]
test byte [eax + 0x30], 1
je 0x100691b4
inc dword [esi + 0x34]
mov dword [esi + 0x30], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101e2520]
cmp byte [eax], 0
je 0x10068d59
cmp byte [esi + 2], 0
mov byte [esi], 0
jne 0x10069195
jmp 0x10069169
mov eax, dword [0x101dfe94]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
inc eax
mov ecx, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 3
ja case.default.0x10068d74
jmp dword [eax*4 + 0x100691d4]
push dword [0x101dfe90]
call edi
jmp 0x10068d8d
push dword [0x101dfe90]
call ecx
test ax, ax
setne al
test al, al
je 0x1006912c
cmp byte [esi + 9], 0
mov byte [esi], 1
mov byte [esi + 2], 0
je case.0x10069140.0
cmp byte [esi + 3], 0
jne 0x10068db6
mov byte [esi + 3], 1
mov edi, dword [0x101e094c]
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x6f8]
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x10068f5d
mov ecx, dword fs:[0x2c]
mov eax, dword [0x101e14f0]
mov eax, dword [ecx + eax*4]
mov ecx, dword [0x101e274c]
cmp ecx, dword [eax + 4]
jle 0x10068e1e
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x10068e1e
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e2750]
mov ecx, dword [esp + 0xc]
cmp word [eax + edi], 0x1f
mov ecx, dword [ecx + 0xc8]
je 0x10068e4a
test ecx, ecx
je 0x10068e4a
cmp ecx, 7
jl 0x10068f5d
cmp ecx, 0x10
jg 0x10068f5d
mov edi, dword [0x101e094c]
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x6f8]
call eax
mov dword [esp + 0xc], eax
test eax, eax
je 0x10068ed0
mov esi, dword fs:[0x2c]
mov edx, dword [0x101e14f0]
mov ecx, dword [0x101e274c]
mov eax, dword [esi + edx*4]
mov esi, dword [esp + 8]
cmp ecx, dword [eax + 4]
jle 0x10068eb3
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x10068eb3
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [esp + 0xc]
cmp dword [eax + 0xc8], 0
jne 0x10068ed0
mov eax, dword [0x101e2750]
cmp word [eax + edi], 0x1f
jne 0x10068f5d
mov edi, dword [0x101e094c]
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x6f8]
call eax
test eax, eax
je 0x10068f40
mov esi, dword fs:[0x2c]
mov edx, dword [0x101e14f0]
mov eax, dword [0x101e274c]
mov ecx, dword [esi + edx*4]
mov esi, dword [esp + 8]
cmp eax, dword [ecx + 4]
jle 0x10068f34
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x10068f34
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e2750]
cmp word [eax + edi], 0x1f
je 0x10068f5d
mov eax, dword [esi + 0x14]
mov word [esi + 0xc], 0
mov byte [esi + 0xe], 1
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x101e07bc]
cmp dword [eax + 0x38], 0
jne 0x10068fc1
mov ecx, dword [0x101e253c]
call fcn.1007aa00
test al, al
je 0x10068fc1
mov ecx, dword [esi + 0x14]
dec ecx
cmp dword [esi + 0x2c], ecx
jl 0x10068fa6
cmp byte [esi + 0xa], 0
jne 0x10068f8a
mov byte [esi + 0xa], 1
cmp byte [esi + 0xf], 0
jne 0x10068f94
mov byte [esi + 0xf], 1
mov eax, dword [0x101e07bc]
mov eax, dword [eax + 4]
mov dword [esi + 0x30], eax
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], ecx
inc dword [esi + 0x34]
mov word [esi], 0
mov word [esi + 0xc], 0
mov byte [0x101e29e5], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x101e2520]
call fcn.10066790
test al, al
je 0x1006910f
mov eax, dword [0x101e14f0]
mov ecx, dword fs:[0x2c]
mov edi, dword [0x101e094c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [0x101e274c]
cmp eax, dword [ecx + 4]
jle 0x10069023
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x10069023
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e2750]
cmp word [edi + eax], 0x40
je 0x1006910f
mov edi, dword [0x101e094c]
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x6f8]
call eax
mov ecx, eax
mov dword [esp + 0xc], ecx
test ecx, ecx
je 0x100690c1
mov esi, dword fs:[0x2c]
mov eax, dword [0x101e14f0]
mov ecx, dword [0x101e274c]
mov edx, dword [esi + eax*4]
mov esi, dword [esp + 8]
cmp ecx, dword [edx + 4]
jle 0x1006909d
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x1006909d
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e2750]
mov ecx, dword [esp + 0xc]
cmp word [edi + eax], 0x1f
mov ecx, dword [ecx + 0xc8]
je 0x1006910f
test ecx, ecx
je 0x1006910f
cmp ecx, 7
jl 0x100690c1
cmp ecx, 0x10
jle 0x1006910f
cmp byte [esi + 0xd], 0
mov al, byte [esi + 0xc]
jne 0x100690df
test al, al
jne 0x100690db
mov dword [esi + 0x28], 0
mov al, 1
mov byte [esi + 0xc], 1
mov byte [esi + 0xd], 1
test al, al
je 0x10069115
mov ecx, dword [esi + 0x28]
xor edi, edi
mov eax, dword [esi + 0x14]
test ecx, ecx
cmovle eax, edi
mov dword [esi + 0x24], eax
lea eax, [ecx + 1]
mov dword [esi + 0x28], eax
cmp eax, dword [esi + 0x14]
jl case.0x10069140.0
mov dword [esi + 0x28], edi
mov byte [esi + 0xc], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov word [esi + 0xc], 0
mov eax, dword [esi + 0x14]
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], 0
mov byte [esi + 0xd], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [sym.imp.USER32.dll_GetKeyState]
mov byte [esi], 0
mov eax, dword [0x101dfeb4]
inc eax
cmp eax, 3
ja case.default.0x10069140
jmp dword [eax*4 + 0x100691e4]
push dword [0x101dfeb0]
call edi
jmp 0x10069159
push dword [0x101dfeb0]
call ecx
test ax, ax
setne al
test al, al
jne case.0x10069140.0
cmp byte [esi + 2], 0
jne case.0x10069140.0
cmp byte [esi + 3], 0
mov byte [esi + 0xa], 1
je 0x10069191
mov eax, dword [esi + 0x14]
dec eax
cmp dword [esi + 0x2c], eax
jl 0x1006918d
cmp byte [esi + 0xf], 0
jne 0x10069186
mov byte [esi + 0xf], 1
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
mov byte [esi + 3], 0
mov byte [esi + 2], 1
mov byte [esi + 8], 0
mov word [esi + 0xc], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret