Function at 0x100a8e98
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x14
mov eax, 0x10188f04
call fcn.10145d80
xor edi, edi
mov dword [ebp - 0x14], 0x80004005
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x10]
mov esi, 0x101f84b0
push eax
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.100e53b3
call fcn.1011c4cf
fstp qword [ebp - 0x20]
mov dword [ebp - 0x18], edi
cmp dword [ebp + 0x1c], edi
mov byte [ebp - 4], 1
je 0x100a8ee2
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.100e5889
mov esi, dword [ebp + 0x10]
cmp esi, 1
jne 0x100a8f2c
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
movzx esi, ax
mov ebx, 0x8000
push 0x11
and esi, ebx
call edi
movzx ecx, ax
fld qword [0x101a3db0]
fcomp qword [ebp - 0x20]
and ecx, ebx
fnstsw ax
test ah, 0x41
jp 0x100a8f21
test ecx, ecx
je 0x100a8f21
push 3
xor edi, edi
jmp 0x100a8f47
neg esi
sbb esi, esi
and esi, 2
xor edi, edi
jmp 0x100a8f48
cmp esi, 4
jne 0x100a8f48
fld qword [0x101a3db0]
fcomp qword [ebp - 0x20]
fnstsw ax
test ah, 0x41
jp 0x100a8f45
push 3
jmp 0x100a8f47
push 2
pop esi
cmp dword [ebp - 0x10], edi
je 0x100a8f62
cmp esi, 3
jne 0x100a8f65
fld qword [0x101a3db0]
fcomp qword [ebp - 0x20]
fnstsw ax
test ah, 0x41
jne 0x100a8fb4
push 2
pop esi
cmp esi, edi
jne 0x100a8faf
mov esi, dword [ebp - 0x18]
cmp esi, edi
je 0x100a8f97
push dword [ebp + 8]
lea ecx, [ebp + 0x1c]
call fcn.10005f82
mov eax, dword [eax]
mov ecx, dword [esi]
push 1
push eax
push esi
mov byte [ebp - 4], 2
call dword [ecx + 0x24]
push dword [ebp + 0x1c]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 0xc], edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp - 0x10]
je 0x100a9004
call fcn.10118b48
jmp 0x100a9009
cmp esi, 3
jne 0x100a9011
mov esi, dword [ebp - 0x18]
cmp esi, edi
je 0x100a8fe1
push dword [ebp + 8]
lea ecx, [ebp + 0x1c]
call fcn.10005f82
mov eax, dword [eax]
mov ecx, dword [esi]
push edi
push eax
push esi
mov byte [ebp - 4], 3
call dword [ecx + 0x24]
push dword [ebp + 0x1c]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [ebp + 0xc], edi
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
je 0x100a8ff8
or eax, 1
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
jmp 0x100a8fa8
or eax, 0x800
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.10117e07
add esp, 0x10
mov dword [ebp - 0x14], eax
jmp 0x100a908a
cmp esi, 2
jne 0x100a908a
mov esi, dword [ebp - 0x18]
cmp esi, edi
je 0x100a9043
push dword [ebp + 8]
lea ecx, [ebp + 0x10]
call fcn.10005f82
mov eax, dword [eax]
mov ecx, dword [esi]
push edi
push eax
push esi
mov byte [ebp - 4], 4
call dword [ecx + 0x24]
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp + 0x1c]
push eax
call fcn.101173de
pop ecx
cmp dword [ebp + 0x1c], edi
mov byte [ebp - 4], 5
je 0x100a9079
cmp dword [ebp + 0xc], edi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 8]
push dword [ebp + 0x1c]
je 0x100a906e
call fcn.10118b48
jmp 0x100a9073
call fcn.10117e07
mov dword [ebp - 0x14], eax
add esp, 0x10
mov eax, dword [ebp + 0x1c]
cmp eax, edi
mov byte [ebp - 4], 1
je 0x100a908a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x18]
cmp eax, edi
mov byte [ebp - 4], 0
je 0x100a909b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x100a90ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
call fcn.10145e58
ret 0x18