Function at 0x1001b6d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x10089040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1008b698], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1001ba3b
push dword [0x1008b66c]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
test ax, ax
jne 0x1001b721
mov word [0x1008abb8], ax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 8
cmp byte [0x1008abb8], 0
jne 0x1001b9a0
cmp byte [0x1008b698], 0
je 0x1001b760
push dword [0x1008b66c]
call esi
test ax, ax
je 0x1001b751
cmp byte [0x1008abb8], 0
je 0x1001b751
push 0
jmp 0x1001b753
push 1
mov ecx, dword [0x100c13d4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
mov byte [0x1008abb9], 0
xor edi, edi
nop dword [eax]
cmp edi, 1
jne 0x1001b789
mov byte [0x1008abb9], 1
mov eax, dword [ebx + 4]
push dword [eax]
push ecx
call fcn.1001bd50
jmp 0x1001b7e9
test edi, edi
jne 0x1001b7e9
mov eax, dword [0x1008abd0]
mov dword [ebp - 0x10c], eax
mov eax, dword [0x1008b878]
mov dword [ebp - 0x110], eax
mov eax, dword [0x100c1354]
test eax, eax
jne 0x1001b7da
mov edx, 0xe80c2f78
mov ecx, 0x10079bb9
call fcn.1000b060
mov edx, 0xc10bf213
mov ecx, 0x10077f85
mov esi, eax
call fcn.1000b060
mov edx, esi
mov ecx, eax
call fcn.1006eeb0
mov dword [0x100c1354], eax
mov edx, dword [ebp - 0x110]
mov ecx, dword [ebp - 0x10c]
mov dword [eax + edx], ecx
mov esi, 1
nop
cmp edi, 1
jne 0x1001b85a
mov eax, dword [ebx + 4]
push dword [eax]
call fcn.1001c110
mov ecx, dword [0x100c1358]
push dword [0x1008b878]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [0x100c135c]
push 0
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x100c1180]
movss xmm0, dword [0x100c1f04]
movss dword [eax + 0x10], xmm0
mov eax, dword [0x100c1180]
movss xmm0, dword [0x100c1f08]
movss dword [eax + 0x14], xmm0
mov eax, dword [0x100c1180]
mov ecx, dword [0x100c1f0c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [0x100c1358]
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, dword [ebx]
test byte [ecx + 0xf0], 1
jne 0x1001b982
movss xmm0, dword [ecx + 0xfc]
xorps xmm1, xmm1
comiss xmm0, xmm1
ja 0x1001b982
mov eax, dword [ebx + 4]
push dword [eax]
push ecx
call fcn.1001ba50
cmp byte [0x1008abb8], 0
je 0x1001b8af
push dword [0x1008b66c]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1001b8af
cmp byte [0x100c13dc], 0
je 0x1001b8af
push 0
jmp 0x1001b8b1
push 1
mov ecx, dword [0x100c13d4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x2c]
call eax
cmp byte [0x1008abb8], 0
jne 0x1001b951
cmp byte [0x1008abc8], 0
jne 0x1001b948
test edi, edi
jne 0x1001b93c
mov eax, dword [ebx + 4]
push dword [eax]
call fcn.1001c110
mov ecx, dword [0x100c1358]
push dword [0x1008b878]
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, dword [0x100c135c]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x100c1180]
movss xmm0, dword [0x100c1f04]
movss dword [eax + 0x10], xmm0
mov eax, dword [0x100c1180]
movss xmm0, dword [0x100c1f08]
movss dword [eax + 0x14], xmm0
mov eax, dword [0x100c1180]
mov ecx, dword [0x100c1f0c]
mov dword [eax + 0x1c], ecx
mov ecx, dword [0x100c1358]
mov eax, dword [ecx]
call dword [eax + 8]
inc esi
cmp esi, 0x20
jle 0x1001b7f0
jmp 0x1001b977
mov byte [0x1008abc8], 0
jmp 0x1001b989
mov eax, dword [0x100c1180]
mov dword [0x1008abbc], esi
mov eax, dword [eax + 0x1c]
mov dword [0x1008abc0], eax
mov eax, dword [ebx + 4]
mov eax, dword [eax]
movsx eax, word [eax + 0x44]
cdq
xor eax, edx
sub eax, edx
mov dword [0x1008abc4], eax
cmp byte [0x1008abb8], 0
jne 0x1001b9a0
jmp 0x1001b989
mov byte [0x1008abb8], 0
inc edi
cmp edi, 2
jl 0x1001b770
cmp byte [0x1008abb8], 0
je 0x1001ba3b
mov eax, dword [0x100c1180]
mov ecx, dword [0x1008abbc]
add ecx, dword [0x1008abc0]
cmp dword [eax + 0x1c], ecx
jge 0x1001b9f3
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax + 0x24], 0
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [eax + 0x28], 0
cmp byte [0x1008abb9], 0
je 0x1001ba3b
mov eax, dword [ebx + 4]
mov eax, dword [eax]
or dword [eax + 0x30], 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100714c0
mov esp, ebp
pop ebp
ret 8
call fcn.1001bfc0
mov ecx, dword [0x100c13e0]
mov esi, eax
inc ecx
lea eax, [ebp - 0x108]
push ecx
push 0x1007e3f0
push eax
mov dword [0x100c13e0], ecx
call fcn.1001c0c0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0
push 0
push esi
call fcn.1001ad00
mov eax, dword [ebx]
add esp, 0x10
mov byte [eax], 0
mov eax, dword [ebx]
mov byte [eax + 1], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100714c0
mov esp, ebp
pop ebp
ret 8