Function at 0x10018301
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1019c641
push eax
mov dword fs:[0], esp
cmp byte [0x102a063e], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x1001852a
mov ecx, dword [0x1026622c]
mov eax, dword [0x102a05e8]
cmp ecx, 3
ja case.0x100182fa.0
jmp dword [ecx*4 + 0x1001853c]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10018332
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x10018332
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001852a
mov ebx, dword [0x102a036c]
test ebx, ebx
je 0x1001852a
mov eax, dword [0x102a0368]
test eax, eax
jne 0x1001837f
mov edx, 0xe80c2f78
mov ecx, 0x102113c1
call fcn.10005520
mov edx, 0xc10bf213
mov ecx, 0x102112e9
mov esi, eax
call fcn.10005520
mov edx, esi
mov ecx, eax
call fcn.10133370
mov dword [0x102a0368], eax
cmp dword [eax + ebx], 0
jle 0x1001852a
call fcn.1000c3f0
cmp eax, 9
je 0x1001852a
cmp eax, 8
je 0x1001852a
cmp byte [0x102685b9], 0
je 0x1001852a
mov eax, dword [0x102a05b0]
mov ecx, dword [0x1026a304]
mov esi, dword [eax + 0x1c]
mov eax, dword fs:[0x2c]
dec esi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x102a5fec]
cmp eax, dword [ecx + 4]
jle 0x10018417
push 0x102a5fec
call fcn.1019a606
add esp, 4
cmp dword [0x102a5fec], 0xffffffff
jne 0x10018417
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov dword [ebp - 4], 0
mov ecx, str.client.dll
call fcn.10008920
push 0x102a5fec
mov dword [0x102a5ff0], eax
mov dword [ebp - 4], 0xffffffff
call fcn.1019a5bc
add esp, 4
push esi
push 0
call dword [0x102a5ff0]
cmp byte [0x102685b8], 0
jne 0x100184a5
mov eax, dword [0x102685c0]
cmp eax, dword [edi + 8]
jge 0x1001845a
cmp byte [0x102a05f8], 0
je 0x1001844f
push str.delusional_print_pixelsurfed
push dword [0x102a03e8]
call fcn.1000c3b0
add esp, 8
mov byte [0x102685b8], 1
mov al, 1
jmp 0x1001845c
xor al, al
mov byte [0x102a0678], al
mov eax, dword [0x102685c8]
mov eax, dword [eax + 0x30]
mov dword [edi + 0x30], eax
mov ecx, dword [0x102685c8]
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ecx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ecx + 0x14]
mov dword [edi + 0x14], eax
mov eax, dword [0x102685c8]
mov eax, dword [eax + 0x28]
mov dword [edi + 0x28], eax
mov eax, dword [0x102685c8]
mov eax, dword [eax + 0x24]
mov dword [edi + 0x24], eax
mov eax, dword [0x102685c8]
mov eax, dword [eax + 0x2c]
mov dword [edi + 0x2c], eax
mov ecx, dword [edi + 0x30]
mov eax, ecx
or eax, 4
and ecx, 0xfffffffb
cmp byte [0x102685ba], 0
cmovne ecx, eax
mov dword [edi + 0x30], ecx
cmp byte [0x102685b8], 0
je 0x1001852a
mov eax, dword [0x102a03e4]
mov edi, dword [0x102a036c]
test eax, eax
jne 0x10018503
mov edx, 0xe80c2f78
mov ecx, 0x10211675
call fcn.10005520
mov edx, 0xc10bf213
mov ecx, 0x10211311
mov esi, eax
call fcn.10005520
mov edx, esi
mov ecx, eax
call fcn.10133370
mov dword [0x102a03e4], eax
movss xmm0, dword [eax + edi + 8]
cvtps2pd xmm0, xmm0
ucomisd xmm0, qword [0x10251870]
lahf
test ah, 0x44
jnp 0x1001852a
mov byte [0x102a5f81], 0
mov word [0x102685b8], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret