Function at 0x10069200
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x101e2520]
push esi
mov esi, ecx
cmp byte [eax], 0
je 0x10069265
cmp byte [esi + 6], 0
mov byte [esi + 4], 0
mov byte [esi + 0xb], 0
jne 0x1006923d
mov eax, dword [esi + 0x14]
dec eax
mov byte [esi + 0xa], 1
cmp dword [esi + 0x2c], eax
jl 0x10069239
cmp byte [esi + 0xf], 0
jne 0x10069232
mov byte [esi + 0xf], 1
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
mov byte [esi + 6], 1
mov byte [esi + 8], 0
mov word [esi + 0xc], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
pop esi
ret
mov eax, dword [0x101dfeb4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
inc eax
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp eax, 3
ja case.0x100692b4.0
jmp dword [eax*4 + 0x100694a8]
push dword [0x101dfeb0]
call edi
jmp 0x1006929b
push dword [0x101dfeb0]
call ebx
test ax, ax
setne al
test al, al
je case.0x100692b4.0
mov eax, dword [0x101dfe94]
inc eax
cmp eax, 3
ja case.default.0x100692b4
jmp dword [eax*4 + 0x100694b8]
push dword [0x101dfe90]
call edi
jmp 0x100692cd
push dword [0x101dfe90]
call ebx
test ax, ax
setne al
test al, al
jne case.0x100692b4.0
cmp byte [esi + 9], 0
mov byte [esi + 4], 1
mov byte [esi + 6], 0
mov byte [esi + 0xb], 0
je case.0x10069433.0
mov edi, dword [0x101e094c]
mov ecx, edi
mov eax, dword [edi]
mov eax, dword [eax + 0x6f8]
call eax
mov ebx, eax
test ebx, ebx
je 0x1006937f
mov edx, dword [0x101e14f0]
mov eax, dword fs:[0x2c]
mov ecx, dword [0x101e274c]
mov edx, dword [eax + edx*4]
cmp ecx, dword [edx + 4]
jle 0x10069353
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x10069353
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e2750]
cmp word [eax + edi], 0x1f
je case.0x10069433.0
mov eax, dword [ebx + 0xc8]
test eax, eax
je case.0x10069433.0
cmp eax, 7
jl 0x1006937f
cmp eax, 0x10
jle case.0x10069433.0
mov eax, dword [0x101e14f0]
mov ecx, dword fs:[0x2c]
mov edi, dword [0x101e094c]
mov ecx, dword [ecx + eax*4]
mov eax, dword [0x101e274c]
cmp eax, dword [ecx + 4]
jle 0x100693ce
push 0x101e274c
call fcn.100b5535
add esp, 4
cmp dword [0x101e274c], 0xffffffff
jne 0x100693ce
mov eax, dword [0x101e2758]
push 0x101e274c
mov dword [0x101e2750], eax
call fcn.100b54eb
add esp, 4
mov eax, dword [0x101e2750]
cmp word [eax + edi], 0x40
je case.0x10069433.0
mov eax, dword [0x101e2528]
mov edi, dword [esi + 0x18]
cmp byte [eax + 0x64766], 0
jne 0x100693fe
mov ecx, dword [0x101e253c]
call fcn.1007aa00
test al, al
je 0x10069413
mov eax, dword [0x101e07c0]
cmp byte [eax], 0
je 0x10069413
mov dword [esi + 0x24], edi
pop edi
pop ebx
mov byte [esi + 0xb], 1
pop esi
ret
mov eax, dword [0x101e07bc]
pop edi
pop ebx
pop esi
and dword [eax + 0x30], 0xfffffffe
ret
mov byte [esi + 4], 0
mov byte [esi + 0xb], 0
mov eax, dword [0x101dfe94]
inc eax
cmp eax, 3
ja case.default.0x10069433
jmp dword [eax*4 + 0x100694c8]
push dword [0x101dfe90]
call edi
jmp 0x1006944c
push dword [0x101dfe90]
call ebx
test ax, ax
setne al
test al, al
jne case.0x10069433.0
cmp byte [esi + 6], 0
jne case.0x10069433.0
mov eax, dword [esi + 0x14]
dec eax
mov byte [esi + 0xa], 1
cmp dword [esi + 0x2c], eax
jl 0x1006947a
cmp byte [esi + 0xf], 0
jne 0x10069473
mov byte [esi + 0xf], 1
mov byte [esi + 0x1c], 1
mov dword [esi + 0x20], eax
mov byte [esi + 8], 0
mov word [esi + 0xc], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi + 6], 1
pop edi
pop ebx
pop esi
ret