Function at 0x100948f
Capabilities:
Log keystrokes via polling

Disassembly:
mov dword [ebp - 0x54], 0x1038840
jmp 0x1006f9a
test dx, dx
je 0x1005421
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10070b8
add eax, 4
add ecx, 4
test dx, dx
jne 0x10070ac
xor eax, eax
jmp 0x10070bd
mov eax, dword [ebp - 0x58]
jmp 0x100705f
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x4c], 0xffffffff
or dword [ebp - 0x60], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 0x18]
xor edi, edi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x64], edi
call fcn.0100511c
cmp byte [section..data], 0
mov byte [ebp - 0x45], al
jne 0x100dd2c
cmp esi, edi
je 0x10053f3
cmp word [esi], di
je 0x10053f3
cmp word [ebp + 0x12], di
jne 0x1006fb4
mov ax, word [0x1038074]
mov word [ebp + 0x10], ax
mov ax, word [0x1038076]
mov word [ebp + 0x12], ax
mov esi, dword [ebp - 0x54]
push esi
call fcn.01006e99
test eax, eax
jne 0x100dda8
mov dword [ebp - 0x6c], esi
mov ebx, dword [sym.imp.GDI32.dll_SetFontEnumeration]
and dword [ebp - 0x58], 0
cmp dword [0x1038078], 0
jbe 0x100701c
mov esi, dword [0x1038080]
add esi, 4
mov eax, dword [ebp + 8]
test eax, eax
jne 0x100947f
mov ax, word [esi + 6]
cmp ax, word [ebp + 0x12]
je 0x1007083
push dword [ebp + 0x10]
push dword [esi]
call fcn.01006f2e
test eax, eax
jne 0x1007083
inc dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
add esi, 0x18
cmp eax, dword [0x1038078]
jb 0x1006fe4
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x1007052
xor edi, edi
push edi
call ebx
mov esi, eax
and eax, 0xfffffffe
push eax
call ebx
cmp word [ebp + 0x12], di
jl 0x100dddf
push dword [ebp + 0x12]
push dword [ebp - 0x54]
push edi
call fcn.010083ca
push esi
mov edi, eax
call ebx
test edi, edi
jne 0x100dded
mov eax, dword [ebp - 0x60]
xor ecx, ecx
cmp eax, ecx
jl 0x100ddf9
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x54]
cmp word [eax], 0
pop edi
pop esi
pop ebx
je 0x100de84
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
xor ecx, ebp
call fcn.010015a8
leave
ret 0x14
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x100948d
mov al, byte [esi + 0x10]
and al, 4
mov byte [ebp - 0x4d], al
jne 0x10070a4
mov al, byte [ebp - 0x45]
cmp byte [esi + 0x11], al
jne 0x100700b
mov edi, dword [esi + 0xc]
mov ecx, dword [ebp - 0x54]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x10053ff
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1005428
mov ecx, dword [ebp - 0x6c]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
je 0x100ddb6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1005428
cmp byte [ebp - 0x4d], 4
je 0x100700b
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
jmp 0x100700b
cmp al, byte [esi + 0x10]
je 0x1006fef
jmp 0x100700b
cmp eax, dword [esi + 8]
je 0x100708e
jmp 0x100700b
cmp al, 0x80
je 0x1006f89
cmp al, 0x81
je 0x1006f89
cmp al, 0x88
je 0x1006f89
xor ecx, ecx
cmp al, 0x86
sete cl
mov eax, ecx
cmp eax, edi
jne 0x1006f89
cmp esi, edi
je 0x100dd5e
cmp word [esi], di
jne 0x100dd8d
mov ecx, dword [0x1038080]
push 0x20
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x59]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [0x1038070]
imul eax, eax, 0x18
push dword [eax + ecx + 4]
push dword [ebp + 0x18]
call fcn.01024998
cmp word [ebp + 0x12], di
jne 0x1006fb4
mov ax, word [ebp - 0x68]
mov word [ebp + 0x10], ax
mov ax, word [ebp - 0x66]
jmp 0x1006fb0
push esi
call fcn.0102427f
mov dword [ebp - 0x6c], eax
jmp 0x1006fc8
test dx, dx
je 0x100ddd8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10070d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x10070ca
xor eax, eax
jmp 0x10070db
mov eax, dword [ebp + 0x12]
neg eax
mov word [ebp + 0x12], ax
jmp 0x1007039
mov dword [ebp - 0x4c], 0xfffffffe
jmp 0x1006fce
mov dl, byte [section..data]
cmp dword [0x1038078], ecx
jbe 0x100de59
mov eax, dword [0x1038080]
add eax, 0x14
test dl, dl
je 0x100de2d
cmp dword [ebp + 8], 0
je 0x100de20
mov bl, byte [ebp + 8]
cmp bl, byte [eax]
jne 0x100de48
test byte [eax], 4
jne 0x100de34
mov bl, byte [ebp - 0x45]
cmp byte [eax + 1], bl
jmp 0x100de32
mov bl, byte [ebp + 8]
cmp bl, byte [eax]
jne 0x100de48
mov si, word [ebp + 0x12]
cmp word [eax - 0xe], si
jl 0x100de48
mov si, word [eax - 0x10]
cmp si, word [ebp + 0x10]
jge 0x100de56
inc ecx
add eax, 0x18
cmp ecx, dword [0x1038078]
jae 0x100de59
jmp 0x100de0f
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], 0
jge 0x1007062
test dl, dl
je 0x100de7a
push dword [ebp + 0x18]
call fcn.0100514a
test eax, eax
mov eax, dword [ebp - 0x64]
je 0x100705f
mov eax, dword [0x1038070]
jmp 0x100705f
mov ecx, dword [ebp - 0x4c]
mov edx, dword [0x1038080]
imul ecx, ecx, 0x18
push dword [ecx + edx + 0x10]
push 0x20
push eax
call fcn.010058fe
jmp 0x1007072