Function at 0x10070ba0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x100b7e50]
mov eax, dword [eax + 0x1c]
cmp eax, 1
jne 0x10070bbd
cmp ecx, 0x201
je 0x10070c19
cmp ecx, 0x203
jmp 0x10070c13
cmp eax, 2
jne 0x10070bd2
cmp ecx, 0x204
je 0x10070c19
cmp ecx, 0x206
jmp 0x10070c13
cmp eax, 4
jne 0x10070be7
cmp ecx, 0x207
je 0x10070c19
cmp ecx, 0x209
jmp 0x10070c13
cmp eax, 5
jne 0x10070bf4
shr edx, 0x10
cmp edx, 1
jmp 0x10070bff
cmp eax, 6
jne 0x10070c2b
shr edx, 0x10
cmp edx, 2
jne 0x10070ecd
cmp ecx, 0x20b
je 0x10070c19
cmp ecx, 0x20d
jne 0x10070ecd
mov al, byte [0x100b774f]
test al, al
mov ecx, 0x100b774f
sete al
xchg byte [ecx], al
ret
cmp edx, eax
jne 0x10070c50
cmp ecx, 0x100
je 0x10070c3f
cmp ecx, 0x104
jne 0x10070c50
mov al, byte [0x100b774f]
test al, al
mov ecx, 0x100b774f
sete al
xchg byte [ecx], al
mov eax, dword [0x100b7748]
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [eax + 4]
cmp byte [eax], 0
je 0x10070cb3
mov eax, dword [0x100b7e50]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x34]
cmp eax, str.Hold
je 0x10070c84
cmp eax, str.Toggle
je 0x10070c95
cmp eax, str.Always
je 0x10070c8c
push ecx
call esi
test ax, ax
je 0x10070cac
mov byte [0x100b7ed6], 1
jmp 0x10070cb3
push ecx
call esi
test al, 1
je 0x10070cb3
cmp byte [0x100b7ed6], 0
sete byte [0x100b7ed6]
jmp 0x10070cb3
mov byte [0x100b7ed6], 0
mov eax, dword [0x100b7748]
mov eax, dword [eax]
cmp byte [eax + 0xa], 0
je 0x10070d0e
mov eax, dword [0x100b7e50]
mov ecx, dword [eax]
mov eax, dword [eax + 0x24]
cmp eax, str.Hold
je 0x10070cdf
cmp eax, str.Toggle
je 0x10070cf0
cmp eax, str.Always
je 0x10070ce7
push ecx
call esi
test ax, ax
je 0x10070d07
mov byte [0x100b7ed5], 1
jmp 0x10070d0e
push ecx
call esi
test al, 1
je 0x10070d0e
cmp byte [0x100b7ed5], 0
sete byte [0x100b7ed5]
jmp 0x10070d0e
mov byte [0x100b7ed5], 0
mov eax, dword [0x100b7748]
mov eax, dword [eax]
cmp byte [eax + 5], 0
je 0x10070d70
cmp byte [eax + 9], 0
je 0x10070d70
mov eax, dword [0x100b7e50]
mov ecx, dword [eax + 4]
mov eax, dword [eax + 0x28]
cmp eax, str.Hold
je 0x10070d41
cmp eax, str.Toggle
je 0x10070d52
cmp eax, str.Always
je 0x10070d49
push ecx
call esi
test ax, ax
je 0x10070d69
mov byte [0x100b7ed4], 1
jmp 0x10070d70
push ecx
call esi
test al, 1
je 0x10070d70
cmp byte [0x100b7ed4], 0
sete byte [0x100b7ed4]
jmp 0x10070d70
mov byte [0x100b7ed4], 0
mov eax, dword [0x100b7e50]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax + 0x38]
cmp eax, str.Hold
je 0x10070d90
cmp eax, str.Toggle
je 0x10070da1
cmp eax, str.Always
je 0x10070d98
push ecx
call esi
test ax, ax
je 0x10070db8
mov byte [0x100b7efd], 1
jmp 0x10070dbf
push ecx
call esi
test al, 1
je 0x10070dbf
cmp byte [0x100b7efd], 0
sete byte [0x100b7efd]
jmp 0x10070dbf
mov byte [0x100b7efd], 0
mov eax, dword [0x100b7740]
cmp byte [eax], 0
je 0x10070e18
mov eax, dword [0x100b7e50]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0x30]
cmp eax, str.Hold
je 0x10070de9
cmp eax, str.Toggle
je 0x10070dfa
cmp eax, str.Always
je 0x10070df1
push ecx
call esi
test ax, ax
je 0x10070e11
mov byte [0x100b7ed7], 1
jmp 0x10070e18
push ecx
call esi
test al, 1
je 0x10070e18
cmp byte [0x100b7ed7], 0
sete byte [0x100b7ed7]
jmp 0x10070e18
mov byte [0x100b7ed7], 0
mov eax, dword [0x100b7740]
cmp byte [eax + 4], 0
je 0x10070e72
mov eax, dword [0x100b7e50]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0x3c]
cmp eax, str.Hold
je 0x10070e43
cmp eax, str.Toggle
je 0x10070e54
cmp eax, str.Always
je 0x10070e4b
push ecx
call esi
test ax, ax
je 0x10070e6b
mov byte [0x100b7efe], 1
jmp 0x10070e72
push ecx
call esi
test al, 1
je 0x10070e72
cmp byte [0x100b7efe], 0
sete byte [0x100b7efe]
jmp 0x10070e72
mov byte [0x100b7efe], 0
mov eax, dword [0x100b7740]
cmp byte [eax + 8], 0
je 0x10070ecc
mov eax, dword [0x100b7e50]
mov ecx, dword [eax + 0x18]
mov eax, dword [eax + 0x40]
cmp eax, str.Hold
je 0x10070e9d
cmp eax, str.Toggle
je 0x10070eae
cmp eax, str.Always
je 0x10070ea5
push ecx
call esi
test ax, ax
je 0x10070ec5
mov byte [0x100b7ea3], 1
pop esi
ret
push ecx
call esi
test al, 1
je 0x10070ecc
cmp byte [0x100b7ea3], 0
pop esi
sete byte [0x100b7ea3]
ret
mov byte [0x100b7ea3], 0
pop esi
ret