Function at 0x1001bcf0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x2c
cmp byte [0x10281635], 0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], ecx
je 0x1001c0f7
mov edx, dword [0x102472a8]
mov eax, dword [0x102815e0]
cmp edx, 3
ja case.0x1001bd18.0
jmp dword [edx*4 + 0x1001c100]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1001bd50
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
jmp 0x1001bd50
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001c0f7
mov edi, dword [0x10281360]
test edi, edi
je 0x1001c0f7
mov ebx, edi
test ebx, ebx
je 0x1001c0f7
mov eax, dword [0x1028135c]
test eax, eax
jne 0x1001bdad
mov edx, 0xe80c2f78
mov ecx, 0x10219689
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov edi, dword [0x10281360]
mov dword [0x1028135c], eax
cmp dword [eax + ebx], 0
jle 0x1001c0f7
mov eax, dword [0x102813b4]
test eax, eax
jne 0x1001bdee
mov edx, 0xe80c2f78
mov ecx, 0x102197a5
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x102813b4], eax
test byte [eax + edi], 1
jne 0x1001c0f7
call fcn.1000b770
cmp eax, 9
je 0x1001c0f7
cmp eax, 8
je 0x1001c0f7
mov al, byte [0x102496a5]
test al, al
jne 0x1001c0f7
mov ecx, dword [0x1024b2f0]
mov edx, dword fs:[0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
nop dword [eax]
test al, al
jne 0x1001c0f7
mov eax, dword [0x1028159c]
mov ecx, dword [edx + ecx*4]
mov esi, dword [eax + 0x1c]
mov eax, dword [0x10286fd0]
dec esi
cmp eax, dword [ecx + 4]
jle 0x1001be98
push 0x10286fd0
call fcn.1018b6e4
add esp, 4
cmp dword [0x10286fd0], 0xffffffff
jne 0x1001be98
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov ecx, str.client.dll
call fcn.10007f00
push 0x10286fd0
mov dword [0x10286fd4], eax
call fcn.1018b693
add esp, 4
push esi
push 0
call dword [0x10286fd4]
mov eax, dword [0x102813b4]
mov edi, dword [0x10281360]
mov ebx, edi
test eax, eax
jne 0x1001bee6
mov edx, 0xe80c2f78
mov ecx, 0x102197a5
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov edi, dword [0x10281360]
mov dword [0x102813b4], eax
mov eax, dword [eax + ebx]
mov dword [esp + 0x1c], eax
mov eax, dword [0x102813d8]
test eax, eax
jne 0x1001bf24
mov edx, 0xe80c2f78
mov ecx, 0x10219945
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195d9
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x102813d8], eax
movq xmm0, qword [eax + edi]
xor ebp, ebp
mov eax, dword [eax + edi + 8]
movq qword [esp + 0x2c], xmm0
mov dword [esp + 0x34], eax
movss xmm0, dword [esp + 0x34]
mov byte [esp + 0x13], 0
movss dword [esp + 0x20], xmm0
nop word [eax + eax]
push 0x64
call fcn.1018b313
mov esi, dword [esp + 0x1c]
add esp, 4
mov ecx, eax
push esi
call fcn.10017ee0
cmp dword [esp + 0x14], 0
mov ebx, eax
mov ecx, dword [ebx + 0x30]
jne 0x1001bf77
or ecx, 4
jmp 0x1001bf7a
and ecx, 0xfffffffb
mov dword [ebx + 0x30], ecx
mov ecx, ebx
call fcn.1002a2e0
test byte [esp + 0x1c], 1
jne 0x1001c0d2
mov eax, dword [0x102813d8]
mov edi, dword [0x10281360]
test eax, eax
jne 0x1001bfd0
mov edx, 0xe80c2f78
mov ecx, 0x10219945
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195d9
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov esi, dword [esp + 0x18]
mov dword [0x102813d8], eax
movss xmm0, dword [eax + edi + 8]
movss xmm1, dword [0x10240974]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1001bffa
movss xmm0, dword [esp + 0x20]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jnp 0x1001c0a8
lea edx, [esp + 0x13]
mov ecx, esi
call fcn.10016920
test al, al
jne 0x1001c0a8
mov eax, dword [0x102813b4]
mov edi, dword [0x10281360]
mov ebx, edi
test eax, eax
jne 0x1001c052
mov edx, 0xe80c2f78
mov ecx, 0x102197a5
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195b1
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov edi, dword [0x10281360]
mov dword [0x102813b4], eax
mov eax, dword [eax + ebx]
mov dword [esp + 0x1c], eax
mov eax, dword [0x102813d8]
test eax, eax
jne 0x1001c090
mov edx, 0xe80c2f78
mov ecx, 0x10219945
call fcn.10004f10
mov edx, 0xc10bf213
mov ecx, 0x102195d9
mov esi, eax
call fcn.10004f10
mov edx, esi
mov ecx, eax
call fcn.10127750
mov dword [0x102813d8], eax
movss xmm0, dword [eax + edi + 8]
inc ebp
movss dword [esp + 0x20], xmm0
cmp ebp, 0x10
jl 0x1001bf50
jmp 0x1001c0d2
mov eax, dword [esi + 8]
add eax, ebp
mov dword [0x102496b4], ebx
cmp dword [esp + 0x14], 0
mov dword [0x102496ac], eax
sete byte [0x102496a6]
mov byte [0x102496a5], 1
mov byte [0x10286f5e], 1
call fcn.1002a990
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 2
jge 0x1001c0f7
mov al, byte [0x102496a5]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
jmp 0x1001be40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret