Function at 0x1000a5e0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
cmp byte [0x100c508e], 0
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edi
je 0x1000ae47
push dword [0x100c5090]
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1000ae47
test byte [0x100c540c], 1
mov esi, dword [0x100c4f8c]
jne 0x1000ae47
cmp byte [0x100c1a18], 0
jne 0x1000ae47
mov eax, dword [0x100c1a00]
mov edx, dword [esp + 0x10]
mov ecx, dword [0x100c0e8c]
movss xmm1, dword [edi + 0x28]
mov eax, dword [eax + 0x1c]
movq xmm0, qword [edx]
movss xmm2, dword [edi + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 0x14]
mov dword [esp + 0x40], eax
mov eax, dword [edi + 0x30]
mov dword [esp + 0x18], eax
mov eax, dword fs:[0x2c]
movq qword [esp + 0x44], xmm0
movq xmm0, qword [edi + 0xc]
movq qword [esp + 0x38], xmm0
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x100c5418]
movss dword [esp + 0x1c], xmm1
movss dword [esp + 0x20], xmm2
cmp eax, dword [ecx + 4]
jle 0x1000a6ee
push 0x100c5418
call fcn.1006cd15
add esp, 4
cmp dword [0x100c5418], 0xffffffff
jne 0x1000a6de
mov eax, dword [esp + 0x10]
push 0x100c5418
movq xmm0, qword [eax]
movq qword [0x100c5420], xmm0
mov eax, dword [eax + 8]
mov dword [0x100c5428], eax
call fcn.1006ccc4
add esp, 4
mov edx, dword [esp + 0x10]
movss xmm2, dword [esp + 0x20]
movss xmm1, dword [esp + 0x1c]
cmp byte [0x100c19fc], 0
jne 0x1000a775
movss xmm0, dword [edx]
movss dword [0x100c1d0c], xmm0
movss xmm0, dword [edx + 4]
movss dword [0x100c1d10], xmm0
movss xmm0, dword [edx + 8]
movss dword [0x100c1d14], xmm0
movss dword [0x100bed68], xmm1
movss dword [0x100bed6c], xmm2
mov dword [0x100bed70], 0x7f800000
movss xmm1, dword [edx + 4]
movss xmm2, dword [edx + 8]
movss xmm0, dword [edx]
subss xmm0, dword [0x100c5420]
subss xmm1, dword [0x100c5424]
subss xmm2, dword [0x100c5428]
movss dword [0x100c1d00], xmm0
movss dword [0x100c1d04], xmm1
movss dword [0x100c1d08], xmm2
movss xmm0, dword [edx]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
dec ecx
movss dword [0x100c5420], xmm0
and eax, 4
movss xmm0, dword [edx + 4]
movss dword [0x100c5424], xmm0
movss xmm0, dword [edx + 8]
mov byte [0x100c19fc], 0
movss dword [0x100c5428], xmm0
mov dword [esp + 0xc], 0
mov dword [esp + 0x34], ecx
mov dword [esp + 0x28], eax
nop
mov eax, dword [0x100c53fc]
test eax, eax
je 0x1000a7d7
mov dword [esp + 0xc], eax
mov dword [0x100c53fc], 0
mov eax, dword [0x100c0280]
push ecx
push 0
mov eax, dword [eax]
call eax
cmp dword [esp + 0x28], 0
mov eax, dword [esp + 0xc]
je 0x1000a7fd
cmp eax, 2
mov ecx, 2
cmovl eax, ecx
mov dword [esp + 0xc], eax
movss xmm0, dword [0x100c1d0c]
mov dl, al
mov eax, dword [esp + 0x18]
not dl
movss dword [edi + 0xc], xmm0
and dl, 1
movss xmm0, dword [0x100c1d10]
movss dword [edi + 0x10], xmm0
movss xmm0, dword [0x100c1d14]
movss dword [edi + 0x14], xmm0
mov dword [edi + 0x30], eax
movss xmm0, dword [0x100bed68]
movss dword [edi + 0x28], xmm0
movss xmm0, dword [0x100bed6c]
mov byte [0x100c5414], dl
movss dword [edi + 0x24], xmm0
mov dword [esp + 0x24], 0
nop word [eax + eax]
mov ecx, dword [edi + 0x30]
mov eax, ecx
and eax, 0xfffffffb
or ecx, 4
cmp dword [esp + 0xc], 1
cmovle ecx, eax
mov dword [edi + 0x30], ecx
test dl, dl
je 0x1000a963
movss xmm1, dword [0x100c1d00]
lea edx, [edi + 0xc]
addss xmm1, dword [edx]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0x42b20000
lea eax, [esp + 0x30]
mov dword [esp + 0x2c], 0xc2b20000
movss dword [edx], xmm1
movss xmm0, dword [0x100c1d04]
addss xmm0, dword [edx + 4]
movss dword [edx + 4], xmm0
movss xmm0, dword [0x100c1d08]
addss xmm0, dword [edx + 8]
movss dword [edx + 8], xmm0
movss xmm0, dword [0x100a9da0]
comiss xmm0, xmm1
cmovbe ecx, edx
comiss xmm1, dword [0x100a9cb4]
movss xmm1, dword [0x100a9da8]
cmovbe eax, ecx
lea ecx, [esp + 0x30]
mov eax, dword [eax]
mov dword [edx], eax
lea eax, [edx + 4]
movss xmm0, dword [eax]
comiss xmm1, xmm0
mov dword [esp + 0x2c], 0x43340000
mov dword [esp + 0x30], 0xc3340000
movss xmm1, dword [0x100a9d9c]
cmovbe ecx, eax
lea eax, [esp + 0x2c]
comiss xmm0, dword [0x100a9cd0]
cmovbe eax, ecx
lea ecx, [esp + 0x30]
mov eax, dword [eax]
mov dword [edx + 4], eax
lea eax, [edx + 8]
movss xmm0, dword [eax]
comiss xmm1, xmm0
mov dword [esp + 0x2c], 0x42480000
mov dword [esp + 0x30], 0xc2480000
cmovbe ecx, eax
lea eax, [esp + 0x2c]
comiss xmm0, dword [0x100a9ca8]
cmovbe eax, ecx
mov eax, dword [eax]
mov dword [edx + 8], eax
jmp 0x1000a971
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov ecx, dword [0x100c1bb0]
push edi
call fcn.10023960
mov ecx, dword [0x100c4ea8]
mov eax, dword [0x100c4f8c]
mov edi, dword [0x100c1bb0]
mov edx, dword [ecx]
push dword [eax]
call dword [edx + 0x10]
mov ecx, dword [0x100c4ea4]
push 0
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0xc0]
mov ecx, dword [0x100c196c]
mov dword [eax], 0xffffffff
mov eax, dword [edi]
mov dword [ecx + 0x10], eax
mov eax, dword [edi + 4]
mov dword [ecx + 0x14], eax
mov ecx, dword [esi]
call fcn.10009f80
sub esp, 8
fld dword [eax + 8]
fstp qword [esp]
call fcn.100928c0
fstp dword [esp + 0x34]
fld dword [0x100c53ec]
fstp qword [esp]
call fcn.100928c0
movss xmm0, dword [esp + 0x34]
add esp, 8
fstp dword [esp + 0x30]
fld dword [esp + 0x30]
fstp dword [esp + 0x30]
comiss xmm0, dword [esp + 0x30]
jbe 0x1000aa32
mov ecx, dword [esi]
call fcn.10009e00
test byte [eax], 1
jne 0x1000aa32
movss xmm1, dword [0x100c53ec]
xorps xmm0, xmm0
comiss xmm0, xmm1
jbe 0x1000aa3a
mov ecx, dword [esi]
call fcn.10009f80
xorps xmm0, xmm0
comiss xmm0, dword [eax + 8]
ja 0x1000ab19
movss xmm1, dword [0x100c53ec]
movss xmm0, dword [0x100c5408]
xorps xmm0, xmmword [0x100aa210]
comiss xmm0, xmm1
jbe 0x1000aaa5
fld dword [0x100c5408]
push ecx
fstp dword [esp]
call fcn.100929bd
mov ecx, dword [esi]
add esp, 4
fstp dword [esp + 0x2c]
call fcn.10009f80
push ecx
fld dword [eax + 8]
fstp dword [esp]
call fcn.100929bd
movss xmm0, dword [esp + 0x30]
add esp, 4
xorps xmm0, xmmword [0x100aa210]
fstp dword [esp + 0x30]
movss xmm1, dword [esp + 0x30]
ucomiss xmm1, xmm0
lahf
test ah, 0x44
jp 0x1000aaa5
mov eax, dword [esi]
cmp dword [eax + 0x25c], 9
jne 0x1000ab19
mov ecx, dword [esi]
call fcn.10009f80
cmp byte [0x100c1a18], 0
movss xmm0, dword [eax + 8]
movss dword [0x100c53ec], xmm0
jne 0x1000acd7
mov ecx, dword [esi]
call fcn.10009e00
test byte [eax], 1
jne 0x1000aafa
mov eax, dword [esi]
cmp dword [eax + 0x25c], 9
je 0x1000aafa
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 0x40
jge 0x1000aafa
mov dl, byte [0x100c5414]
mov edi, dword [esp + 0x14]
jmp 0x1000a860
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 4
jge 0x1000ac6b
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
jmp 0x1000a7c0
cmp byte [0x100c5414], 0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x30]
mov dword [0x100c53e4], eax
je 0x1000ac5f
movss xmm0, dword [0x100c1d00]
lea ecx, [esp + 0x34]
addss xmm0, dword [0x100c1d0c]
movss xmm3, dword [0x100a9da0]
lea eax, [esp + 0x30]
mov esi, dword [esp + 0x10]
movss xmm1, dword [0x100c1d04]
addss xmm1, dword [0x100c1d10]
movss xmm2, dword [0x100c1d08]
addss xmm2, dword [0x100c1d14]
comiss xmm3, xmm0
mov dword [esp + 0x30], 0x42b20000
mov dword [esp + 0x34], 0xc2b20000
mov byte [0x100c19fc], 1
movss xmm3, dword [0x100a9da8]
movss dword [esi], xmm0
cmovbe ecx, esi
movss dword [esi + 4], xmm1
comiss xmm0, dword [0x100a9cb4]
movss dword [esi + 8], xmm2
cmovbe eax, ecx
lea ecx, [esp + 0x34]
comiss xmm3, xmm1
movss xmm0, dword [eax]
lea eax, [esi + 4]
movss dword [esi], xmm0
cmovbe ecx, eax
mov dword [esp + 0x30], 0x43340000
comiss xmm1, dword [0x100a9cd0]
lea eax, [esp + 0x30]
mov dword [esp + 0x34], 0xc3340000
movss xmm1, dword [0x100a9d9c]
cmovbe eax, ecx
lea ecx, [esp + 0x34]
comiss xmm1, xmm2
mov eax, dword [eax]
mov dword [esi + 4], eax
lea eax, [esi + 8]
mov dword [esp + 0x30], 0x42480000
mov dword [esp + 0x34], 0xc2480000
cmovbe ecx, eax
lea eax, [esp + 0x30]
comiss xmm2, dword [0x100a9ca8]
cmovbe eax, ecx
mov eax, dword [eax]
mov dword [esi + 8], eax
movss dword [0x100c1d0c], xmm0
movss xmm0, dword [esi + 4]
movss dword [0x100c1d10], xmm0
movss xmm0, dword [esi + 8]
movss dword [0x100c1d14], xmm0
movss xmm0, dword [0x100bed68]
movss dword [edx + 0x28], xmm0
movss xmm0, dword [0x100bed6c]
movss dword [edx + 0x24], xmm0
mov byte [0x100c1a18], 1
jmp 0x1000ae1d
mov edx, dword [esp + 0x14]
movss xmm0, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
movss dword [edx + 0xc], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [edx + 0x10], xmm0
movss xmm0, dword [esp + 0x40]
movss dword [edx + 0x14], xmm0
movss xmm0, dword [esp + 0x44]
movss dword [eax], xmm0
movss xmm0, dword [esp + 0x48]
movss dword [eax + 4], xmm0
movss xmm0, dword [esp + 0x4c]
movss dword [eax + 8], xmm0
movss xmm0, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
movss dword [edx + 0x28], xmm0
movss xmm0, dword [esp + 0x20]
mov dword [edx + 0x30], eax
movss dword [edx + 0x24], xmm0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp byte [0x100c5414], 0
mov edx, dword [esp + 0x14]
mov eax, dword [edx + 0x30]
mov dword [0x100c53e4], eax
je 0x1000ae1d
movss xmm0, dword [0x100c1d00]
lea ecx, [esp + 0x34]
addss xmm0, dword [0x100c1d0c]
movss xmm3, dword [0x100a9da0]
lea eax, [esp + 0x30]
mov esi, dword [esp + 0x10]
movss xmm1, dword [0x100c1d04]
addss xmm1, dword [0x100c1d10]
movss xmm2, dword [0x100c1d08]
addss xmm2, dword [0x100c1d14]
comiss xmm3, xmm0
mov dword [esp + 0x30], 0x42b20000
mov dword [esp + 0x34], 0xc2b20000
mov byte [0x100c19fc], 1
movss xmm3, dword [0x100a9da8]
movss dword [esi], xmm0
cmovbe ecx, esi
movss dword [esi + 4], xmm1
comiss xmm0, dword [0x100a9cb4]
movss dword [esi + 8], xmm2
cmovbe eax, ecx
lea ecx, [esp + 0x34]
comiss xmm3, xmm1
movss xmm0, dword [eax]
lea eax, [esi + 4]
movss dword [esi], xmm0
cmovbe ecx, eax
mov dword [esp + 0x30], 0x43340000
comiss xmm1, dword [0x100a9cd0]
lea eax, [esp + 0x30]
mov dword [esp + 0x34], 0xc3340000
movss xmm1, dword [0x100a9d9c]
cmovbe eax, ecx
lea ecx, [esp + 0x34]
comiss xmm1, xmm2
mov eax, dword [eax]
mov dword [esi + 4], eax
lea eax, [esi + 8]
mov dword [esp + 0x30], 0x42480000
mov dword [esp + 0x34], 0xc2480000
cmovbe ecx, eax
lea eax, [esp + 0x30]
comiss xmm2, dword [0x100a9ca8]
cmovbe eax, ecx
mov eax, dword [eax]
mov dword [esi + 8], eax
movss dword [0x100c1d0c], xmm0
movss xmm0, dword [esi + 4]
movss dword [0x100c1d10], xmm0
movss xmm0, dword [esi + 8]
movss dword [0x100c1d14], xmm0
movss xmm0, dword [0x100bed68]
movss dword [edx + 0x28], xmm0
movss xmm0, dword [0x100bed6c]
movss dword [edx + 0x24], xmm0
movss xmm0, dword [esp + 0x38]
mov eax, dword [esp + 0xc]
movss dword [edx + 0xc], xmm0
movss xmm0, dword [esp + 0x3c]
movss dword [edx + 0x10], xmm0
movss xmm0, dword [esp + 0x40]
movss dword [edx + 0x14], xmm0
mov dword [0x100c53fc], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret