Function at 0x100717d0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x10259d1c]
xor eax, ebp
mov dword [esp + 0x30], eax
call fcn.1004d5c0
mov esi, eax
mov eax, dword [eax + 0x8c]
cmp dword [eax + 0x34], 0
jle 0x10071a1e
cmp dword [eax + 0x14], 0
jne 0x1007180e
cmp dword [eax + 0x18], 0
je 0x10071a1e
lea eax, [esp + 0x18]
push eax
push dword [0x1025f578]
call dword [sym.imp.USER32.dll_GetClientRect]
movq xmm0, qword [esp + 0x18]
movq xmm1, qword [esp + 0x20]
psubd xmm1, xmm0
cvtdq2ps xmm0, xmm1
movlps qword [esi + 8], xmm0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
sub edx, dword [0x1025f570]
mov edi, ecx
sbb edi, dword [0x1025f574]
movd xmm0, edi
movd xmm1, edx
punpckldq xmm1, xmm0
movq qword [esp + 8], xmm1
fild qword [esp + 8]
fstp dword [esp]
movss xmm0, dword [esp]
fild qword [0x1025f568]
fstp dword [esp + 4]
divss xmm0, dword [esp + 4]
movss dword [esi + 0x10], xmm0
mov dword [0x1025f574], ecx
mov dword [0x1025f570], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
movzx eax, ax
shr eax, 0xf
mov byte [esi + 0xf0], al
push 0x10
call edi
movzx eax, ax
shr eax, 0xf
mov byte [esi + 0xf1], al
push 0x12
call edi
movzx eax, ax
shr eax, 0xf
mov byte [esi + 0xf2], al
mov byte [esi + 0xf3], 0
call fcn.1004d5c0
mov edi, eax
cmp byte [eax + 0x34b], 0
je 0x10071914
movsd xmm0, qword [edi + 0xd8]
cvttps2dq xmm0, xmm0
movlps qword [esp + 0x28], xmm0
lea eax, [esp + 0x28]
push eax
push dword [0x1025f578]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [edi + 0xd8], 0xff7fffff
mov dword [edi + 0xdc], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x1025f578]
je 0x10071951
mov eax, 0xffffffff
cmp byte [esi + 0xa4], 0
je 0x10071983
cmp dword [0x10201bb0], eax
jne 0x10071990
jmp 0x10071a0b
lea ebx, [esp + 0x28]
push ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10071936
push ebx
push dword [0x1025f578]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10071936
movsd xmm0, qword [esp + 0x28]
cvtdq2ps xmm0, xmm0
movlps qword [edi + 0xd8], xmm0
jmp 0x10071936
call fcn.10058940
cmp dword [0x10201bb0], eax
je 0x10071a0b
mov dword [0x10201bb0], eax
call fcn.1004d5c0
test byte [eax], 0x20
jne 0x10071a0b
mov esi, eax
call fcn.10058940
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
je 0x10071a04
cmp byte [esi + 0xa4], 0
jne 0x10071a04
dec ecx
cmp ecx, 6
ja case.default.0x100719be
jmp dword [ecx*4 + 0x101af870]
mov eax, 0x7f01
jmp 0x100719fb
mov eax, 0x7f00
jmp 0x100719fb
mov eax, 0x7f86
jmp 0x100719fb
mov eax, 0x7f85
jmp 0x100719fb
mov eax, 0x7f84
jmp 0x100719fb
mov eax, 0x7f83
jmp 0x100719fb
mov eax, 0x7f82
jmp 0x100719fb
mov eax, 0x7f89
push eax
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.10155bf1
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3