Function at 0x100a4f80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [0x10253210]
test edi, edi
je 0x100a52c7
mov ecx, edi
call fcn.10078d00
test al, al
jne 0x100a52c7
cmp byte [0x1031d7d8], al
je 0x100a52c7
mov eax, dword fs:[0x2c]
mov ecx, dword [0x10255374]
push ebx
push esi
mov esi, dword [eax + ecx*4]
mov eax, dword [0x1031e93c]
cmp eax, dword [esi + 4]
jle 0x100a5002
push 0x1031e93c
call fcn.101987e8
add esp, 4
cmp dword [0x1031e93c], 0xffffffff
jne 0x100a5002
push 0x1031e93c
mov dword [0x1031e934], 0
mov dword [0x1031e930], 0x1031d748
call fcn.10198797
add esp, 4
cmp byte [0x102556c9], 0
jne 0x100a5021
cmp byte [0x102556cb], 0
jne 0x100a5021
cmp byte [0x102556c8], 0
jne 0x100a5021
xor bl, bl
jmp 0x100a5023
mov bl, 1
mov eax, dword [0x1031e930]
mov eax, dword [eax]
test eax, eax
jne 0x100a5035
mov dword [0x1031e934], eax
jmp 0x100a504b
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
movzx eax, al
mov dword [0x1031e934], eax
jne 0x100a5058
cmp byte [0x10316908], 0
jne 0x100a5058
xor cl, cl
jmp 0x100a505a
mov cl, 1
cmp dword [0x1031d5f0], 2
je 0x100a5073
mov eax, dword [0x102556cc]
cmp eax, dword [0x1031d560]
setl al
jmp 0x100a507d
cmp dword [0x102556cc], 0
sete al
test bl, bl
jne 0x100a5089
test al, al
je 0x100a5089
test cl, cl
jne 0x100a5096
cmp byte [0x102556ca], 0
jne 0x100a5096
xor al, al
jmp 0x100a5098
mov al, 1
mov byte [0x102556ca], al
mov eax, dword [0x1031e940]
cmp eax, dword [esi + 4]
jle 0x100a50e1
push 0x1031e940
call fcn.101987e8
add esp, 4
cmp dword [0x1031e940], 0xffffffff
jne 0x100a50e1
push 0x1031e940
mov dword [0x1031e954], 0
mov dword [0x1031e950], 0x1031d41c
call fcn.10198797
add esp, 4
cmp byte [0x102556ca], 0
jne 0x100a5128
cmp byte [0x102556cb], 0
jne 0x100a5128
cmp byte [0x102556c8], 0
jne 0x100a5128
mov eax, dword [0x1031e950]
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov eax, dword [eax]
test eax, eax
jne 0x100a5114
mov dword [0x1031e954], eax
jmp 0x100a512e
push eax
call ebx
shr eax, 0xf
and al, 1
movzx eax, al
mov dword [0x1031e954], eax
jne 0x100a5140
jmp 0x100a512e
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp byte [0x102556c9], 0
je 0x100a514d
cmp dword [0x1031d5f0], 2
je 0x100a514d
cmp dword [0x102556cc], 0
je 0x100a514d
mov al, 1
jmp 0x100a514f
xor al, al
mov byte [0x102556c9], al
mov eax, dword [0x1031e94c]
cmp eax, dword [esi + 4]
jle 0x100a5198
push 0x1031e94c
call fcn.101987e8
add esp, 4
cmp dword [0x1031e94c], 0xffffffff
jne 0x100a5198
push 0x1031e94c
mov dword [0x1031e948], 0
mov dword [0x1031e944], 0x1031d3b0
call fcn.10198797
add esp, 4
cmp byte [0x102556c9], 0
jne 0x100a5289
cmp byte [0x102556ca], 0
jne 0x100a5289
cmp byte [0x102556c8], 0
jne 0x100a5289
cmp dword [0x1031690c], 0
je 0x100a51d5
cmp byte [0x1031d614], 0
jne 0x100a5289
cmp byte [0x10316750], 0
jne 0x100a5289
mov esi, dword [ebp + 8]
test esi, esi
je 0x100a5289
cmp dword [0x10316764], 0
je 0x100a5289
mov eax, dword [0x1031d4ac]
sub eax, 0
je 0x100a5234
sub eax, 2
je 0x100a520e
sub eax, 1
jmp 0x100a5256
mov eax, dword [0x1031e944]
mov eax, dword [eax]
test eax, eax
jne 0x100a5220
mov dword [0x1031e948], eax
jmp 0x100a5258
push eax
call ebx
shr eax, 0xf
and al, 1
movzx eax, al
mov dword [0x1031e948], eax
jne 0x100a5289
jmp 0x100a5258
mov eax, dword [0x1031e944]
mov eax, dword [eax]
test eax, eax
jne 0x100a5246
mov dword [0x1031e948], eax
jmp 0x100a5289
push eax
call ebx
shr eax, 0xf
and al, 1
movzx eax, al
mov dword [0x1031e948], eax
je 0x100a5289
cmp byte [0x10316760], 0
jne 0x100a5270
cmp dword [0x1031686c], 3
jne 0x100a5289
test byte [esi + 0x24], 1
je 0x100a5289
cmp byte [0x1031d76c], 0
je 0x100a5282
mov ecx, edi
call fcn.10079030
jmp 0x100a5284
mov al, 1
mov byte [0x102556cb], al
mov al, byte [0x1031d7b4]
mov byte [0x102556c8], al
pop esi
pop ebx
test al, al
je 0x100a52a9
mov word [0x102556c9], 0
mov byte [0x102556cb], 0
mov al, byte [0x102556cb]
mov byte [0x10316750], al
mov al, byte [0x102556c9]
mov byte [0x10316910], al
mov al, byte [0x102556ca]
mov byte [0x10316909], al
pop edi
pop ebp
ret 4