Function at 0x1001fc70
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x101205b3], 0
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x1001fccd
mov eax, dword [0x1011e220]
mov ecx, dword [0x101205ac]
dec eax
cmp eax, 3
ja case.default.0x1001fc9e
jmp dword [eax*4 + 0x1001fed4]
push ecx
call esi
test ax, ax
setne al
jmp 0x1001fcc9
push ecx
call edi
test ax, ax
setne al
jmp 0x1001fcc9
push ecx
call esi
test ax, ax
sete al
jmp 0x1001fcc9
mov al, byte [ebp - 1]
test al, al
jne case.0x1001fc9e.1
call fcn.1001a890
mov byte [eax + 0x19], 0
cmp byte [0x101205b8], 0
je 0x1001fd1f
mov eax, dword [0x1011e224]
mov ecx, dword [0x1012058c]
dec eax
cmp eax, 3
ja case.default.0x1001fcf0
jmp dword [eax*4 + 0x1001fee4]
push ecx
call esi
test ax, ax
setne al
jmp 0x1001fd1b
push ecx
call edi
test ax, ax
setne al
jmp 0x1001fd1b
push ecx
call esi
test ax, ax
sete al
jmp 0x1001fd1b
mov al, byte [ebp - 1]
test al, al
jne case.0x1001fcf0.1
call fcn.1001a890
mov byte [eax + 0x1b], 0
cmp byte [0x101205b2], 0
je 0x1001fd3e
push dword [0x101205b4]
call esi
test ax, ax
jne 0x1001fd47
call fcn.1001a890
mov byte [eax + 0x18], 0
cmp byte [0x10120585], 0
je 0x1001fd90
mov eax, dword [0x1011e210]
mov ecx, dword [0x10120598]
dec eax
cmp eax, 3
ja case.default.0x1001fd61
jmp dword [eax*4 + 0x1001fef4]
push ecx
call esi
test ax, ax
setne al
jmp 0x1001fd8c
push ecx
call edi
test ax, ax
setne al
jmp 0x1001fd8c
push ecx
call esi
test ax, ax
sete al
jmp 0x1001fd8c
mov al, byte [ebp - 1]
test al, al
jne case.0x1001fd61.1
call fcn.1001a890
mov byte [eax + 0x1a], 0
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001fe05
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001fe05
mov edi, dword [0x10120420]
test edi, edi
je 0x1001fe05
mov eax, dword [0x10120334]
test eax, eax
jne 0x1001fdff
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x10120334], eax
cmp dword [eax + edi], 0
jg 0x1001fe29
call fcn.1001a890
mov byte [eax + 0x18], 0
call fcn.1001a890
mov byte [eax + 0x19], 0
call fcn.1001a890
mov byte [eax + 0x1a], 0
call fcn.1001a890
mov byte [eax + 0x1b], 0
call fcn.1000f8e0
cmp eax, 9
je 0x1001fe3d
call fcn.1000f8e0
cmp eax, 8
jne 0x1001fe61
call fcn.1001a890
mov byte [eax + 0x18], 0
call fcn.1001a890
mov byte [eax + 0x19], 0
call fcn.1001a890
mov byte [eax + 0x1a], 0
call fcn.1001a890
mov byte [eax + 0x1b], 0
mov eax, dword [0x101202e0]
mov edi, dword [0x10120420]
test eax, eax
jne 0x1001fea1
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101202e0], eax
test byte [eax + edi], 1
je 0x1001fecb
call fcn.1001a890
mov byte [eax + 0x18], 0
call fcn.1001a890
mov byte [eax + 0x19], 0
call fcn.1001a890
mov byte [eax + 0x1a], 0
call fcn.1001a890
mov byte [eax + 0x1b], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret