Function at 0x101d9920
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10233f96
mov eax, dword fs:[0]
push eax
sub esp, 0x308
mov eax, dword [0x102d944c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
xor eax, eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x2cc], eax
mov dword [ebp - 0x2c8], eax
imul eax, dword [ecx + 0x64], 0x3ba4
cmp dword [eax + 0x103f6814], 0x18
mov dword [ebp - 0x2e8], ecx
mov dword [ebp - 0x2f4], edi
lea esi, [eax + 0x103f2d70]
jbe 0x101d999f
add dword [esi + 0x3aa4], 0xffffffff
jne 0x101d9996
mov dword [esi + 0x3aa0], 0
cmp dword [esi + 0x3aa4], 0x18
ja 0x101d9983
push edi
push esi
call fcn.101d87f0
cmp dword [0x103f64c8], 0
jne 0x101d99be
push 1
call fcn.101fae5b
add esp, 4
mov dword [0x103f64c8], eax
push dword [ebp - 0x2e8]
call fcn.1018d640
test al, al
jne 0x101d9fb3
push edi
call fcn.101d9620
push 0xd
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], 0
push str.antiUntrusted
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
call fcn.100bd420
lea eax, [ebp - 0x2e4]
mov dword [ebp - 4], 0
push eax
mov ecx, 0x10550908
call fcn.100b9b80
mov al, byte [eax]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x2d0]
mov byte [ebp - 0x2c1], al
cmp ecx, 0x10
jb 0x101d9a6e
mov edx, dword [ebp - 0x2e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x101d9a5e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101d9fd0
push ecx
push edx
call fcn.101fb2ba
mov al, byte [ebp - 0x2c1]
add esp, 8
test al, al
jne 0x101d9aef
mov eax, dword [esi + 0x3b08]
mov ecx, 5
cdq
idiv ecx
mov edi, dword [ebp - 0x2f4]
lea ecx, [ebp - 0x2cc]
mov eax, edx
mov dword [ebp - 0x2ec], 2
shr eax, 0x1f
test al, al
mov dword [ebp - 0x2cc], 0
lea eax, [ebp - 0x2fc]
mov dword [ebp - 0x2fc], edx
cmove ecx, eax
mov dword [ebp - 0x2d8], 0xc2b20000
cmp edx, 2
mov dword [ebp - 0x2d4], 0
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2d0], 0x42b20000
cmovle eax, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x2d8]
mov dword [edi + 0x39d8], eax
mov eax, dword [edi + 0x3a40]
cmp eax, 1
jne 0x101d9bad
movss xmm0, dword [edi + 0x3a58]
lea ecx, [esi + 0x3a94]
mov eax, dword [edi + 0x39fc]
addss xmm0, dword [0x102c1340]
mov dword [edi + 0x39dc], eax
mov byte [edi + 0x3a60], 0
mov dword [esi + 0x3b58], 0
mov dword [esi + 0x3b5c], 0
movss dword [esi + 0x3b0c], xmm0
mov dword [esi + 0x3b60], 0
call fcn.100bb4a0
mov dword [esi + 0x3aa8], 0x7f7fffff
mov dword [esi + 0x3aac], 0x7fffffff
mov byte [esi + 0x3ab0], 0
mov eax, dword [edi + 0x3954]
push 4
push str.MOVE
mov eax, dword [eax + 0x64]
lea eax, [eax + eax*2]
lea ecx, [eax*8 + 0x103f3ea8]
call fcn.100c26e0
push 0x3a80
lea eax, [esi + 0x14]
mov dword [edi + 0x3a44], 0x102c0f44
push edi
push eax
call fcn.101febb0
add esp, 0xc
jmp 0x101d9e63
cmp eax, 2
jne 0x101d9c22
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], 0
push str.override_key
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
call fcn.100bd420
mov eax, 1
mov dword [ebp - 4], 1
mov dword [ebp - 0x2c8], eax
mov ecx, 0x10550928
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.100b9b60
push dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
mov byte [ebp - 0x2c1], 1
test eax, eax
je 0x101d9c29
mov byte [ebp - 0x2c1], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2c8]
test al, 1
je 0x101d9c7d
mov ecx, dword [ebp - 0x2d0]
and eax, 0xfffffffe
mov dword [ebp - 0x2c8], eax
cmp ecx, 0x10
jb 0x101d9c7d
mov edx, dword [ebp - 0x2e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x101d9c73
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101d9fd5
push ecx
push edx
call fcn.101fb2ba
add esp, 8
cmp byte [ebp - 0x2c1], 0
je 0x101d9c97
push edi
push esi
mov ecx, 0x103f3b88
call fcn.101dac80
jmp 0x101d9e63
cmp dword [edi + 0x3a40], 8
jne 0x101d9d7a
push 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x304], 0
push str.override_key
lea ecx, [ebp - 0x314]
mov dword [ebp - 0x300], 0
movups xmmword [ebp - 0x314], xmm0
call fcn.100bd420
mov dword [ebp - 4], 2
mov ecx, 0x10550928
mov eax, dword [ebp - 0x2c8]
or eax, 2
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x314]
push eax
call fcn.100b9b60
push dword [eax]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x101d9d7a
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x2d4], 0
push str.override
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x2d0], 0
movups xmmword [ebp - 0x2e4], xmm0
call fcn.100bd420
mov dword [ebp - 4], 3
mov ecx, 0x10550908
mov eax, dword [ebp - 0x2c8]
or eax, 4
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2cc], eax
lea eax, [ebp - 0x2e4]
push eax
call fcn.100b9b80
mov byte [ebp - 0x2c1], 1
cmp byte [eax], 0
jne 0x101d9d81
mov byte [ebp - 0x2c1], 0
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x2c8]
test al, 4
je 0x101d9df6
mov ecx, dword [ebp - 0x2d0]
and eax, 0xfffffffb
mov dword [ebp - 0x2c8], eax
cmp ecx, 0x10
jb 0x101d9ddb
mov edx, dword [ebp - 0x2e4]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x101d9dcb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101d9fda
push ecx
push edx
call fcn.101fb2ba
mov eax, dword [ebp - 0x2c8]
add esp, 8
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 0xf
mov byte [ebp - 0x2e4], 0
mov dword [ebp - 4], 0xffffffff
test al, 2
je 0x101d9e3b
mov ecx, dword [ebp - 0x300]
cmp ecx, 0x10
jb 0x101d9e3b
mov edx, dword [ebp - 0x314]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x101d9e31
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101d9fda
push ecx
push edx
call fcn.101fb2ba
add esp, 8
cmp byte [ebp - 0x2c1], 0
je 0x101d9e53
push dword [ebp - 0x2e8]
push edi
push esi
call fcn.101d90e0
jmp 0x101d9e63
cmp dword [edi + 0x3a40], 5
jne 0x101d9e63
push edi
push esi
call fcn.101db680
cmp byte [edi + 0x3a60], 0
jne 0x101d9fa8
cmp dword [edi + 0x3a40], 1
je 0x101d9fa8
mov ecx, dword [0x1054dfe4]
lea edx, [ebp - 0x168]
push edx
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ecx]
push dword [edx + 0x64]
mov eax, dword [eax + 0x20]
call eax
test al, al
je 0x101d9eac
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x15c]
jmp 0x101d9ec3
xorps xmm0, xmm0
movlpd qword [ebp - 0x2f8], xmm0
mov ecx, dword [ebp - 0x2f4]
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 0x2f0]
mov dword [ebp - 0x2ec], ecx
mov ecx, 0x10552624
push eax
call fcn.1010cb10
cmp byte [eax], 0
je 0x101d9f6a
mov ecx, dword [0x1054dfe4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x1054dfe4]
mov edx, dword [ecx]
lea ecx, [ebp - 0x2c0]
push ecx
mov ecx, dword [0x1054dfe4]
push eax
mov edx, dword [edx + 0x20]
call edx
test al, al
je 0x101d9fa8
mov ecx, dword [ebp - 0x2b8]
mov eax, dword [ebp - 0x2b4]
cmp ecx, 0x489902b5
jne 0x101d9f34
cmp eax, 0x1100001
je 0x101d9f52
cmp ecx, 0x187fa216
jne 0x101d9f43
cmp eax, 0x1100001
je 0x101d9f52
cmp ecx, 0x154c4e0a
jne 0x101d9fa8
cmp eax, 0x1100001
jne 0x101d9fa8
mov eax, dword [esi + 0x3ab8]
mov eax, dword [eax + 0x64]
mov eax, dword [eax*4 + 0x104e5210]
mov dword [edi + 0x39dc], eax
jmp 0x101d9fa8
cmp byte [esi + 0x3b38], 0
je 0x101d9fa8
mov eax, dword [esi + 0x3b3c]
mov dword [edi + 0x39dc], eax
mov eax, dword [edi + 0x3954]
push 2
push 0x102c0f4c
mov eax, dword [eax + 0x64]
lea eax, [eax + eax*2]
lea ecx, [eax*8 + 0x103f3ea8]
call fcn.100c26e0
mov dword [edi + 0x3a44], 0x102c0f4c
lea ecx, [edi + 0x39dc]
call fcn.101c9d30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101fae3a
mov esp, ebp
pop ebp
ret 8
call fcn.10201dbe
call fcn.10201dbe
call fcn.10201dbe
int3