Function at 0x101c1d6
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
xor edi, edi
push 0x11
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call esi
xor ebx, ebx
inc ebx
test ax, ax
jns 0x101c1fd
mov dword [ebp - 8], ebx
push 0x10
call esi
test ax, ax
mov esi, dword [ebp + 0xc]
jns 0x101c212
test byte [esi + 0x20], 2
je 0x101c212
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x10]
cmp eax, 0x24
jg 0x101c3bd
je 0x101c397
sub eax, 0xd
je 0x101c35d
sub eax, 0x13
je 0x101c346
dec eax
je 0x101c31e
dec eax
je 0x101c2b1
dec eax
jne 0x101c3cb
cmp dword [ebp - 8], edi
je 0x101c252
mov eax, dword [esi + 4]
dec eax
jmp 0x101c26a
mov eax, dword [esi + 0x60]
dec eax
push eax
push esi
push dword [ebp + 8]
call fcn.0101bb30
mov ecx, dword [esi + 4]
cmp eax, ecx
jl 0x101c26a
lea eax, [ecx - 1]
mov ecx, dword [esi + 8]
xor edx, edx
test byte [esi + 0x20], bl
jne 0x101c279
lea edx, [ecx - 1]
mov ecx, ebx
cmp dword [ebp - 4], edi
push ebx
je 0x101c28c
push edx
push eax
push esi
push dword [ebp + 8]
call fcn.0101bfd8
jmp 0x101c299
push ecx
push ebx
push edx
push eax
push esi
push dword [ebp + 8]
call fcn.0101bbf0
cmp dword [ebp - 8], edi
je 0x101c467
push ebx
push esi
push dword [ebp + 8]
call fcn.0101bf04
jmp 0x101c467
mov eax, dword [esi + 0x60]
cmp eax, 3
jle 0x101c2c6
add eax, 0xfffffffd
push eax
push esi
push dword [ebp + 8]
call fcn.0101b79a
mov eax, dword [esi + 0x60]
dec eax
push eax
push esi
push dword [ebp + 8]
call fcn.0101bb30
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 4]
cmp dword [ebp + 0xc], eax
jl 0x101c2e3
dec eax
mov dword [ebp + 0xc], eax
mov ecx, dword [esi + 8]
xor edx, edx
test byte [esi + 0x20], bl
jne 0x101c2f2
lea edx, [ecx - 1]
mov ecx, ebx
cmp dword [ebp - 4], edi
push ebx
je 0x101c30a
push edx
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0101bfd8
jmp 0x101c467
push ecx
push ebx
push edx
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0101bbf0
jmp 0x101c467
mov eax, dword [esi + 0x60]
cmp eax, 3
jle 0x101c335
push 3
pop ecx
sub ecx, eax
push ecx
push esi
push dword [ebp + 8]
call fcn.0101b79a
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call fcn.0101c166
jmp 0x101c467
cmp dword [esi + 0x98], edi
jne 0x101c356
push edi
push ebx
push edi
jmp 0x101c45d
push ebx
push edi
push edi
push edi
push edi
jmp 0x101c310
lea ebx, [esi + 0x98]
cmp dword [ebx], edi
je 0x101c467
push edi
push esi
push dword [ebp + 8]
call fcn.0101bf04
push dword [esi + 0x9c]
push dword [ebx]
push dword [esi + 0x94]
push dword [esi + 0x90]
push esi
push dword [ebp + 8]
call fcn.0101bd65
jmp 0x101c467
cmp dword [ebp - 8], edi
je 0x101c3ab
mov eax, dword [esi + 0x6c]
neg eax
push eax
push esi
push dword [ebp + 8]
call fcn.0101b79a
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call fcn.0101c166
push edi
jmp 0x101c2a3
sub eax, 0x25
je 0x101c437
dec eax
je 0x101c417
dec eax
je 0x101c3f9
dec eax
je 0x101c3d2
mov eax, ebx
jmp 0x101c469
cmp dword [ebp - 8], edi
je 0x101c3f1
push ebx
push edi
push edi
push edi
push edi
push esi
push dword [ebp + 8]
call fcn.0101bbf0
push ebx
push esi
push dword [ebp + 8]
call fcn.0101b79a
jmp 0x101c467
push dword [ebp - 4]
push ebx
push edi
push ebx
jmp 0x101c45e
test byte [esi + 0x20], bl
je 0x101c410
cmp dword [ebp - 8], edi
je 0x101c40b
mov eax, dword [esi + 0x58]
sub eax, dword [esi + 0x5c]
jmp 0x101c44b
push dword [esi + 0x50]
jmp 0x101c44c
push dword [ebp - 4]
push ebx
push ebx
jmp 0x101c45d
cmp dword [ebp - 8], edi
je 0x101c42e
push ebx
push edi
push edi
push edi
push edi
push esi
push dword [ebp + 8]
call fcn.0101bbf0
push 0xffffffffffffffff
jmp 0x101c3e6
push dword [ebp - 4]
push edi
push edi
push 0xffffffffffffffff
jmp 0x101c45e
test byte [esi + 0x20], bl
je 0x101c457
cmp dword [ebp - 8], edi
je 0x101c446
mov eax, dword [esi + 0x70]
jmp 0x101c449
mov eax, dword [esi + 0x50]
neg eax
push eax
push esi
push dword [ebp + 8]
call fcn.0101ba32
jmp 0x101c467
push dword [ebp - 4]
push edi
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 8]
call fcn.0101c09d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc