Function at 0x1002053a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x1002f040]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [0x1002f628]
mov dword [esp + 0x14], edi
test ecx, ecx
je case.default.0x1002091c
add ecx, 8
mov dword [esp + 0x10], ecx
call fcn.1001f659
xor ebx, ebx
mov esi, eax
mov eax, 0x204
inc ebx
cmp edx, eax
ja 0x100208f3
je 0x100206f9
mov eax, 0x100
cmp edx, 0x104
ja 0x100206c0
je 0x100207c3
mov eax, edx
sub eax, 7
je 0x100206ac
sub eax, ebx
je 0x100206ac
sub eax, 0x18
je 0x1002068b
sub eax, 0xe0
je 0x10020679
sub eax, ebx
je 0x10020679
sub eax, ebx
jne case.default.0x1002091c
push edi
call dword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x10020602
mov edx, dword [ebp + 8]
lea eax, [edx - 1]
cmp eax, 0xfffe
ja case.default.0x1002091c
mov ecx, dword [esp + 0x10]
push edx
call fcn.1000266a
jmp case.default.0x1002091c
and dword [esp + 0x30], 0
lea ecx, [esp + 0x30]
xor eax, eax
inc eax
push eax
push ecx
push eax
lea ecx, [ebp + 8]
push ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx eax, word [esp + 0x30]
test eax, eax
je case.default.0x1002091c
mov ecx, dword [esp + 0x10]
cmp byte [ecx + 0x3761], 0
je case.default.0x1002091c
mov ecx, dword [0x1002f628]
xorps xmm0, xmm0
and dword [esp + 0x2c], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [ecx + 0x3780]
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 2
call fcn.1001219b
jmp case.default.0x1002091c
mov eax, 0x100
cmp edx, eax
je 0x100207c3
jmp 0x100207c1
xor ebx, ebx
inc ebx
cmp word [ebp + 0xc], bx
jne case.default.0x1002091c
call fcn.1001f78c
test al, al
je case.default.0x1002091c
mov eax, ebx
jmp 0x100209ec
cmp edx, 7
sete al
movzx eax, al
push eax
call fcn.10002a3b
jmp case.default.0x1002091c
mov eax, edx
sub eax, 0x105
je 0x100207bc
sub eax, 0xfb
je 0x10020768
sub eax, 1
je case.0x1002091c.518
sub eax, 1
je case.0x1002091c.517
sub eax, 1
jne case.default.0x1002091c
xor edi, edi
cmp edx, 0x206
jne 0x100206fb
mov edi, ebx
cmp edx, 0x207
je 0x1002070b
cmp edx, 0x209
jne 0x1002070e
push 2
pop edi
cmp edx, 0x20b
je 0x1002071e
cmp edx, 0x20d
jne 0x10020735
mov eax, dword [ebp + 8]
xor ecx, ecx
shr eax, 0x10
cmp ax, bx
setne cl
add ecx, 3
mov dword [esp + 0x30], ecx
mov edi, ecx
cmp dword [esi + 0xc], 0
jne 0x1002074f
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x1002074f
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x10]
bts eax, edi
push ebx
mov dword [esi + 0xc], eax
push edi
call fcn.10002975
jmp case.default.0x1002091c
cmp byte [esi + 8], 0
mov dword [esi + 4], edi
jne 0x10020799
and dword [esp + 0x24], 0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], edi
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov byte [esi + 8], 1
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 0x10
cwde
movd xmm2, eax
movsx eax, cx
mov ecx, dword [esp + 0x10]
cvtdq2ps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
jmp 0x100209e5
mov eax, 0x100
xor bl, bl
cmp dword [ebp + 8], eax
jae case.default.0x1002091c
call fcn.1001f926
mov esi, dword [ebp + 8]
cmp esi, 0xd
jne 0x100207ec
mov eax, dword [ebp + 0xc]
shr eax, 0x10
bt ax, 8
mov eax, 0x10d
cmovb esi, eax
mov ecx, esi
call fcn.1001fff5
test eax, eax
je 0x10020804
push ecx
push esi
mov dl, bl
mov ecx, eax
call fcn.1001f830
pop ecx
pop ecx
cmp esi, 0x10
jne 0x10020850
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0xa0
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne 0x10020830
push ecx
push edi
mov dl, bl
mov ecx, 0x210
call fcn.1001f830
pop ecx
pop ecx
mov edi, 0xa1
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne case.default.0x1002091c
push ecx
mov ecx, 0x214
jmp 0x100208e4
cmp esi, 0x11
jne 0x10020899
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0xa2
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne 0x1002087c
push ecx
push edi
mov dl, bl
mov ecx, 0x20f
call fcn.1001f830
pop ecx
pop ecx
mov edi, 0xa3
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne case.default.0x1002091c
push ecx
mov ecx, 0x213
jmp 0x100208e4
cmp esi, 0x12
jne case.default.0x1002091c
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0xa4
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne 0x100208c9
push ecx
push edi
mov dl, bl
mov ecx, 0x211
call fcn.1001f830
pop ecx
pop ecx
mov edi, 0xa5
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne case.default.0x1002091c
push ecx
mov ecx, 0x215
push edi
mov dl, bl
call fcn.1001f830
pop ecx
pop ecx
jmp case.default.0x1002091c
mov eax, 0x219
cmp edx, eax
ja 0x100209c5
je 0x100209b9
lea eax, [edx - 0x205]
cmp eax, 9
ja case.default.0x1002091c
movzx eax, byte [eax + 0x10020a0e]
jmp dword [eax*4 + 0x100209fe]
xor ebx, ebx
cmp edx, 0x205
sete bl
cmp edx, 0x208
jne 0x1002093b
push 2
pop ebx
jmp 0x10020955
cmp edx, 0x20c
jne 0x10020955
mov eax, dword [ebp + 8]
xor ebx, ebx
shr eax, 0x10
cmp ax, 1
setne bl
add ebx, 3
mov eax, dword [esi + 0xc]
btr eax, ebx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x10020976
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, edi
jne 0x10020972
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [esp + 0x10]
push 0
push ebx
jmp 0x1002075e
mov eax, dword [ebp + 8]
xorps xmm1, xmm1
shr eax, 0x10
cwde
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm2, dword [0x1002cdbc]
call fcn.100029e3
jmp case.default.0x1002091c
mov eax, dword [ebp + 8]
xorps xmm2, xmm2
shr eax, 0x10
cwde
movd xmm1, eax
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x1002cdbc]
jmp 0x10020997
cmp dword [ebp + 8], 7
jne case.default.0x1002091c
mov byte [esi + 0x25], 1
jmp case.default.0x1002091c
cmp edx, 0x2a3
jne case.default.0x1002091c
cmp dword [esi + 4], edi
jne 0x100209d6
and dword [esi + 4], 0
movss xmm1, dword [0x1002ce0c]
mov byte [esi + 8], 0
movaps xmm2, xmm1
call fcn.100028b7
xor eax, eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1002515c
mov esp, ebp
pop ebp
ret