Function at 0x10018690
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
mov ebx, dword [0x1023d288]
push ebp
push esi
push edi
mov edi, ecx
test ebx, ebx
je 0x1001899b
mov eax, dword [0x1023d284]
test eax, eax
jne 0x100186dc
mov edx, 0xe80c2f78
mov ecx, 0x1021170d
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d284], eax
cmp dword [eax + ebx], 0
jle 0x1001899b
call fcn.1000c050
cmp eax, 9
je 0x1001899b
cmp eax, 8
je 0x1001899b
cmp eax, 0xa
je 0x1001899b
cmp byte [0x102733e7], 0
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
je 0x100187bf
mov ecx, dword [0x10237394]
mov eax, dword [0x102733fc]
cmp ecx, 3
ja case.0x10018729.0
jmp dword [ecx*4 + 0x100189a4]
push eax
call ebx
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10018755
push eax
call ebx
test ax, ax
setne al
jmp 0x10018755
push eax
call ebx
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x100187bf
test byte [0x102734b8], 1
mov ecx, dword [0x1023d2c0]
je 0x100187b6
mov ebp, dword [0x1023d288]
test ecx, ecx
jne 0x100187a3
mov edx, 0xe80c2f78
mov ecx, 0x10211851
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov ecx, eax
mov dword [0x1023d2c0], ecx
test byte [ecx + ebp], 1
jne 0x100187b6
or dword [edi + 0x30], 2
mov byte [0x10273490], 1
jmp 0x100187c5
mov byte [0x10273490], 0
jmp 0x100187c5
mov ecx, dword [0x1023d2c0]
cmp byte [0x102733f2], 0
je 0x100188d9
mov edx, dword [0x102373cc]
mov eax, dword [0x102733c4]
cmp edx, 3
ja case.0x100187e2.0
jmp dword [edx*4 + 0x100189b4]
push eax
call ebx
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x1001880e
push eax
call ebx
test ax, ax
setne al
jmp 0x1001880e
push eax
call ebx
cwde
shr eax, 0x10
test eax, eax
sete al
mov ecx, dword [0x1023d2c0]
test al, al
je 0x100188d9
mov ebp, dword [0x1023d288]
test ecx, ecx
jne 0x10018857
mov edx, 0xe80c2f78
mov ecx, 0x10211851
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov ecx, eax
mov dword [0x1023d2c0], ecx
test byte [ecx + ebp], 1
mov eax, dword [0x1023d214]
je 0x1001886d
mov edx, dword [eax + 0x1c]
mov dword [0x1026ebe0], edx
jmp 0x10018873
mov edx, dword [0x1026ebe0]
mov eax, dword [eax + 0x1c]
sub eax, edx
cmp eax, 2
setle byte [0x10273498]
jg 0x100188d2
mov ebp, dword [0x1023d288]
test ecx, ecx
jne 0x100188bf
mov edx, 0xe80c2f78
mov ecx, 0x10211851
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov ecx, eax
mov dword [0x1023d2c0], ecx
test byte [ecx + ebp], 1
jne 0x100188d2
or dword [edi + 0x30], 6
mov byte [0x10273499], 1
jmp 0x100188d9
mov byte [0x10273499], 0
cmp byte [0x102733cb], 0
je 0x1001899b
mov edx, dword [0x102373bc]
mov eax, dword [0x10273434]
cmp edx, 3
ja case.0x100188f6.0
jmp dword [edx*4 + 0x100189c4]
push eax
call ebx
cwde
shr eax, 0x10
test eax, eax
setne al
jmp 0x10018922
push eax
call ebx
test ax, ax
setne al
jmp 0x10018922
push eax
call ebx
cwde
shr eax, 0x10
test eax, eax
sete al
test al, al
je 0x1001899b
mov ecx, dword [0x1023d2c0]
test byte [0x102734b8], 1
je 0x10018994
mov ebx, dword [0x1023d288]
test ecx, ecx
jne 0x10018970
mov edx, 0xe80c2f78
mov ecx, 0x10211851
call fcn.100050d0
mov edx, 0xc10bf213
mov ecx, 0x10211635
mov esi, eax
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov ecx, eax
mov dword [0x1023d2c0], ecx
test byte [ecx + ebx], 1
jne 0x10018994
cmp byte [0x10273409], 0
mov byte [0x1027349a], 1
je 0x1001898a
or dword [edi + 0x30], 2
or dword [edi + 0x30], 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov byte [0x1027349a], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret