Function at 0x1000d200
Capabilities:
Log keystrokes via application hook
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp dword [0x1002d830], 0xffffffff
push ebx
push esi
push edi
je 0x1000d4c5
cmp byte [0x1002d7af], 0
mov ebx, dword [ebp + 0x10]
jne 0x1000d4c5
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x5b
call esi
mov edi, 0x8000
test di, ax
jne 0x1000d4c5
push 0x5c
call esi
test di, ax
jne 0x1000d4c5
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x1000d262
cmp dword [0x1002d830], eax
jne 0x1000d262
test ebx, ebx
je 0x1000d4c5
test al, 1
jne 0x1000d4c5
test al, 0xf
je 0x1000d276
test al, 6
je 0x1000d4c5
mov ecx, 0x1002e78c
call fcn.10005e10
cmp dword [0x1002e1ec], 0
xorps xmm0, xmm0
mov ecx, dword [ebp + 0x14]
mov edx, str.FastFolders
mov esi, dword [ebp + 0xc]
mov eax, str.FastFolders_t___
cmove eax, edx
mov dword [0x1002d974], esi
movups xmmword [ebp - 0x18], xmm0
mov dword [ebp - 0xc], eax
mov eax, dword [0x1002d7b0]
mov dword [ebp - 0x14], eax
movzx eax, cx
or eax, 0xffff0000
mov byte [0x1002d7ad], 0
movups xmmword [ebp - 0x28], xmm0
mov dword [0x1002d82c], 0
mov byte [0x1002d83c], 0
mov dword [ebp - 0x30], 0x30
movq qword [ebp - 8], xmm0
mov dword [ebp - 0x2c], 0x3f
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], ecx
mov dword [0x1002d81c], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
cmp dword [0x1002d830], 0
lea edi, [ebx + 1]
mov dword [ebp - 0x1c], eax
jne 0x1000d326
lea eax, [ebp - 0x30]
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.USER32.dll_InsertMenuItemA]
jmp 0x1000d419
cmp dword [0x1002e1ec], 0
mov ecx, str.Move_To_Folder
mov eax, str.Move_To_Folder_t___
cmove eax, ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
push 0x400
push ebx
push esi
call dword [sym.imp.USER32.dll_InsertMenuItemA]
call dword [sym.imp.USER32.dll_CreatePopupMenu]
cmp dword [0x1002e1ec], 0
mov ecx, str.Copy_To_Folder
mov dword [ebp - 0x1c], eax
mov eax, str.Copy_To_Folder_t___
cmove eax, ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
push 0x400
push edi
push esi
call dword [sym.imp.USER32.dll_InsertMenuItemA]
inc edi
cmp dword [0x1002e1dc], 0
je 0x1000d419
push dword [0x1002b02c]
call fcn.1000ec60
mov esi, eax
push esi
call fcn.1000ecc0
push esi
push dword [0x1002d794]
call fcn.10003d00
add esp, 0x10
mov dword [ebp + 0x10], eax
test esi, esi
je 0x1000d3c6
mov ecx, dword [0x1002d790]
push esi
push ecx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [ebp + 0x10]
movzx ecx, byte [0x1002d83c]
test eax, 0x40000000
mov eax, 1
mov dword [ebp - 0x14], 0
cmovne ecx, eax
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x24]
test cl, cl
mov edx, 3
mov byte [0x1002d83c], cl
cmove eax, edx
mov dword [ebp - 0xc], str.Move_To_Parent
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x30]
push eax
push 0x400
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_InsertMenuItemA]
inc edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [0x1002d808]
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x1000d43f
push ecx
call esi
mov dword [0x1002d808], 0
mov eax, dword [0x1002d80c]
test eax, eax
je 0x1000d455
push eax
call esi
mov dword [0x1002d80c], 0
mov eax, dword [0x1002d810]
test eax, eax
je 0x1000d46b
push eax
call esi
mov dword [0x1002d810], 0
push dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_SetWindowsHookExA]
push dword [0x1002d79c]
push 0x1000aa50
push 4
call esi
push dword [ebp + 0xc]
mov dword [0x1002d808], eax
push dword [0x1002d79c]
push 0x1000ae50
push 7
call esi
push dword [ebp + 0xc]
mov dword [0x1002d80c], eax
push dword [0x1002d79c]
push 0x1000a810
push 2
call esi
sub edi, ebx
mov dword [0x1002d810], eax
inc edi
movzx eax, di
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18