Function at 0x102fdce0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x118], eax
cmp dword [ebp + 0x10], 0
jne 0x102fdd23
cmp dword [ebp + 8], 0x14
je 0x102fdd23
cmp dword [ebp + 8], 0x91
je 0x102fdd23
cmp dword [ebp + 8], 0x90
jne 0x102fdd28
jmp 0x102fdee2
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp eax, 0x7fff
jbe 0x102fdd45
mov eax, 0xff20
jmp 0x102fdf7a
push 0x100
push 0
lea edx, [ebp - 0x110]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
and eax, 1
je 0x102fdd6a
mov byte [ebp - 0x100], 0x80
mov ecx, dword [ebp + 0xc]
and ecx, 4
je 0x102fdd79
mov byte [ebp - 0xff], 0x80
mov edx, dword [ebp + 0xc]
and edx, 0x10
je 0x102fdd88
mov byte [ebp - 0xfe], 0x80
mov eax, dword [ebp + 0xc]
and eax, 2
je 0x102fdd97
mov byte [ebp - 0xfc], 1
mov ecx, dword [ebp + 0xc]
and ecx, 0x20
je 0x102fdda3
mov byte [ebp - 0x7f], 1
mov edx, dword [ebp + 0xc]
and edx, 8
je 0x102fddaf
mov byte [ebp - 0x80], 1
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ToAscii]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jge 0x102fde04
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ToAscii]
mov eax, 0xff20
jmp 0x102fdf7a
cmp dword [ebp - 0x114], 2
jne 0x102fdebe
movzx edx, byte [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
cwde
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sar ecx, 8
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 8]
and edx, 0xff
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x118], eax
push 0x100
push 0
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x11c]
and edx, 1
je 0x102fde72
mov byte [ebp - 0x100], 0x80
mov eax, dword [ebp - 0x11c]
and eax, 2
je 0x102fde84
mov byte [ebp - 0xff], 0x80
mov ecx, dword [ebp - 0x11c]
and ecx, 4
je 0x102fde96
mov byte [ebp - 0xfe], 0x80
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_ToAscii]
mov eax, 0xff20
jmp 0x102fdf7a
cmp dword [ebp - 0x114], 1
jne 0x102fdee2
movzx eax, byte [ebp - 4]
cmp eax, 0x20
jl 0x102fdee2
movzx ecx, byte [ebp - 4]
cmp ecx, 0x7f
je 0x102fdee2
movzx eax, byte [ebp - 4]
jmp 0x102fdf7a
cmp dword [ebp + 8], 0x91
jbe 0x102fdef2
xor eax, eax
jmp 0x102fdf7a
mov edx, dword [ebp + 8]
mov dword [ebp - 0x120], edx
cmp dword [ebp - 0x120], 0x10
je 0x102fdf34
cmp dword [ebp - 0x120], 0x11
je 0x102fdf18
cmp dword [ebp - 0x120], 0x12
je 0x102fdf53
jmp 0x102fdf70
push 0xa3
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
je 0x102fdf32
mov eax, 0xffe4
jmp 0x102fdf7a
jmp 0x102fdf70
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
je 0x102fdf51
mov eax, 0xffe2
jmp 0x102fdf7a
jmp 0x102fdf70
push 0xa5
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x80
je 0x102fdf70
mov eax, 0xffea
jmp 0x102fdf7a
mov eax, dword [ebp + 8]
mov eax, dword [eax*4 + 0x1034efa8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1022118e
mov esp, ebp
pop ebp
ret