Function at 0x1001d360
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acc98
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
cmp esi, 0x100
je 0x1001d3ac
cmp esi, 0x101
jne 0x1001d3b8
cmp ebx, 0xff
je 0x1001d6b2
cmp esi, 0x100
je 0x1001d3cc
cmp esi, 0x101
jne 0x1001d4e3
cmp ebx, 0xd
jne 0x1001d4e3
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1001d4e3
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1001d4e3
mov eax, dword [edi + 0x108]
lea ecx, [ebp - 0x28]
add eax, 0xedc
push eax
call fcn.100091d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov ecx, 0x100bc34c
cmovae eax, dword [ebp - 0x28]
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001d450
test dl, dl
je 0x1001d44c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001d450
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001d430
xor eax, eax
jmp 0x1001d455
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001d5db
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov ecx, 0x100bc35c
cmovae eax, dword [ebp - 0x28]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001d490
test dl, dl
je 0x1001d48c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001d490
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001d470
xor eax, eax
jmp 0x1001d495
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001d5db
mov edx, 0x100bc374
lea ecx, [ebp - 0x28]
call fcn.10011a60
test al, al
je 0x1001d4c1
mov eax, dword [edi + 0x108]
cmp byte [eax + 0xeb8], 3
je 0x1001d5db
mov ecx, dword [edi + 0x108]
call fcn.1001d2c0
test al, al
jne 0x1001d5db
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10003610
cmp esi, 0x100
jne 0x1001d5e8
lea eax, [ebx - 1]
cmp eax, 0xfe
ja 0x1001d6b2
cmp ebx, 0xe5
je 0x1001d6b2
cmp byte [ebp + 0x18], 0
jne 0x1001d6b2
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp + 0x14]
sar edi, 0x10
and edi, 0xff
mov ecx, dword [esi + 0x108]
cmp byte [ecx + 0xeb4], 0
jne 0x1001d53e
call fcn.1001d2c0
test al, al
jne 0x1001d6b2
push 0
push ecx
mov ecx, dword [esi + 0x108]
push ebx
call fcn.10023d60
test al, al
je 0x1001d564
mov eax, dword [esi + 0x108]
cmp byte [eax + 0xeb4], 0
jne 0x1001d6b2
push 0
push 0x14
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp edi, eax
je 0x1001d6b2
push 0
push 0x90
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp edi, eax
je 0x1001d6b2
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
and al, 1
cmp al, byte [esi + 4]
je 0x1001d5b6
mov byte [esi + 4], al
mov esi, dword [ebp - 0x30]
push 0
push 0x14
mov esi, dword [esi]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebp - 0x30]
push eax
call dword [esi + 0xc]
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov edx, edi
push 1
push ecx
mov byte [ebx + esi + 6], 1
mov ecx, ebx
mov esi, dword [eax]
call fcn.10023c90
mov ecx, dword [ebp - 0x30]
add esp, 4
push eax
call dword [esi + 8]
jmp 0x1001d6b2
lea ecx, [ebp - 0x28]
call fcn.10003610
jmp 0x1001d6b2
cmp esi, 0x101
je 0x1001d5f8
cmp esi, 0x105
jne 0x1001d651
mov edi, dword [ebp + 0x14]
sar edi, 0x10
and edi, 0xff
cmp ebx, 0xe5
jne 0x1001d617
push 1
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ebx, eax
mov eax, dword [ebp - 0x2c]
cmp byte [eax + ebx + 6], 0
lea edx, [eax + ebx]
je 0x1001d654
lea ecx, [ebx - 1]
cmp ecx, 0xfe
ja 0x1001d654
mov eax, dword [ebp - 0x30]
mov byte [edx + 6], 0
mov edx, edi
push 0
push ecx
mov esi, dword [eax]
mov ecx, ebx
call fcn.10023c90
mov ecx, dword [ebp - 0x30]
add esp, 4
push eax
call dword [esi + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 0x2c]
cmp esi, 8
je 0x1001d65e
cmp esi, 7
jne 0x1001d6b2
mov ebx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edi, edi
cmp byte [eax + edi + 6], 0
je 0x1001d6a9
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
mov eax, dword [ebp - 0x2c]
jne 0x1001d6a9
push 0
push edi
mov byte [eax + edi + 6], 0
call ebx
mov esi, dword [ebp - 0x30]
mov edx, eax
push 0
push ecx
mov ecx, edi
mov esi, dword [esi]
call fcn.10023c90
mov ecx, dword [ebp - 0x30]
add esp, 4
push eax
call dword [esi + 8]
mov eax, dword [ebp - 0x2c]
inc edi
cmp edi, 0x100
jl 0x1001d666
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ab974
mov esp, ebp
pop ebp
ret 0x18