Function at 0x1002d740
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x101bd92c]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [0x101ed690]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov byte [edi + 0x1c8], 0
test eax, eax
jne 0x1002d79e
push 0x10
call fcn.10092352
add esp, 4
test eax, eax
je 0x1002d797
mov dword [eax + 4], 0
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
jmp 0x1002d799
xor eax, eax
mov dword [0x101ed690], eax
cmp dword [eax + 4], 0
je 0x1002d8b4
mov ecx, dword [ebp + 0xc]
and ecx, 0x80000000
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], ecx
jne 0x1002d7d3
push esi
mov ecx, edi
mov dword [edi + 0x17c], esi
call fcn.10039350
mov ecx, dword [esp + 0xc]
jmp 0x1002d7e5
cmp dword [edi + 0x17c], esi
je 0x1002d7e5
mov dword [edi + 0x17c], 0
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [edi + 0x190], 1
mov al, byte [eax + 0x11]
and al, 0x80
mov edx, 1
cmovne ebx, edx
mov dword [esp + 0x18], ebx
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, 0x11
jne 0x1002d8cd
test ecx, ecx
je 0x1002d838
mov eax, dword [edi + 0x174]
mov dword [esp + 0x1c], eax
mov dword [edi + 0x170], 0
mov dword [edi + 0x174], 0
jmp 0x1002d889
cmp dword [edi + 0x170], 0
jne 0x1002d889
xor ebx, ebx
cmp ebx, 0x11
je 0x1002d866
cmp ebx, 0xa2
je 0x1002d866
cmp ebx, 0xa3
je 0x1002d866
push ebx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 8
test al, al
jne 0x1002d883
inc ebx
cmp ebx, 0x100
jl 0x1002d843
mov dword [edi + 0x170], 1
mov dword [edi + 0x174], 1
mov ebx, dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp dword [esp + 0x18], 0
je 0x1002d8fb
cmp esi, 0x20
jne 0x1002d8fb
cmp dword [esp + 0xc], 0
jne 0x1002d8fb
call fcn.1000ecf0
test eax, eax
je 0x1002d8b4
mov ecx, dword [edi + 0x1bc]
test ecx, ecx
je 0x1002d8b4
mov eax, dword [ecx]
call dword [eax + 0x1c]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
test al, al
jne 0x1002d8e7
mov dword [edi + 0x170], 0
mov dword [edi + 0x174], 0
jmp 0x1002d889
test ecx, ecx
jne 0x1002d889
cmp dword [edi + 0x174], ecx
je 0x1002d889
mov dword [edi + 0x174], ecx
jmp 0x1002d889
mov dword [esp + 0x10], 0
cmp esi, 0x10
jne 0x1002d9c0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x16c]
cmp eax, ecx
jbe 0x1002d920
sub eax, ecx
jmp 0x1002d924
sub ecx, eax
mov eax, ecx
xor ecx, ecx
cmp eax, 0x1f4
mov eax, 1
cmovb ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [edi + 0x1cc], eax
jne 0x1002d976
mov ecx, dword [edi + 0x1b4]
push 0xb4
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [eax]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1002d976
push 0
push 0x153
push 0x52d
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [edi + 0x1cc], 2
jne 0x1002d9b6
mov ecx, dword [edi + 0x1b4]
push 0xb4
mov eax, dword [ecx]
call dword [eax + 0x10]
mov eax, dword [eax]
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1002d9b6
push 0
push 0x154
push 0x52d
push dword [esp + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [edi + 0x1cc], 0
cmp dword [edi + 0x1b0], 0
je 0x1002d9e6
cmp esi, 8
jne 0x1002d9e6
push 1
call fcn.10006810
mov ecx, eax
call fcn.100b91c0
mov dword [edi + 0x1b0], 0
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
cmp al, 0x81
jne 0x1002da7f
mov ecx, dword [edi + 0x1bc]
test ecx, ecx
je 0x1002da04
mov eax, dword [ecx]
call dword [eax]
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x1002da13
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, edi
call fcn.10032950
mov ecx, edi
call fcn.10038060
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [edi + 0xf4]
test ecx, ecx
je 0x1002da36
call fcn.100132f0
mov ecx, edi
call fcn.10038120
mov ecx, dword [edi + 0xf8]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x1002d8b4
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [edi + 0x1b8]
mov eax, dword [ecx]
call dword [eax + 0x28]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp al, 1
jne 0x1002dbbf
mov ecx, dword [edi + 0x1b4]
push 0x81
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
je 0x1002dac5
cmp esi, 0x1b
jne 0x1002dac5
mov ecx, dword [edi + 0x1b8]
mov eax, dword [ecx]
call dword [eax + 0x34]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push esi
call fcn.10008b20
mov ecx, eax
call fcn.1002b350
mov ecx, eax
cmp ecx, 0xffffffff
je 0x1002db32
mov eax, dword [ebp + 0x10]
test byte [eax + 0x10], 0x80
je 0x1002daef
mov dword [edi + 0x8c], 1
test byte [eax + 0x11], 0x80
je 0x1002daff
mov dword [edi + 0x90], 1
cmp ecx, 0x9d04
jne 0x1002db11
mov dword [edi + 0x94], 1
mov byte [edi + 0x1c8], 1
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x10
jne 0x1002db97
cmp dword [esp + 0xc], 0
jne 0x1002db97
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 0
push 0
push 0x14
call esi
push 0
push 2
push 0
push 0x14
call esi
call fcn.10006740
mov edx, dword [eax]
push 0x7f
mov ecx, eax
call dword [edx + 0x44]
mov bl, al
call fcn.10006740
mov edx, dword [eax]
xor ecx, ecx
test bl, bl
sete cl
push ecx
push 0x7f
mov ecx, eax
call dword [edx + 0x48]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x1b4]
push 0x7c
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jne 0x1002dc01
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp al, 0x80
jne 0x1002dc01
mov ecx, dword [edi + 0x1bc]
test ecx, ecx
je 0x1002dbd2
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [edi + 0x1b8]
test ecx, ecx
je 0x1002dbe1
mov eax, dword [ecx]
call dword [eax + 8]
mov ecx, edi
call fcn.10038060
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0xc]
push esi
call fcn.10008b20
mov ecx, eax
call fcn.1002b350
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x1002dadc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1002dc59
cmp esi, 0x11
je 0x1002dc55
cmp esi, 0x10
je 0x1002dc55
push 0xa0
call ebx
push 0xa1
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1002dc84
cmp esi, 0x11
je 0x1002d8b4
cmp esi, 0x10
jne 0x1002dd7a
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x10
jne 0x1002dd7a
cmp dword [edi + 0x17c], esi
jne 0x1002dd57
cmp dword [esp + 0x18], 0
jne 0x1002dd57
mov ecx, dword [edi + 0x1b4]
push 0x74
mov eax, dword [ecx]
call dword [eax]
cmp eax, 1
jne 0x1002dd49
mov ecx, dword [edi + 0xf8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
test eax, eax
jle 0x1002dd49
push 0xa0
call ebx
push 0xa1
movzx esi, ax
call ebx
movzx eax, ax
test si, si
je 0x1002dd17
test ax, ax
jne 0x1002dd57
push ecx
push 2
mov ecx, edi
call fcn.10030bd0
mov dword [edi + 0x8c], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
test ax, ax
je 0x1002dd57
push ecx
push 3
mov ecx, edi
call fcn.10030bd0
mov dword [edi + 0x8c], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp dword [esp + 0x10], 0
jne 0x1002dd57
mov ecx, edi
call fcn.1002e330
mov dword [edi + 0x8c], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x11
jne 0x1002deed
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [edi + 0x1b4]
mov esi, eax
mov edx, dword [ecx]
sub esi, dword [edi + 0x194]
push 0x74
call dword [edx]
test eax, eax
jne 0x1002de51
cmp esi, 0x64
jb 0x1002deca
mov ecx, dword [edi + 0xf8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
test eax, eax
jle 0x1002de51
push 0xa2
call ebx
push 0xa3
movzx esi, ax
call ebx
movzx eax, ax
test si, si
je 0x1002de1b
test ax, ax
jne 0x1002deca
cmp dword [esp + 0x1c], 0
je 0x1002deca
push ecx
push 2
mov ecx, edi
call fcn.10030bd0
mov dword [edi + 0x90], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
test ax, ax
je 0x1002deca
push ecx
push 3
mov ecx, edi
call fcn.10030bd0
mov dword [edi + 0x90], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp esi, 0x64
jb 0x1002deca
mov ecx, dword [edi + 0x1b4]
push 0x72
mov eax, dword [ecx]
call dword [eax]
lea ecx, [eax - 4]
cmp ecx, 2
ja 0x1002deca
cmp dword [edi + 0x90], 0
jne 0x1002deca
cmp eax, 4
je 0x1002debb
cmp eax, 5
jne 0x1002de9b
push 0xa2
call ebx
push 0xa3
movzx esi, ax
call ebx
movzx eax, ax
test si, si
je 0x1002deca
test ax, ax
jmp 0x1002deb9
cmp eax, 6
jne 0x1002deca
push 0xa2
call ebx
push 0xa3
movzx esi, ax
call ebx
test ax, ax
je 0x1002deca
test si, si
jne 0x1002deca
mov ecx, dword [edi + 0x1bc]
test ecx, ecx
je 0x1002deca
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [edi + 0x90], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [edi + 0x1b4]
push 0x7a
mov eax, dword [ecx]
xor ebx, ebx
call dword [eax + 0x44]
cmp eax, 1
jne 0x1002dfe5
mov ecx, dword [edi + 0x1b4]
push 0x7c
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jne 0x1002dfe5
mov eax, dword [ebp + 0x10]
test byte [eax + 0x10], 0x80
je 0x1002df2d
mov dword [edi + 0x8c], 1
test byte [eax + 0x11], 0x80
je 0x1002df3d
mov dword [edi + 0x90], 1
mov ecx, dword [edi + 0x1b4]
push 0x81
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
je 0x1002d8b4
cmp esi, 0x1b
je 0x1002daa0
cmp esi, 8
je 0x1002d8b4
cmp esi, 0xd
je 0x1002d8b4
cmp esi, 0x2d
je 0x1002d8b4
cmp esi, 9
je 0x1002d8b4
cmp esi, 0x2e
je 0x1002d8b4
cmp esi, 0x26
je 0x1002d8b4
cmp esi, 0x25
je 0x1002d8b4
cmp esi, 0x27
je 0x1002d8b4
cmp esi, 0x28
je 0x1002d8b4
mov ecx, dword [edi + 0x1b4]
push 0x7c
mov eax, dword [ecx]
call dword [eax + 0x44]
test al, al
jne 0x1002dfc9
cmp esi, 0x20
je 0x1002d8b4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc
cmp dword [edi + 0x34], ebx
jle 0x1002dff6
movzx ebx, byte [esi + 0x10198ab0]
jmp 0x1002e251
mov ecx, dword [edi + 0xf8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
test eax, eax
jle 0x1002e09d
cmp esi, 0x1b
jne 0x1002e018
mov ebx, 1
jmp 0x1002e251
cmp esi, 0x20
jne 0x1002e033
mov ecx, dword [edi + 0xf8]
push 0
mov eax, dword [ecx]
call dword [eax + 0xc]
cmp dword [eax + 4], ebx
jge 0x1002e00e
xor ebx, ebx
jmp 0x1002e05e
cmp esi, 0x21
je 0x1002e00e
cmp esi, 0x22
je 0x1002e00e
lea eax, [esi - 0x31]
cmp eax, 8
ja 0x1002e04f
mov ebx, 1
jmp 0x1002e251
movzx ebx, byte [esi + 0x10196f38]
test ebx, ebx
jne 0x1002e251
mov ecx, edi
call fcn.100380d0
mov ecx, edi
call fcn.10038e10
mov ecx, dword [edi + 0xf8]
mov eax, dword [ecx]
call dword [eax + 0x20]
mov ecx, dword [edi + 0x1b8]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [edi + 0x1b8]
mov eax, dword [ecx]
call dword [eax + 0x2c]
mov ecx, dword [edi + 0x1b8]
mov eax, dword [ecx]
call dword [eax + 0x28]
jmp 0x1002e251
mov ecx, dword [edi + 0x1b4]
push 0x81
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
jne 0x1002df55
lea eax, [edi + 0xc4]
push 0x10199b78
push eax
call fcn.100112d0
add esp, 8
test al, al
je 0x1002e0d9
mov eax, dword [edi + 0x98]
mov dword [edi + 0x9c], eax
cmp dword [edi + 0x9c], ebx
jne 0x1002e0f1
push 0x10199228
lea ecx, [edi + 0xc4]
call fcn.100044a0
cmp esi, 0x25
je 0x1002e10a
cmp esi, 0x26
je 0x1002e10a
cmp esi, 0x28
je 0x1002e10a
cmp esi, 0x27
je 0x1002e10a
cmp esi, 0x20
jne 0x1002e12a
push 0x10199228
lea ecx, [edi + 0xc4]
mov dword [edi + 0x9c], ebx
mov dword [edi + 0x98], 1
call fcn.100044a0
cmp esi, 0x60
jb 0x1002e134
cmp esi, 0x69
jbe 0x1002e140
lea eax, [esi - 0x30]
cmp eax, 9
ja 0x1002e1d7
mov dword [edi + 0x98], 1
cmp dword [edi + 0x9c], ebx
je 0x1002e1f5
lea eax, [edi + 0xc4]
push 0x10199b78
push eax
call fcn.10011630
add esp, 8
test al, al
je 0x1002e1f5
mov ecx, dword [edi + 0x1b4]
push 0x52
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x1002e1f5
cmp byte [edi + 0x19c], bl
jne 0x1002e1f5
cmp esi, 0x60
jb 0x1002e192
sub esi, 0x30
xor eax, eax
push 0x206
push eax
mov word [esp + 0x28], ax
lea eax, [esp + 0x2a]
push eax
call fcn.10098090
add esp, 0xc
lea eax, [esp + 0x20]
push esi
push 0x10199b7c
push eax
call fcn.10091da4
add esp, 0xc
push esi
call fcn.10038d40
push 0x10199228
lea ecx, [edi + 0xc4]
call fcn.100044a0
jmp 0x1002e1f5
lea eax, [edi + 0xc4]
push 0x10199b78
push eax
call fcn.10011630
add esp, 8
test al, al
je 0x1002e1f5
mov dword [edi + 0x9c], ebx
mov eax, dword [ebp + 0x10]
test byte [eax + 0x10], 0x80
je 0x1002e238
cmp dword [esp + 0x18], ebx
jne 0x1002e251
lea eax, [esi - 0x30]
cmp eax, 0x4a
jbe 0x1002e22f
lea eax, [esi - 0xbf]
cmp eax, 0x1f
jbe 0x1002e22f
cmp esi, 0xba
je 0x1002e22f
cmp esi, 0xbb
je 0x1002e22f
cmp esi, 0xbd
jne 0x1002e24a
movzx ebx, byte [esi + 0x10198ab0]
jmp 0x1002e251
mov ecx, dword [edi + 0x1b4]
push 0x7c
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp eax, 1
je 0x1002e204
movzx ebx, byte [esi + 0x10196f38]
mov ecx, dword [edi + 0x1b4]
push 0x48
mov eax, dword [ecx]
call dword [eax]
test eax, eax
je 0x1002e26b
cmp esi, 0x20
jne 0x1002e26b
lea ebx, [esi - 0x1f]
jmp 0x1002e270
cmp esi, 0x10
je 0x1002e285
mov eax, dword [ebp + 0x10]
test byte [eax + 0x10], 0x80
je 0x1002e288
mov dword [edi + 0x8c], 1
jmp 0x1002e288
mov eax, dword [ebp + 0x10]
cmp esi, 0x11
je 0x1002e29d
test byte [eax + 0x11], 0x80
je 0x1002e29d
mov dword [edi + 0x90], 1
push esi
push ecx
push dword [edi + 0x90]
mov ecx, edi
call fcn.1002e4f0
test eax, eax
jne 0x1002d8b4
cmp esi, 0x20
jne 0x1002e2dd
test ebx, ebx
jne 0x1002dfc9
cmp dword [esp + 0xc], ebx
jne 0x1002e2e5
mov ecx, dword [edi + 0x1b4]
push 0x7c
mov eax, dword [ecx]
call dword [eax + 0x44]
test eax, eax
je 0x1002e2e5
jmp 0x1002dfc9
test ebx, ebx
jne 0x1002dfc9
push 1
mov ecx, edi
call fcn.100393c0
cmp dword [esp + 0x10], 0
jne 0x1002e303
cmp eax, 0x27
je 0x1002e303
cmp eax, 0x25
jne 0x1002d8b4
mov ecx, edi
call fcn.10038da0
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1009174c
mov esp, ebp
pop ebp
ret 0xc