Function at 0x10109820
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1010992b
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1010992b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x40]
call eax
test eax, eax
je 0x1010992b
mov ecx, esi
call fcn.101030a0
test al, al
je 0x1010992b
mov eax, dword [ebp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
push eax
call esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
shr eax, 0xf
and eax, 0xffffff01
shr ecx, 1
mov dword [esp + 8], eax
and cl, 1
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x18], eax
mov dword [edx + 0x30], edi
mov byte [edi + 0x1c], cl
mov ecx, dword [ebp + 0x18]
mov al, cl
and al, 1
mov dword [edi + 0xc], edx
mov byte [edi + 0x1e], al
mov eax, ecx
shr eax, 2
and al, 1
mov byte [edi + 0x23], al
mov eax, ecx
shr eax, 3
and al, 1
mov byte [edi + 0x24], al
mov eax, ecx
shr eax, 4
and al, 1
mov byte [edi + 0x25], al
mov eax, ecx
shr eax, 5
and al, 1
mov byte [edi + 0x26], al
mov eax, ecx
shr eax, 8
and al, 1
push 1
mov byte [edi + 0x27], al
call esi
mov esi, dword [ebp + 8]
shr eax, 0xf
and al, 1
mov byte [edi + 0x1d], al
mov byte [esi + 0x79], 0
mov eax, dword [edi + 0xc]
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10109918
cmp byte [edi + 0x23], 0
jne 0x10109918
mov eax, dword [edi + 0xc]
push 0
push 0
push 0x211
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
mov ecx, edi
call fcn.1010ba20
test al, al
jne 0x10109935
mov ecx, esi
call fcn.10103290
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp byte [edi + 0x23], 0
mov eax, dword [esp + 8]
mov byte [edi + 0x1f], al
mov byte [edi + 0x1d], al
jne 0x1010996f
mov eax, dword [edi + 0xc]
push 0
push dword [esi + 0x20]
push 0x117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
push eax
push 0
push 0x2117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push 0x10
push dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1010999d
mov eax, dword [ebp + 0x1c]
movups xmm0, xmmword [eax]
jmp 0x101099a0
xorps xmm0, xmm0
movups xmmword [esi + 0xc4], xmm0
movzx eax, byte [edi + 0x26]
mov ecx, esi
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10102f30
mov ecx, dword [ebp + 0x18]
mov eax, ecx
shr eax, 7
and al, 1
shr ecx, 6
movzx eax, al
and cl, 1
push eax
movzx eax, cl
push eax
push dword [ebp + 0x1c]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.1010a980
push 0x250
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x20]
push dword [esp + 0x20]
push 0xffffffffffffffff
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.10102ee0
push ecx
mov ecx, edi
call fcn.1010baa0
cmp byte [edi + 0x2b], 0
jne 0x1010992b
mov ecx, esi
call fcn.10102f10
push esi
mov ecx, edi
call fcn.1010a6d0
mov ecx, esi
call fcn.10103290
cmp byte [edi + 0x1e], 0
je 0x1010992b
mov eax, dword [edi + 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18