Function at 0x1001b420
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [0x1008acb8], 0
push ebx
push esi
push edi
jne 0x1001b6b8
push dword [0x1008b67c]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call edi
cmp byte [0x1008b668], 0
je 0x1001b506
test ax, ax
je 0x1001b506
mov ebx, dword [0x1008b878]
mov eax, ebx
mov ecx, dword [0x100c1354]
mov dword [esp + 0x10], eax
test ecx, ecx
jne 0x1001b4ae
mov edx, 0xe80c2f78
mov ecx, 0x10079bb9
call fcn.1000b060
mov edx, 0xc10bf213
mov ecx, 0x10077f85
mov esi, eax
call fcn.1000b060
mov edx, esi
mov ecx, eax
call fcn.1006eeb0
mov ebx, dword [0x1008b878]
mov ecx, eax
mov eax, dword [esp + 0x10]
mov dword [0x100c1354], ecx
test byte [ecx + eax], 1
je 0x1001b4c4
test byte [0x1008aca8], 1
jne 0x1001b4c4
mov eax, dword [ebp + 8]
or dword [eax + 0x30], 4
test ecx, ecx
jne 0x1001b4f9
mov edx, 0xe80c2f78
mov ecx, 0x10079bb9
call fcn.1000b060
mov edx, 0xc10bf213
mov ecx, 0x10077f85
mov esi, eax
call fcn.1000b060
mov edx, esi
mov ecx, eax
call fcn.1006eeb0
mov ecx, eax
mov dword [0x100c1354], ecx
test byte [ecx + ebx], 1
je 0x1001b506
mov eax, dword [ebp + 8]
and dword [eax + 0x30], 0xfffffffd
push dword [0x1008b66c]
lea eax, [ebp + 8]
mov dword [esp + 0x14], 0x1008abb8
mov dword [esp + 0x18], eax
call edi
sub esp, 8
lea ecx, [esp + 0x18]
call fcn.1001b6d0
push 0
call edi
test ax, ax
je 0x1001b592
cmp byte [0x1008b6d0], 0
je 0x1001b592
mov eax, dword [0x100c1354]
mov ebx, dword [0x1008b878]
test eax, eax
jne 0x1001b578
mov edx, 0xe80c2f78
mov ecx, 0x10079bb9
call fcn.1000b060
mov edx, 0xc10bf213
mov ecx, 0x10077f85
mov esi, eax
call fcn.1000b060
mov edx, esi
mov ecx, eax
call fcn.1006eeb0
mov dword [0x100c1354], eax
test byte [eax + ebx], 1
jne 0x1001b58b
test byte [0x1008aca8], 1
je 0x1001b58b
mov al, 1
jmp 0x1001b58d
xor al, al
mov byte [0x1008acbf], al
push dword [0x1008b67c]
call edi
test ax, ax
je 0x1001b6b1
cmp byte [0x1008b668], 0
je 0x1001b6b1
mov eax, dword [0x100c11e0]
mov edi, dword [0x1008b878]
mov ebx, edi
test eax, eax
jne 0x1001b5f5
mov edx, 0xe80c2f78
mov ecx, 0x100781bd
call fcn.1000b060
mov edx, 0xc10bf213
mov ecx, 0x10077f91
mov esi, eax
call fcn.1000b060
mov edx, esi
mov ecx, eax
call fcn.1006eeb0
mov edi, dword [0x1008b878]
mov dword [0x100c11e0], eax
movss xmm0, dword [eax + ebx + 8]
comiss xmm0, dword [0x1008acb4]
jbe 0x1001b6b1
test byte [0x1008aca8], 1
jne 0x1001b6b1
mov eax, dword [0x100c1354]
mov ebx, edi
test eax, eax
jne 0x1001b654
mov edx, 0xe80c2f78
mov ecx, 0x10079bb9
call fcn.1000b060
mov edx, 0xc10bf213
mov ecx, 0x10077f85
mov esi, eax
call fcn.1000b060
mov edx, esi
mov ecx, eax
call fcn.1006eeb0
mov edi, dword [0x1008b878]
mov dword [0x100c1354], eax
test byte [eax + ebx], 1
jne 0x1001b6b1
test dword [0x1008aca8], 0x40000
jne 0x1001b6b1
test eax, eax
jne 0x1001b698
mov edx, 0xe80c2f78
mov ecx, 0x10079bb9
call fcn.1000b060
mov edx, 0xc10bf213
mov ecx, 0x10077f85
mov esi, eax
call fcn.1000b060
mov edx, esi
mov ecx, eax
call fcn.1006eeb0
mov dword [0x100c1354], eax
test dword [eax + edi], 0x40000
jne 0x1001b6b1
mov al, 1
mov byte [0x1008acbe], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor al, al
mov byte [0x1008acbe], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4