Function at 0x102fe980
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x118], eax
cmp dword [ebp + 0x10], 0
jne 0x102fe9c3
cmp dword [ebp + 8], 0x14
je 0x102fe9c3
cmp dword [ebp + 8], 0x91
je 0x102fe9c3
cmp dword [ebp + 8], 0x90
jne 0x102fe9c8
jmp 0x102feb82
push 2
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
cmp eax, 0x7fff
jbe 0x102fe9e5
mov eax, 0xff20
jmp 0x102fec1a
push 0x100
push 0
lea edx, [ebp - 0x110]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0xc]
and eax, 1
je 0x102fea0a
mov byte [ebp - 0x100], 0x80
mov ecx, dword [ebp + 0xc]
and ecx, 4
je 0x102fea19
mov byte [ebp - 0xff], 0x80
mov edx, dword [ebp + 0xc]
and edx, 0x10
je 0x102fea28
mov byte [ebp - 0xfe], 0x80
mov eax, dword [ebp + 0xc]
and eax, 2
je 0x102fea37
mov byte [ebp - 0xfc], 1
mov ecx, dword [ebp + 0xc]
and ecx, 0x20
je 0x102fea43
mov byte [ebp - 0x7f], 1
mov edx, dword [ebp + 0xc]
and edx, 8
je 0x102fea4f
mov byte [ebp - 0x80], 1
push 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ToAscii]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jge 0x102feaa4
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp - 0x118]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_ToAscii]
mov eax, 0xff20
jmp 0x102fec1a
cmp dword [ebp - 0x114], 2
jne 0x102feb5e
movzx edx, byte [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_VkKeyScanA]
cwde
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sar ecx, 8
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 8]
and edx, 0xff
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x118], eax
push 0x100
push 0
lea ecx, [ebp - 0x110]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x11c]
and edx, 1
je 0x102feb12
mov byte [ebp - 0x100], 0x80
mov eax, dword [ebp - 0x11c]
and eax, 2
je 0x102feb24
mov byte [ebp - 0xff], 0x80
mov ecx, dword [ebp - 0x11c]
and ecx, 4
je 0x102feb36
mov byte [ebp - 0xfe], 0x80
push 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_ToAscii]
mov eax, 0xff20
jmp 0x102fec1a
cmp dword [ebp - 0x114], 1
jne 0x102feb82
movzx eax, byte [ebp - 4]
cmp eax, 0x20
jl 0x102feb82
movzx ecx, byte [ebp - 4]
cmp ecx, 0x7f
je 0x102feb82
movzx eax, byte [ebp - 4]
jmp 0x102fec1a
cmp dword [ebp + 8], 0x91
jbe 0x102feb92
xor eax, eax
jmp 0x102fec1a
mov edx, dword [ebp + 8]
mov dword [ebp - 0x120], edx
cmp dword [ebp - 0x120], 0x10
je 0x102febd4
cmp dword [ebp - 0x120], 0x11
je 0x102febb8
cmp dword [ebp - 0x120], 0x12
je 0x102febf3
jmp 0x102fec10
push 0xa3
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
je 0x102febd2
mov eax, 0xffe4
jmp 0x102fec1a
jmp 0x102fec10
push 0xa1
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
je 0x102febf1
mov eax, 0xffe2
jmp 0x102fec1a
jmp 0x102fec10
push 0xa5
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x80
je 0x102fec10
mov eax, 0xffea
jmp 0x102fec1a
mov eax, dword [ebp + 8]
mov eax, dword [eax*4 + 0x1034f0c8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.1022118e
mov esp, ebp
pop ebp
ret