Function at 0x1001fab8
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x10068510]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 0x50
mov eax, 0x10052a80
call fcn.10037f59
xor edi, edi
mov byte [ebp - 0x1d], 0
mov dword [ebp - 4], edi
xor esi, esi
mov dword [ebp - 0x44], esi
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], edi
cmp dword [0x1006a458], edi
je 0x1001fbe4
cmp byte [0x10069c45], bl
je 0x1001fb4d
mov dword [ebp - 0x40], 1
mov esi, dword [0x10069c18]
mov dword [ebp - 0x44], esi
mov ebx, dword [0x10069c1c]
mov dword [ebp - 0x30], ebx
mov eax, dword [0x10069c20]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x10069c24]
mov dword [ebp - 0x28], eax
mov eax, dword [0x10069c28]
mov dword [ebp - 0x24], eax
mov eax, dword [0x10069c2c]
jmp 0x1001fd1e
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x14]
call fcn.10005ad2
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
push 0x10056838
push 4
push edi
push 0x10056858
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jne 0x1001fbc9
mov eax, dword [ebp - 0x14]
cmp eax, edi
je 0x1001fbc9
mov dword [ebp - 0x34], edi
mov ecx, dword [eax]
lea edx, [ebp - 0x34]
push edx
push eax
call dword [ecx + 0x3c]
cmp eax, edi
jne 0x1001fbc9
xor ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x34]
mov esi, eax
and esi, ecx
mov dword [ebp - 0x44], esi
mov ebx, eax
and ebx, 2
mov dword [ebp - 0x30], ebx
mov ecx, eax
and ecx, 8
mov dword [ebp - 0x2c], ecx
mov ecx, eax
and ecx, 4
mov dword [ebp - 0x28], ecx
mov ecx, eax
and ecx, 0x10
mov dword [ebp - 0x24], ecx
and eax, 0x20
mov dword [ebp - 0x38], eax
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1001e586
cmp dword [ebp - 0x40], edi
jne 0x1001fd21
cmp dword [0x10069bcc], edi
jne 0x1001fc15
push 0x10069bcc
push 1
push edi
push str.SoftwareDownloadManagerSpecialKeys
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001fc15
mov dword [0x10069bcc], edi
xor al, al
jmp 0x1001ff0c
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.UseKeyToForce
push dword [0x10069bcc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
test eax, eax
jne 0x1001fc45
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x44], esi
test esi, esi
je 0x1001ff05
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.AltF
push dword [0x10069bcc]
call edi
test eax, eax
jne 0x1001fc77
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.CtrlF
push dword [0x10069bcc]
call edi
test eax, eax
jne 0x1001fca1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.ShiftF
push dword [0x10069bcc]
call edi
test eax, eax
jne 0x1001fccb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.InsF
push dword [0x10069bcc]
call edi
test eax, eax
jne 0x1001fcf5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push str.CheckMouse
push dword [0x10069bcc]
call edi
xor edi, edi
test eax, eax
jne 0x1001fd21
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
cmp esi, edi
je 0x1001ff05
cmp ebx, edi
jne 0x1001fd40
cmp dword [ebp - 0x2c], edi
jne 0x1001fd40
cmp dword [ebp - 0x28], edi
jne 0x1001fd40
cmp dword [ebp - 0x24], edi
je 0x1001ff05
mov byte [ebp - 0x1d], 1
and dword [ebp - 0x18], 0
push 0x11
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
call esi
mov edi, 0x8000
and eax, edi
mov dword [ebp - 0x1c], eax
push 0x12
call esi
movzx ebx, ax
and ebx, edi
push 0x10
call esi
and eax, edi
mov dword [ebp - 0x34], eax
push 0x2d
call esi
movzx eax, ax
mov esi, eax
and esi, edi
mov dword [ebp - 0x48], esi
xor edi, edi
test eax, 0xf000
je 0x1001fe16
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x14]
call fcn.10005ad2
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push eax
push 0x10056838
push 4
push edi
push 0x10056858
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, edi
jne 0x1001fe04
cmp dword [ebp - 0x14], edi
je 0x1001fe04
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push str.InsState
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
je 0x1001fe02
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x5c]
push edx
push edi
push eax
call dword [ecx + 0x58]
test eax, eax
jne 0x1001fdfb
cmp word [ebp - 0x5c], 0x11
jne 0x1001fdfb
cmp byte [ebp - 0x54], 2
jne 0x1001fdfb
xor esi, esi
mov dword [ebp - 0x48], esi
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor edi, edi
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.1001e586
cmp dword [ebp - 0x30], edi
je 0x1001fe2a
cmp ebx, edi
je 0x1001fc0e
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x28], edi
je 0x1001fe3b
cmp dword [ebp - 0x34], edi
je 0x1001fc0e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x2c], edi
je 0x1001fe4c
cmp dword [ebp - 0x1c], edi
je 0x1001fc0e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x24], edi
je 0x1001fe5c
cmp esi, edi
je 0x1001fc0e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jne 0x1001fee1
push 0x100
push edi
lea eax, [ebp]
push eax
call fcn.100388b0
add esp, 0xc
lea eax, [ebp]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1001feb2
mov dword [ebp - 0x3c], edi
push 0x20
pop eax
mov dword [ebp - 0x4c], eax
cmp eax, 0x88
jge 0x1001fea9
test byte [ebp + eax], 0x80
je 0x1001fea6
cmp dword [ebp - 0x24], edi
je 0x1001fea3
cmp eax, 0x2d
je 0x1001fea6
inc dword [ebp - 0x3c]
inc eax
jmp 0x1001fe88
cmp dword [ebp - 0x3c], edi
jne 0x1001fc0e
mov dword [ebp - 0x18], edi
cmp ebx, edi
je 0x1001fec0
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x34], edi
je 0x1001fec8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x1c], edi
je 0x1001fed0
inc dword [ebp - 0x18]
cmp esi, edi
je 0x1001fed7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jne 0x1001fc0e
cmp dword [ebp - 0x38], edi
je 0x1001ff05
push dword [ebp - 0x38]
push dword [ebp - 0x24]
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
push dword [ebp - 0x30]
call fcn.1001d800
add esp, 0x14
test eax, eax
je 0x1001fc0e
or dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x1d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.10037f17
add ebp, 0x104
leave
ret