Function at 0x10091d1
Capabilities:
Log keystrokes
Log keystrokes via polling
Manipulate console buffer

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
test byte [esi + 0x54], 8
mov eax, dword [esi + 4]
mov ebx, dword [eax + 0x16cc]
push edi
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], ebx
mov dword [esi + 0x4c], 0x64
je 0x10092e8
mov ecx, dword [eax + 0x16c8]
sub ecx, eax
cmp byte [eax + 0x3ff6], 0
lea edi, [eax + 0x12c8]
lea ebx, [ebx + ecx - 0x12c8]
je 0x1009237
cmp word [edi], 1
jne 0x1009237
cmp dword [edi + 4], 0
je 0x1009237
cmp byte [edi + 0xe], 0
je 0x1009237
push edi
mov ecx, esi
call fcn.01008307
cmp byte [edi + 0xe], 0xd
je 0x1009241
and dword [esi + 0x40], 0
cmp word [edi], 1
jne 0x1009282
cmp byte [edi + 0xe], 3
jne 0x1009282
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test byte [ebp - 8], 1
je 0x100926a
cmp dword [edi + 4], 0
jne 0x1009271
cmp word [edi + 0xa], 3
jne 0x1009282
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
push 0x14
xor edx, edx
mov eax, ebx
pop ecx
div ecx
test edx, edx
mov dword [ebp - 8], edx
je 0x1009294
sub ebx, edx
lea eax, [ebp - 0x14]
push eax
push 0x14
pop ecx
xor edx, edx
mov eax, ebx
div ecx
push eax
push edi
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
je 0x1009421
mov edi, dword [ebp - 8]
test edi, edi
jbe 0x10092d6
mov eax, dword [esi + 4]
lea ecx, [eax + ebx + 0x12c8]
push edi
push ecx
add eax, 0x12c8
push eax
call dword [sym.imp.msvcrt.dll_memmove]
add esp, 0xc
mov esi, dword [esi + 4]
lea eax, [esi + edi + 0x12c8]
mov dword [esi + 0x16c8], eax
jmp 0x100927b
xor ecx, ecx
inc ecx
cmp ebx, ecx
mov dword [esi + 0x40], ecx
jne 0x10092ff
cmp byte [eax + 0x12c8], 0xd
je 0x10092ff
and dword [esi + 0x40], 0
xor edi, edi
test ebx, ebx
jbe 0x100927b
cmp ebx, 1
sete byte [ebp - 0xc]
mov eax, dword [esi + 4]
cmp byte [eax + 0x3ff6], 0
je 0x100932c
movsx eax, byte [eax + edi + 0x12c8]
push eax
mov ecx, esi
call fcn.01008362
push dword [ebp - 0xc]
lea eax, [ebp - 1]
push eax
mov eax, dword [esi + 4]
movzx eax, byte [edi + eax + 0x12c8]
push eax
mov ecx, esi
call fcn.01007719
test al, al
je 0x1009353
and dword [esi + 0x40], 0
jmp 0x1009413
cmp byte [ebp - 1], 0xd
jne 0x100936a
mov eax, dword [esi + 4]
cmp byte [edi + eax + 0x12c8], 0xa
je 0x1009406
mov eax, dword [esi + 4]
cmp byte [edi + eax + 0x12c8], 3
jne 0x100939a
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push dword [esi + 0x58]
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test byte [ebp - 8], 1
je 0x100939a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
jmp 0x1009413
mov eax, dword [esi + 4]
movzx ax, byte [edi + eax + 0x12c8]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
movsx ebx, ax
cmp ebx, 0xffff
mov dword [ebp - 8], eax
je 0x1009403
movzx eax, al
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
shr ebx, 8
xor ecx, ecx
test bl, 1
je 0x10093d4
push 0x10
pop ecx
test bl, 2
je 0x10093dc
or ecx, 8
test bl, 4
je 0x10093e4
or ecx, 2
push ecx
mov ecx, dword [esi + 4]
movsx ecx, byte [edi + ecx + 0x12c8]
push ecx
push eax
movzx ax, byte [ebp - 8]
mov ecx, esi
push eax
call fcn.0100768c
test eax, eax
je 0x1009421
mov ebx, dword [ebp - 0x10]
mov eax, dword [esi + 4]
mov al, byte [edi + eax + 0x12c8]
mov byte [ebp - 1], al
inc edi
cmp edi, ebx
jb 0x1009310
jmp 0x100927b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xc0000fbe
push 1
call fcn.0100d50f
xor al, al
jmp 0x100927d