Function at 0x10078cea
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
sub esp, 0x100
lea ebp, [esp - 4]
mov eax, dword [0x100fd640]
xor eax, ebp
mov dword [ebp + 0x100], eax
push 0x10
mov eax, 0x100b696b
call fcn.100b4d3e
mov edi, dword [ebp + 0x10c]
mov esi, dword [ebp + 0x118]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
test byte [0x100ffc04], bl
jne 0x10078d64
or dword [0x100ffc04], ebx
fld dword [0x100ca0e8]
and dword [ebp - 4], 0
push ecx
fstp dword [esp]
push 0x1d
push 0
push str.VKEY_translations
mov ecx, 0x100ffbcc
call fcn.1002f962
push 0x100b9c6a
call fcn.100afef1
or dword [ebp - 4], 0xffffffff
pop ecx
test byte [0x100ffc04], 2
jne 0x10078da3
or dword [0x100ffc04], 2
fld dword [0x100ca0e8]
push ecx
fstp dword [esp]
push 0x1d
push 0
push str.Dead_Key_Flags
mov ecx, 0x100ffb94
mov dword [ebp - 4], ebx
call fcn.1002f962
push 0x100b9c60
call fcn.100afef1
or dword [ebp - 4], 0xffffffff
pop ecx
and dword [esi], 0
cmp dword [ebp + 0x114], ebx
jne 0x10078dd4
push edi
mov ecx, 0x100ffb94
call fcn.1002fb48
push edi
mov ecx, 0x100ffbcc
mov esi, eax
call fcn.1002fb48
test eax, eax
je 0x10078dd4
mov ecx, dword [ebp - 0x14]
mov dword [ecx], esi
jmp 0x10078f6f
cmp edi, 0xd
jne 0x10078de1
push 0xa
pop eax
jmp 0x10078f6f
lea eax, [ebp]
push eax
call fcn.100a3fb0
mov eax, dword [ebp + 0x110]
xor esi, esi
pop ecx
test eax, eax
je 0x10078e8c
mov esi, eax
mov edx, eax
mov ecx, eax
and esi, 0x40
and edx, 0x200
and ecx, 0x80
test eax, 0x2000
je 0x10078e1b
mov edx, ebx
mov ecx, ebx
test esi, esi
je 0x10078e23
or byte [ebp + 0x10], 0x80
push edi
call fcn.1007498d
add esp, 4
test eax, eax
je 0x10078e34
and byte [ebp + 0x12], 0x7f
test ecx, ecx
je 0x10078e8c
test edx, edx
jne 0x10078e48
and byte [ebp + 0x11], 0x7f
lea eax, [edi - 0x41]
cmp eax, 0x19
ja 0x10078e4e
or byte [ebp + 0x11], 0x80
jmp 0x10078e8c
push 0x1b
pop edi
push edi
call dword [sym.imp.USER32.dll_VkKeyScanW]
movzx eax, ax
movzx ecx, al
cmp dword [ebp - 0x10], ecx
je 0x10078e6c
inc edi
cmp di, 0x20
jb 0x10078e51
jmp 0x10078e89
shr eax, 8
movzx eax, al
test al, 2
jne 0x10078e85
not eax
xor ecx, ecx
and eax, ebx
test esi, esi
sete cl
cmp eax, ecx
jne 0x10078e89
or byte [ebp + 0x11], 0x80
mov edi, dword [ebp - 0x10]
push dword [0x100ffb50]
push 2
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
test eax, eax
jns 0x10078eaf
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0xa8], ebx
mov eax, dword [ebp - 0x14]
mov dword [eax], ebx
jmp 0x10078ef2
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0xa8], 0
je 0x10078ecd
test esi, esi
jne 0x10078ec7
push eax
call dword [sym.imp.MSVCR100.dll_tolower]
pop ecx
mov word [ebp - 0x18], ax
jmp 0x10078ef2
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push dword [0x100ffb50]
lea ecx, [ebp - 0x18]
push 0
push 2
push ecx
lea ecx, [ebp]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov ebx, eax
xor eax, eax
cmp ebx, 2
sete al
mov dword [ebp - 0x10], eax
test ebx, ebx
js 0x10078f24
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jne 0x10078f24
test ebx, ebx
jne 0x10078f2b
cmp edi, 0x2e
jne 0x10078f17
push 0x7f
pop esi
jmp 0x10078f34
lea eax, [edi - 0x60]
cmp eax, 9
ja 0x10078f24
lea esi, [edi - 0x30]
jmp 0x10078f34
mov esi, 0xffff
jmp 0x10078f34
movzx esi, word [ebp - 0x18]
jg 0x10078f34
mov esi, dword [ebp - 0x1c]
cmp dword [ebp + 0x114], 2
jne 0x10078f65
push esi
push edi
mov ecx, 0x100ffbcc
call fcn.1002faa0
cmp dword [ebp - 0x10], 0
mov ecx, 0x100ffb94
je 0x10078f5f
push dword [ebp - 0x10]
push edi
call fcn.1002faa0
jmp 0x10078f65
push edi
call fcn.1002fb48
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x100]
xor ecx, ebp
call fcn.100b4c22
add ebp, 0x104
leave
ret 0x10