Function at 0x1000e017
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1009fb5d
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x100c50e4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2c], esi
lea eax, [ecx - 0x200]
cmp eax, 0xa3
ja case.0x1000e010.515
movzx eax, byte [eax + 0x1000e4e4]
jmp dword [eax*4 + 0x1000e4c8]
mov eax, dword [edi + 0xc4]
push eax
mov dword [ebp - 0x34], eax
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x1000e042
push 0
push 1
push 0x15
push eax
call dword [sym.imp.IMM32.dll_ImmNotifyIME]
push dword [edi + 0xc4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi]
push 0x12
mov eax, dword [eax + 0xb8]
mov dword [ebp - 0x24], eax
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0xc]
movsx edi, ax
mov eax, ecx
shr edi, 0x1f
shr eax, 3
add edi, edi
and eax, 1
shr ecx, 2
or edi, eax
and ecx, 1
add edi, edi
or edi, ecx
call dword [sym.imp.USER32.dll_GetMessageTime]
mov esi, eax
mov eax, dword [ebp - 0x2c]
mov ecx, eax
movsx edx, ax
shr ecx, 0x10
movsx ecx, cx
push ecx
lea ecx, [ebp - 0x4c]
call fcn.1000a9f0
movups xmm0, xmmword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
add esp, 4
push edi
push esi
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
test eax, eax
je case.0x1000e010.515
push eax
push dword [ebp - 0x34]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
jmp case.0x1000e010.515
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0xc]
movsx edi, ax
mov eax, ecx
shr edi, 0x1f
shr eax, 3
add edi, edi
and eax, 1
shr ecx, 2
or edi, eax
and ecx, 1
add edi, edi
or edi, ecx
call dword [sym.imp.USER32.dll_GetMessageTime]
mov esi, eax
mov eax, dword [ebp - 0x2c]
mov ecx, eax
movsx edx, ax
shr ecx, 0x10
movsx ecx, cx
push ecx
lea ecx, [ebp - 0x4c]
call fcn.1000a9f0
movups xmm0, xmmword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
add esp, 4
push edi
push esi
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.10053b50
jmp case.0x1000e010.515
push dword [edi + 0xc4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, esi
lea ecx, [ebp - 0x4c]
shr eax, 0x10
cwde
movsx esi, si
push eax
mov edx, esi
mov dword [ebp - 0x24], eax
call fcn.1000a9f0
movups xmm0, xmmword [ebp - 0x4c]
sub esp, 0xc
mov ecx, edi
mov eax, esp
movups xmmword [eax], xmm0
call fcn.10051bf0
test al, al
jne 0x1000e1a7
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x98]
push dword [ebp - 0x24]
mov edx, esi
lea ecx, [ebp - 0x3c]
call fcn.1000a9f0
movups xmm0, xmmword [ebp - 0x3c]
add esp, 4
mov ecx, edi
push 0
push 0
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call fcn.10043120
push eax
mov ecx, edi
call fcn.10044250
mov eax, dword [edi]
push 0x12
mov edi, dword [eax + 0xbc]
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0xc]
movsx esi, ax
mov eax, ecx
shr esi, 0x1f
shr eax, 3
add esi, esi
and eax, 1
shr ecx, 2
or esi, eax
and ecx, 1
add esi, esi
or esi, ecx
call dword [sym.imp.USER32.dll_GetMessageTime]
movups xmm0, xmmword [ebp - 0x4c]
mov ecx, dword [ebp - 0x28]
push esi
push eax
sub esp, 0x10
mov eax, esp
movups xmmword [eax], xmm0
call edi
jmp case.0x1000e010.515
mov eax, esi
movsx edx, si
shr eax, 0x10
lea ecx, [ebp - 0x4c]
cwde
push eax
mov byte [edi + 0x63c], 0
call fcn.1000a9f0
movsd xmm0, qword [edi + 0x3c0]
add esp, 4
ucomisd xmm0, qword [ebp - 0x4c]
lahf
test ah, 0x44
jp 0x1000e23a
movsd xmm0, qword [edi + 0x3c8]
ucomisd xmm0, qword [ebp - 0x44]
lahf
test ah, 0x44
jnp case.0x1000e010.515
cmp byte [edi + 0x635], 0
jne 0x1000e26b
mov eax, dword [edi + 0xc4]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x10
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x30], 0xffffffff
call dword [sym.imp.USER32.dll_TrackMouseEvent]
push 0x12
mov byte [edi + 0x635], 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp + 0xc]
movsx esi, ax
mov eax, ecx
shr esi, 0x1f
shr eax, 3
add esi, esi
and eax, 1
shr ecx, 2
or esi, eax
and ecx, 1
add esi, esi
or esi, ecx
call dword [sym.imp.USER32.dll_GetMessageTime]
movups xmm0, xmmword [ebp - 0x4c]
push esi
sub esp, 0x14
mov ecx, edi
mov eax, esp
movups xmmword [eax], xmm0
call fcn.10053510
jmp case.0x1000e010.515
mov ecx, edi
mov byte [edi + 0x635], 0
call fcn.10052540
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0xc4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x1000e3d7
cmp byte [edi + 0x335], 0
jne 0x1000e313
lea eax, [ebp - 0x20]
push eax
push dword [edi + 0xc4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, esi
movsx ecx, si
shr eax, 0x10
cwde
push eax
push ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x1000e2c6
mov ecx, dword [ebp + 8]
cmp byte [edi + 0x4ec], 0
je 0x1000e335
mov eax, dword [edi + 0x538]
push esi
push dword [ebp + 0xc]
push ecx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp case.0x1000e010.515
mov eax, dword [ebp + 0xc]
cmp ecx, 0x20e
je 0x1000e40e
test al, 4
jne 0x1000e40e
mov esi, dword [edi + 0x644]
test esi, esi
je case.0x1000e010.515
shr eax, 0x10
cwde
sub dword [edi + 0x64c], eax
mov eax, dword [edi + 0x64c]
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl case.0x1000e010.515
cmp esi, 0xffffffff
jne 0x1000e38b
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0xc]
call eax
mov esi, eax
mov eax, 1
sub esi, 1
cmove esi, eax
mov ecx, dword [edi + 0x64c]
mov eax, ecx
cdq
mov dword [ebp - 0x24], 0x78
idiv dword [ebp - 0x24]
mov eax, 0x88888889
mov dword [edi + 0x64c], edx
imul ecx
add edx, ecx
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, esi
test byte [ebp + 0xc], 8
je 0x1000e3fb
mov eax, dword [edi]
test ecx, ecx
mov ecx, edi
mov eax, dword [eax + 0x9c]
jns 0x1000e3f4
push 0x91d
call eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10083210
mov esp, ebp
pop ebp
ret 0xc
push 0x91e
jmp 0x1000e3d3
mov eax, dword [edi + 0x410]
push ecx
add eax, ecx
mov ecx, edi
push eax
call fcn.10044f90
jmp case.0x1000e010.515
cmp dword [edi + 0x258], 0
jne 0x1000e4b4
cmp dword [edi + 0x648], 0
je 0x1000e4b4
xor edx, edx
cmp ecx, 0x20e
sete dl
shr eax, 0x10
cwde
lea edx, [edx*4 + 0x64c]
add edx, edi
mov dword [ebp - 0x24], edx
mov esi, dword [edx]
sub esi, eax
mov dword [edx], esi
mov eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x78
jl case.0x1000e010.515
mov eax, 0x88888889
sub esp, 8
imul esi
add edx, esi
sar edx, 6
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
shl eax, 4
sub eax, ecx
shl eax, 3
sub esi, eax
mov eax, dword [ebp - 0x24]
mov dword [eax], esi
mov eax, dword [edi + 0x648]
imul eax, ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, qword [edi + 0x140]
movsd qword [esp], xmm0
call fcn.10090466
mov ecx, dword [edi + 8]
add esp, 8
add ecx, eax
push ecx
mov ecx, edi
call fcn.10010f30
jmp case.0x1000e010.515
push esi
push eax
push ecx
push dword [edi + 0xc4]
call dword [sym.imp.USER32.dll_DefWindowProcW]
jmp 0x1000e3d7