Function at 0x10001cfd
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x10061bb7
call fcn.100616f8
sub esp, 0x8c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x20], cl
je 0x10001d85
cmp byte [ebp + 0x20], 0
je 0x10001d51
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100020c4
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x56207ccb
inc dword [edx]
cmp dword [edx], 2
jl 0x10001d3a
jmp 0x100020c4
mov ecx, dword [ebp + 0x2c]
mov dword [ecx], 0
cmp dword [ecx], 2
jg 0x100020c4
mov edx, dword [ebp + 0x24]
mov dword [ebp + 8], 0x543beb71
mov dword [ebp + 8], 0x696a485b
mov eax, dword [ebp + 8]
mov dword [edx], eax
inc dword [ecx]
cmp dword [ecx], 2
jle 0x10001d66
jmp 0x100020c4
test cl, cl
je 0x10001e2f
mov dword [ebp - 0x14], 0x4e0e
cmp dword [ebp - 0x14], 0x513c
jle 0x10001e0d
xor esi, esi
mov ebx, esi
mov ecx, esi
mov dword [ebp + 8], esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x1c], 0xc4e
mov dword [ebp - 0x18], eax
xor eax, ecx
lea ecx, [ebp - 0x4c]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001dcd
mov eax, dword [eax]
push eax
call fcn.1004ad2c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.1000b74b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add eax, edi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x10001db4
inc edi
cmp edi, 0x3160
jl 0x10001da8
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x3c41
jl 0x10001da6
inc ebx
cmp ebx, 0x4107
jl 0x10001da1
push 0xe2d
call dword [sym.imp.USER32.dll_GetSysColor]
cmp dword [ebp - 0x14], 0x4def
jge 0x100020c4
push str.mst_ryfbijr_lml_tdvrex_ezh_ykuhpp_fomsbd_bliafccam_cqrivzety_umjlasdo_vjialdr_osxsy
jmp 0x100020be
mov dword [ebp - 0x14], 0x2156
cmp dword [ebp - 0x14], 0x21ea
jle 0x10001e8f
push 0xe23
call dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
mov edi, esi
mov dword [ebp + 8], esi
mov ebx, esi
mov eax, edi
mov edi, 0x2920
cdq
idiv ebx
mov esi, edx
mov eax, esi
mov ecx, 0x1007da98
cdq
push edx
push eax
call fcn.1000b132
inc esi
dec edi
jne 0x10001e5f
mov edi, dword [ebp + 8]
inc ebx
cmp ebx, 0x404
jl 0x10001e53
inc edi
mov dword [ebp + 8], edi
push 0
pop esi
cmp edi, 0x7a9c
jl 0x10001e51
jmp 0x10001e91
xor esi, esi
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x1f08
jge 0x10001eb0
mov edx, str.jbluxc_bjgskcnay_wwcil
mov ecx, 0x1007da98
call fcn.1000d503
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x682b
cmp dword [ebp - 0x14], 0x685c
jle 0x10001f4c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, esi
mov edi, esi
mov ecx, esi
mov dword [ebp + 8], esi
mov eax, edi
cdq
idiv ecx
lea ecx, [ebp - 0x7c]
or edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001ef7
mov eax, dword [eax]
push eax
call fcn.1004ad2c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x7c]
call fcn.1000b74b
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x7f2e
jl 0x10001ed9
inc edi
cmp edi, 0x5fad
jl 0x10001ed4
inc ebx
cmp ebx, 0x6d7c
jl 0x10001ed2
push esi
push 0x243e
push esi
push esi
push 0x335
push 0x2653
push 0x3b1
push 0x2017
call dword [sym.imp.GDI32.dll_ExtTextOutA]
cmp dword [ebp - 0x14], 0x6783
jge 0x10001f60
push str.ywb_txcjcb_lms_emxzxuwmx_defompui_qluwkh_abkf_dxybzfrmu_enob_kkwz
call fcn.1004ad2c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x7c40
cmp dword [ebp - 0x18], 0x7c76
jle 0x10001fb8
mov edi, esi
mov ebx, esi
mov eax, edi
lea ecx, [ebp - 0x64]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001f94
mov eax, dword [eax]
push eax
call fcn.1004ad2c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x64]
call fcn.1000b74b
inc ebx
cmp ebx, 0x460b
jl 0x10001f78
inc edi
cmp edi, 0xd80
jl 0x10001f76
mov ebx, dword [ebp + 0xc]
mov dword [ebx], esi
cmp dword [ebx], 0xfffffff0
jge 0x100020b0
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x1c], 0x23ab
cmp dword [ebp - 0x1c], 0x2402
jle 0x1000203f
mov ebx, esi
mov dword [ebp - 0x14], esi
mov edi, esi
mov dword [ebp - 0x30], ebx
mov dword [ebp + 8], 0x39a5
mov eax, ebx
lea ecx, [ebp - 0x94]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002008
mov eax, dword [eax]
push eax
call fcn.1004ad2c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x94]
call fcn.1000b74b
add ebx, edi
dec dword [ebp + 8]
jne 0x10001fee
mov ebx, dword [ebp - 0x14]
dec edi
cmp edi, 0xffffae1a
jg 0x10001fe4
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x6927
jl 0x10001fe2
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x24], 1
cmp dword [ebp - 0x1c], 0x200c
jge 0x1000205a
push str.mvb_aoxcxmz_llofgebnx_jyooddv_ommx_gilxocsf_vypaa
call fcn.1004ad2c
pop ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x34]
mov edx, dword [ebp + 0x1c]
push eax
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x28], esi
push eax
push dword [ebp + 0x10]
lea ecx, [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x30]
call fcn.100029fb
add esp, 0x1c
dec dword [ebx]
jmp 0x10001fbd
cmp dword [ebp - 0x18], 0x7bd0
jge 0x100020c4
push str.upcpvo_vzlbb_ehlw_jmotdz_lynenehrq_lzja_ljyv_rpwwu_gbl
call fcn.1004ad2c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret