Function at 0x100ecab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x928
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x468]
push 0x42
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x68], 0
mov dword [esi + 0x70], 0
mov dword [esi + 0x78], 0x40
call fcn.100966d0
mov dword [esi + 0x74], eax
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [esi + 0x7c], ax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xbc], 1
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], eax
mov dword [esi + 0xdc], eax
mov dword [esi + 0xe0], eax
mov dword [esi + 0xe4], eax
mov dword [esi + 0xe8], eax
mov dword [esi + 0xec], eax
mov dword [esi + 0xf0], eax
mov dword [esi + 0xf4], eax
mov dword [esi + 0xf8], eax
mov dword [esi + 0xfc], eax
mov dword [esi + 0x100], eax
mov dword [esi + 0x104], eax
mov dword [esi + 0x108], eax
mov dword [esi + 0x10c], eax
mov dword [esi + 0x110], eax
mov dword [esi + 0x124], eax
mov dword [esi + 0x128], eax
lea eax, [ebp - 0x928]
push eax
mov dword [esi + 0x114], 0xffffffff
mov dword [esi + 0x118], 0xffffffff
mov dword [esi + 0x11c], 0xffffffff
mov dword [esi + 0x120], 0xffffffff
call fcn.10094a90
add esp, 8
call fcn.100ecf70
mov ecx, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor edi, edi
mov eax, dword [sym.imp.USER32.dll_ToUnicode]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea esp, [esp]
mov ebx, dword [edi*4 + 0x1015bd10]
test ebx, ebx
je 0x100ecd2c
test dword [ebp + ebx*4 - 0x928], 0x40000000
jne 0x100ecd2c
cmp ebx, 0x4c
je 0x100ecd2c
mov eax, edi
and al, 0x80
movzx esi, al
mov eax, edi
neg esi
push 1
sbb esi, esi
and eax, 0x7f
and esi, 0xe000
or esi, eax
push esi
call ecx
mov byte [ebp + 0xb], al
test al, al
je 0x100ecd29
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.1010bec0
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
push eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x28]
push 0x10
push eax
lea eax, [ebp - 0x128]
push eax
movzx eax, byte [ebp + 0xb]
push esi
push eax
call dword [ebp - 8]
mov esi, eax
push esi
call fcn.100c9bb0
xor ecx, ecx
push esi
mov word [ebp + eax*2 - 0x28], cx
call fcn.100c9bb0
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push str.UTF_16LE
push str.UTF_32LE
call fcn.1008e3c0
add esp, 0x18
test eax, eax
je 0x100ecd20
mov ecx, dword [eax]
test ecx, ecx
je 0x100ecd10
cmp dword [eax + 4], 0
je 0x100ecd10
mov ecx, 0xfffd
push eax
mov dword [ebp + ebx*4 - 0x928], ecx
call fcn.100966a0
add esp, 4
test esi, esi
jns 0x100ecd29
call fcn.100ecf70
mov ecx, dword [ebp - 4]
inc edi
cmp edi, 0x100
jb 0x100ecc30
push 0
push 0x200
lea eax, [ebp - 0x928]
push eax
push 0
call fcn.10095700
push str.Menu
push 0x65
call fcn.10095880
push str.Left_Windows
push 0xe3
call fcn.10095880
push str.Right_Windows
push 0xe7
call fcn.10095880
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0x28
push 0x14
call esi
and eax, 1
push eax
push 0x2000
call fcn.100958a0
add esp, 8
push 0x90
call esi
and eax, 1
push eax
push 0x1000
call fcn.100958a0
add esp, 8
push 0x91
call esi
and eax, 1
push eax
push 0x8000
call fcn.100958a0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret