Function at 0x100718a0
Capabilities:
Log keystrokes via polling
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x1025ad40]
xor eax, ebp
mov dword [esp + 0x30], eax
call fcn.1004d690
mov esi, eax
mov eax, dword [eax + 0x8c]
cmp dword [eax + 0x34], 0
jle 0x10071aee
cmp dword [eax + 0x14], 0
jne 0x100718de
cmp dword [eax + 0x18], 0
je 0x10071aee
lea eax, [esp + 0x18]
push eax
push dword [0x102605e8]
call dword [sym.imp.USER32.dll_GetClientRect]
movq xmm0, qword [esp + 0x18]
movq xmm1, qword [esp + 0x20]
psubd xmm1, xmm0
cvtdq2ps xmm0, xmm1
movlps qword [esi + 8], xmm0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, eax
sub edx, dword [0x102605e0]
mov edi, ecx
sbb edi, dword [0x102605e4]
movd xmm0, edi
movd xmm1, edx
punpckldq xmm1, xmm0
movq qword [esp + 8], xmm1
fild qword [esp + 8]
fstp dword [esp]
movss xmm0, dword [esp]
fild qword [0x102605d8]
fstp dword [esp + 4]
divss xmm0, dword [esp + 4]
movss dword [esi + 0x10], xmm0
mov dword [0x102605e4], ecx
mov dword [0x102605e0], eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
movzx eax, ax
shr eax, 0xf
mov byte [esi + 0xf0], al
push 0x10
call edi
movzx eax, ax
shr eax, 0xf
mov byte [esi + 0xf1], al
push 0x12
call edi
movzx eax, ax
shr eax, 0xf
mov byte [esi + 0xf2], al
mov byte [esi + 0xf3], 0
call fcn.1004d690
mov edi, eax
cmp byte [eax + 0x34b], 0
je 0x100719e4
movsd xmm0, qword [edi + 0xd8]
cvttps2dq xmm0, xmm0
movlps qword [esp + 0x28], xmm0
lea eax, [esp + 0x28]
push eax
push dword [0x102605e8]
call dword [sym.imp.USER32.dll_ClientToScreen]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [edi + 0xd8], 0xff7fffff
mov dword [edi + 0xdc], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [0x102605e8]
je 0x10071a21
mov eax, 0xffffffff
cmp byte [esi + 0xa4], 0
je 0x10071a53
cmp dword [0x10202bb0], eax
jne 0x10071a60
jmp 0x10071adb
lea ebx, [esp + 0x28]
push ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x10071a06
push ebx
push dword [0x102605e8]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x10071a06
movsd xmm0, qword [esp + 0x28]
cvtdq2ps xmm0, xmm0
movlps qword [edi + 0xd8], xmm0
jmp 0x10071a06
call fcn.10058a10
cmp dword [0x10202bb0], eax
je 0x10071adb
mov dword [0x10202bb0], eax
call fcn.1004d690
test byte [eax], 0x20
jne 0x10071adb
mov esi, eax
call fcn.10058a10
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
je 0x10071ad4
cmp byte [esi + 0xa4], 0
jne 0x10071ad4
dec ecx
cmp ecx, 6
ja case.default.0x10071a8e
jmp dword [ecx*4 + 0x101b0870]
mov eax, 0x7f01
jmp 0x10071acb
mov eax, 0x7f00
jmp 0x10071acb
mov eax, 0x7f86
jmp 0x10071acb
mov eax, 0x7f85
jmp 0x10071acb
mov eax, 0x7f84
jmp 0x10071acb
mov eax, 0x7f83
jmp 0x10071acb
mov eax, 0x7f82
jmp 0x10071acb
mov eax, 0x7f89
push eax
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.10157981
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3