Function at 0x1002e2ca
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x1022d00c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0x1022d548]
mov esi, edx
mov edx, ecx
mov dword [ebp - 0x50], edx
test edi, edi
je case.default.0x1002e837
add edi, 8
call fcn.1002d0fa
mov ecx, eax
mov eax, 0x204
mov dword [ebp - 0x14], ecx
cmp esi, eax
ja 0x1002e80e
je case.0x1002e837.518
mov eax, 0x102
cmp esi, eax
ja 0x1002e437
je 0x1002e395
mov eax, esi
sub eax, 7
je 0x1002e382
sub eax, 1
je 0x1002e382
sub eax, 0x18
je 0x1002e36b
sub eax, 0x5e
je 0x1002e357
sub eax, 0x22
je 0x1002e52b
sub eax, 0x60
je 0x1002e345
sub eax, 1
jne case.default.0x1002e837
mov eax, 0x100
cmp esi, eax
je 0x1002e6ac
jmp 0x1002e6a0
mov byte [ecx + 0x24], 1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1004676c
leave
ret
xor eax, eax
inc eax
cmp word [ebp + 0xc], ax
jne case.default.0x1002e837
call fcn.1002d23a
test al, al
je case.default.0x1002e837
xor eax, eax
inc eax
jmp 0x1002e35d
cmp esi, 7
mov ecx, edi
sete al
movzx eax, al
push eax
call fcn.100031e0
jmp case.default.0x1002e837
push edx
call dword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x1002e3be
mov ecx, dword [ebp + 8]
lea eax, [ecx - 1]
cmp eax, 0xfffe
ja 0x1002e51b
push ecx
mov ecx, edi
call fcn.10002d6d
jmp 0x1002e51b
xor eax, eax
lea ecx, [ebp - 0x14]
inc eax
xor esi, esi
push eax
push ecx
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 0x14], esi
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx edx, word [ebp - 0x14]
mov ecx, dword [edi + 0xdb8]
test edx, edx
je 0x1002e51b
cmp byte [edi + 0x3799], 0
je 0x1002e51b
mov eax, dword [ecx + 0x3ee8]
xorps xmm0, xmm0
mov dword [ebp - 0x2c], eax
inc eax
mov dword [ecx + 0x3ee8], eax
lea eax, [ebp - 0x34]
push eax
add ecx, 0x3ecc
movlpd qword [ebp - 0x24], xmm0
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x28], edx
call fcn.1001eece
jmp 0x1002e51b
mov eax, esi
sub eax, 0x104
je 0x1002e69b
sub eax, 1
je 0x1002e69b
sub eax, 0xa
je 0x1002e61c
sub eax, 0xf1
je 0x1002e52b
sub eax, 1
je case.0x1002e837.518
sub eax, 1
je case.0x1002e837.517
sub eax, 1
jne case.default.0x1002e837
call fcn.1002e2a7
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x4c], ecx
cmp esi, 0x204
je 0x1002e495
cmp esi, 0x206
jne 0x1002e49c
mov dword [ebp - 0x4c], 1
cmp esi, 0x207
je 0x1002e4ac
cmp esi, 0x209
jne 0x1002e4b3
mov dword [ebp - 0x4c], 2
cmp esi, 0x20b
je 0x1002e4c3
cmp esi, 0x20d
jne 0x1002e4db
mov eax, dword [ebp + 8]
xor edx, edx
shr eax, 0x10
inc edx
cmp ax, dx
push 0
pop eax
setne al
add eax, 3
mov dword [ebp - 0x4c], eax
mov esi, dword [ebp - 0x14]
cmp dword [esi + 0xc], ecx
jne 0x1002e4f6
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x1002e4f6
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esi + 0xc]
mov edx, dword [ebp - 0x4c]
bts eax, edx
mov dword [esi + 0xc], eax
push 1
mov eax, dword [edi + 0xdb8]
mov ecx, dword [ebp - 0x18]
push edx
mov dword [eax + 0x3ee4], ecx
mov ecx, edi
call fcn.100030e9
xor eax, eax
cmp byte [edi + 0x92], al
setne al
jmp 0x1002e35d
call fcn.1002e2a7
mov edx, dword [ebp - 0x50]
xor ecx, ecx
mov dword [ebp - 0x18], eax
cmp esi, 0x200
mov eax, dword [ebp - 0x14]
setne cl
inc ecx
mov dword [ebp - 0x58], ecx
mov dword [eax + 4], edx
mov eax, dword [eax + 8]
mov dword [ebp - 0x54], eax
cmp eax, ecx
je 0x1002e5af
push 0x10
pop eax
xor ecx, ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], eax
cmp esi, 0x200
push 2
pop eax
mov dword [ebp - 0x4c], 0x12
cmovne eax, dword [ebp - 0x4c]
mov dword [ebp - 0x40], 0x80000000
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x54], ecx
je 0x1002e599
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_TrackMouseEvent]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 0x50]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 0xc]
movsx eax, cx
mov dword [ebp - 0xc], eax
shr ecx, 0x10
movsx eax, cx
mov dword [ebp - 8], eax
mov eax, dword [edi]
shr eax, 0xa
and al, 1
cmp esi, 0x200
jne 0x1002e5e1
test al, al
je 0x1002e5f8
lea eax, [ebp - 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_ClientToScreen]
jmp 0x1002e5f8
cmp esi, 0xa0
jne 0x1002e5f8
test al, al
jne 0x1002e5f8
lea eax, [ebp - 0xc]
push eax
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [edi + 0xdb8]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x3ee4], ecx
movd xmm2, dword [ebp - 8]
movd xmm1, dword [ebp - 0xc]
cvtdq2ps xmm2, xmm2
cvtdq2ps xmm1, xmm1
jmp 0x1002e947
mov esi, 0x800
test dword [ebp + 0xc], esi
je 0x1002e51b
push edx
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov ecx, eax
xor eax, eax
push eax
push eax
push esi
mov esi, dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
push ecx
mov dword [ebp - 0x4c], ecx
call esi
mov dword [ebp - 0x14], eax
lea ecx, [eax + eax]
push ecx
push 0
push 0x1022dbc0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0x14]
push 0x1022dbc0
push 0x800
push dword [ebp - 0x4c]
call esi
cmp dword [ebp - 0x14], 0
jle 0x1002e68a
xor esi, esi
movzx eax, word [esi*2 + 0x1022dbc0]
mov ecx, edi
push eax
call fcn.10002d6d
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x1002e674
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
jmp 0x1002e51b
mov eax, 0x100
mov byte [ebp - 0x45], 0
cmp esi, 0x104
jne 0x1002e6b0
mov byte [ebp - 0x45], 1
cmp dword [ebp + 8], eax
jae 0x1002e51b
call fcn.1002d453
mov esi, dword [ebp + 8]
cmp esi, 0xd
jne 0x1002e6d9
mov eax, dword [ebp + 0xc]
shr eax, 0x10
bt ax, 8
mov eax, 0x10d
cmovb esi, eax
mov ecx, esi
call fcn.1002dd62
test eax, eax
je 0x1002e6f2
mov dl, byte [ebp - 0x45]
push ecx
push esi
mov ecx, eax
call fcn.1002d2de
pop ecx
pop ecx
cmp esi, 0x10
jne 0x1002e750
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa0
call esi
mov cl, byte [ebp - 0x45]
xor edx, edx
shr eax, 0xf
inc edx
and al, dl
cmp al, cl
jne 0x1002e727
push ecx
mov dl, cl
mov ecx, 0x210
push 0xa0
call fcn.1002d2de
pop ecx
pop ecx
push 0xa1
call esi
mov cl, byte [ebp - 0x45]
shr eax, 0xf
and al, 1
cmp al, cl
jne 0x1002e51b
push ecx
mov dl, cl
mov ecx, 0x214
push 0xa1
jmp 0x1002e802
cmp esi, 0x11
jne 0x1002e7a8
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa2
call esi
mov cl, byte [ebp - 0x45]
shr eax, 0xf
and al, 1
cmp al, cl
jne 0x1002e782
push ecx
mov dl, cl
mov ecx, 0x20f
push 0xa2
call fcn.1002d2de
pop ecx
pop ecx
push 0xa3
call esi
mov cl, byte [ebp - 0x45]
shr eax, 0xf
and al, 1
cmp al, cl
jne 0x1002e51b
push ecx
mov dl, cl
mov ecx, 0x213
push 0xa3
jmp 0x1002e802
cmp esi, 0x12
jne 0x1002e51b
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xa4
call esi
mov cl, byte [ebp - 0x45]
shr eax, 0xf
and al, 1
cmp al, cl
jne 0x1002e7de
push ecx
mov dl, cl
mov ecx, 0x211
push 0xa4
call fcn.1002d2de
pop ecx
pop ecx
push 0xa5
call esi
mov cl, byte [ebp - 0x45]
shr eax, 0xf
and al, 1
cmp al, cl
jne 0x1002e51b
push ecx
mov dl, cl
mov ecx, 0x215
push 0xa5
call fcn.1002d2de
pop ecx
pop ecx
jmp 0x1002e51b
mov eax, 0x219
cmp esi, eax
ja 0x1002e903
je 0x1002e8f0
lea eax, [esi - 0x205]
cmp eax, 9
ja case.default.0x1002e837
movzx eax, byte [eax + 0x1002e9aa]
jmp dword [eax*4 + 0x1002e99a]
call fcn.1002e2a7
xor edx, edx
mov dword [ebp - 0x18], eax
cmp esi, 0x205
sete dl
mov dword [ebp - 0x4c], edx
cmp esi, 0x208
jne 0x1002e861
push 2
pop edx
jmp 0x1002e87b
cmp esi, 0x20c
jne 0x1002e87e
mov eax, dword [ebp + 8]
xor edx, edx
shr eax, 0x10
cmp ax, 1
setne dl
add edx, 3
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0xc]
btr eax, edx
mov dword [ecx + 0xc], eax
test eax, eax
jne 0x1002e8a2
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp - 0x50]
jne 0x1002e89f
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov edx, dword [ebp - 0x4c]
push 0
jmp 0x1002e504
mov eax, dword [ebp + 8]
xorps xmm1, xmm1
shr eax, 0x10
cwde
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm2, dword [0x10227be8]
mov ecx, edi
call fcn.10003170
jmp case.default.0x1002e837
mov eax, dword [ebp + 8]
xorps xmm2, xmm2
shr eax, 0x10
cwde
movd xmm1, eax
cvtdq2ps xmm1, xmm1
xorps xmm1, xmmword [0x10228420]
divss xmm1, dword [0x10227be8]
jmp 0x1002e8c2
cmp dword [ebp + 8], 7
jne case.default.0x1002e837
mov byte [ecx + 0x26], 1
jmp case.default.0x1002e837
mov eax, esi
sub eax, 0x286
je 0x1002e953
sub eax, 0x1c
je 0x1002e91a
sub eax, 1
jne case.default.0x1002e837
xor eax, eax
cmp esi, 0x2a3
setne al
inc eax
cmp dword [ecx + 8], eax
jne case.default.0x1002e837
xor eax, eax
cmp dword [ecx + 4], edx
jne 0x1002e939
mov dword [ecx + 4], eax
movss xmm1, dword [0x10227c64]
mov dword [ecx + 8], eax
movaps xmm2, xmm1
mov ecx, edi
call fcn.10002fe2
jmp case.default.0x1002e837
mov edx, dword [ebp + 8]
cmp edx, 0x7f
ja 0x1002e95e
push edx
jmp 0x1002e98e
movzx eax, dl
shl ax, 8
movzx ecx, ax
shr edx, 8
movzx eax, dl
or ecx, eax
lea eax, [ebp - 0x10]
push 3
push eax
push 4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push eax
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx eax, word [ebp - 0x10]
push eax
mov ecx, edi
call fcn.10002d0f
jmp 0x1002e51b