Function at 0x10166e2
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
shr eax, 0x1f
mov ecx, 0x100
push ebx
or eax, ecx
cmp eax, ecx
push esi
push edi
jne 0x1016842
mov eax, dword [ebp + 8]
sub eax, 0x10
je 0x10167ca
dec eax
je 0x101678d
dec eax
jne 0x1016a38
xor edi, edi
cmp dword [0x101ed88], edi
je 0x1016a38
cmp dword [0x101ee00], edi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
jne 0x101674a
push 0xa5
call esi
shr eax, 8
and eax, 1
mov dword [0x101ee00], eax
je 0x101674a
call fcn.01015331
cmp dword [0x101ed88], edi
je 0x1016a38
cmp dword [0x101ee04], edi
jne 0x1016a38
push 0x12
call esi
shr eax, 8
and eax, 1
mov dword [0x101ee04], eax
je 0x1016a38
cmp dword [0x101ee08], edi
je 0x1016a38
call fcn.01015331
jmp 0x1016a38
xor edi, edi
cmp dword [0x101ed88], edi
je 0x1016a38
cmp dword [0x101ee08], edi
jne 0x1016a38
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
and eax, 1
cmp dword [0x101ee04], edi
mov dword [0x101ee08], eax
je 0x1016a38
cmp eax, edi
jmp 0x101677d
xor edi, edi
cmp dword [0x101edf8], edi
jne 0x1016a38
push edi
push 0x2a
mov dword [0x101edf8], 1
call fcn.0101669c
cmp eax, edi
jl 0x1016a38
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, eax
mov eax, dword [0x101eda8]
push 4
push edi
shl esi, 2
push dword [esi + eax]
call ebx
mov eax, dword [0x101eda8]
push 0x1a
push dword [esi + eax]
call fcn.01014b05
push edi
push 0x36
call fcn.0101669c
cmp eax, edi
jl 0x1016a38
mov esi, eax
mov eax, dword [0x101eda8]
push 4
shl esi, 2
push edi
push dword [esi + eax]
call ebx
push 0x1a
jmp 0x10169e9
cmp eax, 0x101
jne 0x1016a38
mov eax, dword [ebp + 8]
cmp eax, 0x15
ja 0x10169fb
je 0x1016783
sub eax, 0x10
je 0x101698c
dec eax
je 0x1016973
dec eax
je 0x1016940
dec eax
dec eax
jne 0x1016a38
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
mov bx, ax
xor edi, edi
push edi
push 0x3a
and ebx, 1
mov dword [0x101edfc], ebx
call fcn.0101669c
mov esi, eax
cmp esi, edi
jl 0x1016a38
cmp ebx, edi
je 0x1016900
mov eax, dword [0x101eda8]
mov ebx, esi
shl ebx, 2
push dword [ebx + eax]
call fcn.010178f9
mov eax, dword [0x101eda8]
push 4
push edi
push dword [ebx + eax]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [0x101eda8]
push 0x1a
push dword [ebx + eax]
call fcn.01014b05
imul esi, esi, 0x5c
cmp dword [esi + 0x101c228], 0x10
jne 0x1016783
mov eax, dword [0x101eda8]
mov eax, dword [ebx + eax]
mov dword [0x101ee78], eax
jmp 0x1016783
push edi
call fcn.010178f9
mov eax, dword [0x101eda8]
push edi
push edi
push dword [eax + esi*4]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [0x101eda8]
push 3
push dword [eax + esi*4]
call fcn.01014b05
imul esi, esi, 0x5c
cmp dword [esi + 0x101c228], 0x10
jne 0x1016783
mov dword [0x101ee78], edi
jmp 0x1016783
xor edi, edi
cmp dword [0x101ee00], edi
je 0x1016955
mov dword [0x101ee00], edi
call fcn.01015331
cmp dword [0x101ee04], edi
je 0x1016968
mov dword [0x101ee04], edi
call fcn.01015331
mov dword [0x101ee70], edi
jmp 0x1016a38
xor edi, edi
cmp dword [0x101ee08], edi
je 0x1016783
mov dword [0x101ee08], edi
jmp 0x1016783
xor edi, edi
push edi
push 0x2a
mov dword [0x101edf8], edi
call fcn.0101669c
cmp eax, edi
jl 0x1016a38
mov ebx, dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, eax
mov eax, dword [0x101eda8]
push edi
push edi
shl esi, 2
push dword [esi + eax]
call ebx
mov eax, dword [0x101eda8]
push 3
push dword [esi + eax]
call fcn.01014b05
push edi
push 0x36
call fcn.0101669c
cmp eax, edi
jl 0x1016a38
mov esi, eax
mov eax, dword [0x101eda8]
push edi
shl esi, 2
push edi
push dword [esi + eax]
call ebx
push 3
mov eax, dword [0x101eda8]
push dword [esi + eax]
call fcn.01014b05
jmp 0x1016783
sub eax, 0x7a
je 0x1016a16
sub eax, 0x16
je 0x1016a0f
dec eax
jne 0x1016a38
call fcn.01014f7f
jmp 0x1016a38
call fcn.01014ecc
jmp 0x1016a38
push dword [0x101edb0]
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1016a2a
push 9
jmp 0x1016a2c
push 2
push dword [0x101edb0]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8