Function at 0x1001d3f5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f3a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x154
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001d844
mov dword [ebp - 0x4c], 0x7cf1
mov dword [ebp - 0xa8], 0x10008c38
cmp dword [ebp - 0x4c], 0x8069
jle 0x1001d4d9
and dword [ebp - 0x1c], 0
jmp 0x1001d44a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xbf5
jge 0x1001d4d9
and dword [ebp - 0x3c], 0
jmp 0x1001d464
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x764e
jge 0x1001d4d4
and dword [ebp - 0x24], 0
jmp 0x1001d47a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7868
jge 0x1001d4d2
and dword [ebp - 0x40], 0
jmp 0x1001d490
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x469b
jge 0x1001d4d0
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x40]
sub edx, eax
mov eax, edx
cdq
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], edx
push dword [ebp - 0xb8]
push dword [ebp - 0xbc]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1001d489
jmp 0x1001d473
jmp 0x1001d45d
jmp 0x1001d443
lea eax, [ebp + 8]
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0x4c], 0x7ae5
jge 0x1001d4fb
mov edx, dword [ebp - 0xa8]
mov ecx, 0x10084b98
call fcn.10023c34
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0xb4]
movzx eax, byte [eax]
test eax, eax
je 0x1001d5e5
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
movzx eax, byte [eax]
test eax, eax
je 0x1001d544
push 0x7c33
push 1
push 1
push 0x3a2f
call fcn.1001a0d6
add esp, 0x10
mov dword [ebp - 0x54], 0x15b9
mov dword [ebp - 0x90], 0x10008ca0
cmp dword [ebp - 0x54], 0x16ac
jle 0x1001d5c7
and dword [ebp - 0x2c], 0
jmp 0x1001d56b
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x62a7
jge 0x1001d5b7
and dword [ebp - 0x44], 0
jmp 0x1001d581
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0x5300
jge 0x1001d5b5
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x44]
cdq
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], edx
push dword [ebp - 0xc4]
push dword [ebp - 0xc8]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1001d57a
jmp 0x1001d564
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp dword [ebp - 0x54], 0x1460
jge 0x1001d5e0
mov edx, dword [ebp - 0x90]
mov ecx, 0x10084b98
call fcn.10023c34
jmp 0x1001d83f
mov dword [ebp - 0xc0], 0x1bd97a8
mov dword [ebp - 0x98], 0xd609
mov dword [ebp - 0x114], 0x35357f45
mov dword [ebp - 0x88], 6
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x140], 0xfffffffd
mov dword [ebp - 0x13c], 0xfffffffd
mov dword [ebp - 0x138], 0xfffffffd
mov dword [ebp - 0x134], 0xfffffffd
mov dword [ebp - 0x94], 0x65251c60
mov dword [ebp - 0x5c], 0x246c382
mov dword [ebp - 0x12c], 0x7bc35240
mov dword [ebp - 0x50], 0x4839
mov dword [ebp - 0x78], 0x10008ce4
cmp dword [ebp - 0x50], 0x4a0f
jle 0x1001d715
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtSelectClipRgn]
and dword [ebp - 0x20], 0
jmp 0x1001d68e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x71e5
jge 0x1001d715
and dword [ebp - 0x18], 0
jmp 0x1001d6a4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7a80
jge 0x1001d710
and dword [ebp - 0x34], 0
jmp 0x1001d6ba
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0x2a8e
jge 0x1001d70e
and dword [ebp - 0x14], 0
jmp 0x1001d6d0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x51b4
jge 0x1001d70c
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
sar eax, cl
and eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], edx
push dword [ebp - 0xd0]
push dword [ebp - 0xd4]
mov ecx, 0x10084b98
call fcn.10020ee4
jmp 0x1001d6c9
jmp 0x1001d6b3
jmp 0x1001d69d
jmp 0x1001d687
mov dword [ebp - 0x118], 3
cmp dword [ebp - 0x50], 0x4715
jge 0x1001d735
mov edx, dword [ebp - 0x78]
mov ecx, 0x10084b98
call fcn.10023c34
mov dword [ebp - 0xa0], 0xb2415fb5
mov dword [ebp - 0x80], 0x26128f3b
push 1
lea ecx, [ebp - 0x104]
call fcn.100211fe
and dword [ebp - 4], 0
mov dword [ebp - 0xf8], 0x451d
mov dword [ebp - 0xf4], 0x451d
mov dword [ebp - 0xf0], 0x451d
mov dword [ebp - 0xec], 0x451d
lea ecx, [ebp - 0x45]
call fcn.100212ab
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp - 0x148]
call fcn.100212ae
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x124]
call fcn.1002125a
mov byte [ebp - 4], 1
push 0x402c
push 0
lea eax, [ebp - 0x130]
push eax
push 0x7d59
lea eax, [ebp - 0x104]
push eax
call fcn.10020812
add esp, 0x14
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xc0]
push eax
call fcn.1001e055
add esp, 0x2c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x124]
call fcn.10021280
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x104]
call fcn.10021280
jmp 0x1001da45
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xac], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
movzx eax, byte [eax]
test eax, eax
je 0x1001d89e
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
movzx eax, byte [eax]
test eax, eax
je 0x1001d899
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1001da45
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x1001d8c9
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0xa
jle 0x1001da45
mov dword [ebp - 0x6c], 1
mov dword [ebp - 0x58], 0xa74
mov dword [ebp - 0x64], 0x10008d08
cmp dword [ebp - 0x58], 0xc06
jle 0x1001d994
and dword [ebp - 0x28], 0
jmp 0x1001d904
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x4e46
jge 0x1001d994
and dword [ebp - 0x30], 0
jmp 0x1001d91e
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xbfa
jge 0x1001d98f
and dword [ebp - 0x38], 0
jmp 0x1001d934
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x6a96
jge 0x1001d98d
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x38]
shl eax, cl
cdq
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], edx
push dword [ebp - 0xdc]
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x160]
call fcn.1001105e
pop ecx
pop ecx
mov dword [ebp - 0x60], eax
mov ecx, dword [ebp - 0x60]
call fcn.10020ec4
push eax
call fcn.10069ba3
pop ecx
lea ecx, [ebp - 0x160]
call fcn.10020eba
jmp 0x1001d92d
jmp 0x1001d917
jmp 0x1001d8fd
push 1
lea ecx, [ebp - 0x110]
call fcn.100211fe
mov dword [ebp - 4], 2
cmp dword [ebp - 0x58], 0x8e8
jge 0x1001d9ba
push dword [ebp - 0x64]
call fcn.10069ba3
pop ecx
mov dword [ebp - 0x7c], 0xa0b8ee41
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x74], 0xbdebf889
push 0x7657
lea eax, [ebp - 0x110]
push eax
push 0x74f
push 0xc61
lea eax, [ebp - 0x128]
push eax
push 0
call fcn.1001dbcb
add esp, 0x18
push dword [ebp - 0x10]
push 1
lea eax, [ebp - 0x6c]
push eax
push 0
lea eax, [ebp - 0x74]
push eax
push 0x15f2
lea eax, [ebp - 0x7c]
push eax
push 0x7e84
lea eax, [ebp - 0x84]
push eax
push 0x7a74
lea eax, [ebp - 0x110]
push eax
call fcn.10013b06
add esp, 0x2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.10021280
jmp 0x1001d8be
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret