Function at 0x100befe0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.1000a520
movzx eax, al
test eax, eax
jne 0x100befff
xor al, al
jmp 0x100bf2b1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1c]
call fcn.100381c0
test eax, eax
jne 0x100bf01f
mov ecx, 0x10205080
call fcn.100c2510
movzx edx, al
test edx, edx
je 0x100bf026
mov al, 1
jmp 0x100bf2b1
push 9
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx eax, al
test eax, eax
jne 0x100bf11e
push 8
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx ecx, al
test ecx, ecx
jne 0x100bf11e
push 0x4e
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx edx, al
test edx, edx
jne 0x100bf11e
push 7
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx eax, al
test eax, eax
jne 0x100bf11e
push 0x17
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx ecx, al
test ecx, ecx
jne 0x100bf11e
push 0x48
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx edx, al
test edx, edx
jne 0x100bf11e
push 0x39
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx eax, al
test eax, eax
jne 0x100bf11e
push 0xe
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx ecx, al
test ecx, ecx
jne 0x100bf11e
push 0x41
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx edx, al
test edx, edx
jne 0x100bf11e
push 0xf
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx eax, al
test eax, eax
jne 0x100bf11e
push 0x3c
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx ecx, al
test ecx, ecx
jne 0x100bf11e
push 0x3d
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx edx, al
test edx, edx
je 0x100bf125
xor al, al
jmp 0x100bf2b1
push 0x94
mov ecx, 0x10208bdc
call fcn.1011d1e0
movzx eax, al
test eax, eax
je 0x100bf142
mov al, 1
jmp 0x100bf2b1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x20]
call fcn.10021340
movzx edx, al
test edx, edx
je 0x100bf15b
mov al, 1
jmp 0x100bf2b1
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x100bf2af
mov ecx, 0x7dd0f0
call ecx
test eax, eax
je 0x100bf17e
xor al, al
jmp 0x100bf2b1
mov ecx, 0x101e5c68
call fcn.10038120
movzx edx, al
test edx, edx
jne 0x100bf196
xor al, al
jmp 0x100bf2b1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x1c]
call fcn.100382c0
cmp eax, 0x32
jl 0x100bf1d2
push 0
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x20]
call fcn.10021360
push 5
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x20]
call fcn.10021380
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
call fcn.100212e0
mov al, 1
jmp 0x100bf2b1
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x1c]
call fcn.10038180
cmp eax, 1
jne 0x100bf20e
push 0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x20]
call fcn.10021360
push 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x20]
call fcn.10021380
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x20]
call fcn.100212e0
mov al, 1
jmp 0x100bf2b1
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax + 0x43]
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx + 0x44]
lea ecx, [ecx + eax*8]
mov dword [ebp - 8], ecx
push 0x4d
mov ecx, 0x101e1278
call fcn.1014d3f0
movzx edx, al
test edx, edx
je 0x100bf27f
mov eax, dword [0x101dcd20]
sub eax, 0x17c
cmp dword [0x879340c], eax
jbe 0x100bf27f
mov ecx, dword [0x101dcd20]
sub ecx, 0xbe
cmp dword [0x879340c], ecx
jae 0x100bf27f
mov edx, dword [ebp - 8]
add edx, 0x40
mov dword [ebp - 8], edx
cmp dword [0x8793410], 0x82
jle 0x100bf27f
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 0xc
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, 0x101e5c68
call fcn.1009e7a0
push 1
push 0x94
mov ecx, 0x10208bdc
call fcn.1011d0c0
mov al, 1
jmp 0x100bf2b1
xor al, al
mov esp, ebp
pop ebp
ret 4