Function at 0x1a00e3d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x1a02400c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [0x1a02d06c], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x98], ecx
jne 0x1a00e679
cmp byte [0x1a024074], 0
je 0x1a00e43d
lea ecx, [ebp - 0xc8]
call fcn.1a006320
cmp dword [ebp - 0xb0], 0
je 0x1a00e43d
lea ecx, [ebp - 0xc8]
call fcn.1a006320
cmp dword [ebp - 0xa8], 0
jne 0x1a00e679
cmp dword [ebp - 0xac], 0
jne 0x1a00e679
call fcn.1a00dba0
test eax, eax
je 0x1a00e643
push 0xffffffffffffffeb
push dword [0x1a02b604]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, eax
je 0x1a00e49d
mov eax, dword [eax]
test eax, eax
je 0x1a00e49d
cmp word [eax + 0xe2a], 0
jbe 0x1a00e49d
movzx eax, word [eax + 0xe2c]
mov ecx, 0x1111
cmp ax, cx
je 0x1a00e643
mov ecx, 0x2222
cmp ax, cx
je 0x1a00e643
mov ecx, 0x4444
cmp ax, cx
je 0x1a00e643
cmp ebx, 0x10
je 0x1a00e643
cmp ebx, 0x11
je 0x1a00e643
cmp ebx, 0x12
je 0x1a00e643
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
je 0x1a00e4d8
cmp ebx, 0x20
jne 0x1a00e643
cmp dword [ebp + 8], 0x390001
jne 0x1a00e643
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov dword [ebp - 0x90], ebx
call edi
movzx esi, ax
shr esi, 0xe
push 0x14
and esi, 2
call edi
mov edi, esi
or edi, 0x40
and al, 1
cmove edi, esi
cmp dword [0x1a02b608], 0
je 0x1a00e518
or edi, 0x80
mov dword [0x1a02b608], 0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
mov ecx, 0x8000
test cx, ax
jne 0x1a00e580
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
jne 0x1a00e580
cmp ebx, 0x41
jb 0x1a00e564
cmp ebx, 0x5a
ja 0x1a00e564
mov ecx, edi
mov eax, edi
shr eax, 1
shr ecx, 6
not eax
not ecx
xor ecx, eax
lea eax, [ebx + 0x20]
test cl, 1
cmovne eax, ebx
mov dword [ebp - 0x90], eax
jmp 0x1a00e58f
cmp ebx, 8
je 0x1a00e58d
cmp ebx, 0xd
je 0x1a00e58d
cmp ebx, 0x20
je 0x1a00e58d
mov eax, 1
mov dword [ebp - 0x90], eax
jmp 0x1a00e58f
mov eax, 0x13
mov dword [ebp - 0x90], eax
jmp 0x1a00e58f
mov eax, ebx
mov byte [ebp - 0x94], al
call fcn.1a0020f0
test eax, eax
je 0x1a00e5b2
lea eax, [ebp - 0x8c]
push eax
push edi
push dword [ebp - 0x94]
call dword [0x1a02b6c0]
cmp dword [0x1a02d2f8], 0
mov ecx, dword [ebp - 0x90]
je 0x1a00e5f0
lea eax, [ecx - 0x21]
cmp al, 0x5c
ja 0x1a00e5f0
mov ecx, 0xa0
mov dword [0x1a02d2f8], 0
xor eax, eax
mov dword [0x1a024080], 1
mov edi, 0x1a02d078
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x90]
cmp dword [ebp + 8], 0x20
je 0x1a00e612
lea eax, [ecx - 0x21]
cmp al, 0x5c
ja 0x1a00e612
movzx eax, cl
lea ecx, [ebp - 0x1c]
mov word [ebp - 0x1c], ax
xor eax, eax
mov word [ebp - 0x1a], ax
call fcn.1a00d710
mov esi, dword [ebp - 0x24]
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 0x98]
shr esi, 2
not esi
and esi, 1
test eax, eax
cmove eax, dword [0x1a02b614]
mov ecx, eax
call fcn.1a00de40
mov edx, eax
neg edx
sbb edx, edx
and edx, esi
jmp 0x1a00e645
xor edx, edx
cmp ebx, 0x20
jne 0x1a00e666
cmp dword [0x1a02d2fc], 0
je 0x1a00e666
xor eax, eax
mov ecx, 0xa0
mov edi, 0x1a02d300
mov dword [0x1a02d2fc], eax
rep stosd dword es:[edi], eax
mov eax, edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1a01aaa5
mov esp, ebp
pop ebp
ret