Function at 0x1007b820
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100b5462
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x1c], esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0x18], ebx
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
cmp edi, 0xd
jne 0x1007b9c1
test cl, cl
je 0x1007b9ee
push 0x11
call eax
mov ecx, 0x8000
test cx, ax
jne 0x1007b9e2
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1007b9e2
mov ecx, dword [esi + 0x3e00]
cmp byte [ecx + 0xed0], 1
jne 0x1007b8e1
lea eax, [esp + 0x30]
push eax
call fcn.10074090
mov dword [esp + 0x58], ebx
mov edx, str.com.chaoxing.mobile
mov ebx, 1
mov ecx, eax
mov dword [esp + 0x18], ebx
call fcn.10012400
mov byte [esp + 0x17], bl
test al, al
jne 0x1007b8e6
mov byte [esp + 0x17], 0
mov dword [esp + 0x58], 0xffffffff
test bl, 1
je 0x1007b8ff
lea ecx, [esp + 0x30]
and ebx, 0xfffffffe
call fcn.10003e50
mov ecx, dword [esi + 0x3e00]
mov eax, dword [ecx + 0xed0]
shr eax, 0x1e
and al, 1
mov dword [esp + 0x20], eax
lea eax, [esp + 0x30]
push eax
call fcn.10074090
mov ecx, eax
mov edx, dword [ecx + 0x10]
or ebx, 2
cmp dword [ecx + 0x14], 0x10
mov dword [esp + 0x18], edx
jb 0x1007b932
mov ecx, dword [ecx]
mov eax, 0x14
cmp edx, eax
cmovb eax, edx
mov edx, str.com.tencent.tmgp.wec
push eax
call fcn.10004f40
add esp, 4
test eax, eax
jne 0x1007b966
mov ecx, dword [esp + 0x18]
cmp ecx, 0x14
jae 0x1007b95c
or eax, 0xffffffff
jmp 0x1007b964
xor eax, eax
cmp ecx, 0x14
setne al
test eax, eax
sete al
test al, al
sete al
test al, al
je 0x1007b994
mov eax, dword [esi + 0x3e00]
cmp byte [eax + 0xed0], 0
je 0x1007b994
cmp byte [esp + 0x17], 0
jne 0x1007b994
cmp byte [esp + 0x20], 0
mov byte [esp + 0x17], 1
je 0x1007b999
mov byte [esp + 0x17], 0
mov dword [esp + 0x58], 0xffffffff
test bl, 2
je 0x1007b9af
lea ecx, [esp + 0x30]
call fcn.10003e50
cmp byte [esp + 0x17], 0
je 0x1007b9e2
mov eax, dword [esi - 4]
lea ecx, [esi - 4]
call dword [eax + 0x24]
jmp 0x1007b9e2
cmp edi, 9
jne 0x1007b9ea
test cl, cl
je 0x1007b9ee
cmp byte [ebp + 0x14], bl
je 0x1007b9ea
mov eax, dword [ebp + 0xc]
shr eax, 0x1e
test al, 1
jne 0x1007b9e5
mov eax, dword [esi - 4]
lea ecx, [esi - 4]
call dword [eax + 0x28]
mov ecx, dword [ebp + 0x10]
mov eax, dword [sym.imp.USER32.dll_GetKeyState]
test cl, cl
jne 0x1007ba52
push 0xa5
call eax
mov ecx, 0x8000
test cx, ax
je 0x1007ba52
cmp edi, 0x78
je 0x1007ba13
cmp edi, 0x79
je 0x1007ba13
cmp edi, 0x7a
je 0x1007ba13
cmp edi, 0x7b
jne 0x1007ba52
mov ecx, dword [esp + 0x1c]
lea esi, [edi - 0x77]
xor eax, eax
mov dword [esp + 0x24], 0x2710
cmp esi, dword [0x100f08b8]
push 0xc
cmove esi, eax
mov dword [esp + 0x2c], 0xa
lea eax, [esp + 0x28]
mov dword [esp + 0x30], esi
push eax
add ecx, 0xc
call fcn.10004ad0
mov dword [0x100f08b8], esi
mov esi, dword [esp + 0x1c]
mov ecx, dword [esi + 0x3e04]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0x44]
call eax
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.100ad688
mov esp, ebp
pop ebp
ret 0x10