Function at 0x100067d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [0x10227d60]
push ebx
push ebp
push esi
push edi
xor edi, edi
push edi
push 4
push 0x1020fc2c
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp byte [0x101552c3], 0
je 0x10006802
mov byte [0x101552c3], 0
cmp byte [0x10133b2e], 0
je 0x10006812
mov byte [0x10133b2e], 0
mov eax, dword [0x10227cc8]
cmp dword [eax], 0x19d9d
jne 0x10006825
mov dword [eax], 0x19999
mov ecx, dword [0x10227cbc]
cmp dword [ecx], 4
mov ebx, 1
jne 0x100068a0
cmp byte [0x10130dfa], 0
mov byte [0x10130e06], bl
je 0x1000687b
push str.TEXTURE_hud_BeatUp
call dword [0x10139328]
add esp, 4
push 0x294
push 0x331
call dword [0x10167d2c]
add esp, 8
push 0xffffffffffffffff
call dword [0x101899cc]
push str.logo
call dword [0x1017d20c]
add esp, 4
push 0x7b
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x100068a0
cmp byte [0x10130dfa], 0
push 0x64
sete dl
mov byte [0x10130dfa], dl
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.10006720
call fcn.10006530
call fcn.10010b30
mov eax, dword [0x10227cbc]
mov eax, dword [eax]
cmp eax, 2
je 0x100068c4
cmp eax, 3
jne 0x10006ada
cmp byte [0x10227709], 0
je 0x100068d7
push str.Please_Register_with_Administrator___nRegister_At_:_https:__www.facebook.com_XNovaPatchOficial
call fcn.1000f940
push str.TEXTURE_hud_BeatUp
call dword [0x10139328]
add esp, 4
push 0x294
push 0x331
call dword [0x10167d2c]
add esp, 8
push 0xffffffffffffffff
call dword [0x101899cc]
push str.logo
call dword [0x1017d20c]
mov ecx, dword [0x10227cbc]
mov eax, dword [ecx]
add esp, 4
cmp eax, 3
jne 0x10006ada
mov edx, dword [0x10227cc8]
cmp dword [edx], 0x1adad
jne 0x10006933
mov byte [0x101552c3], bl
push 0x96
push edi
push 0x1019d2b8
mov dword [0x10216c0c], ebx
mov byte [0x10130d6a], bl
call fcn.1009aff0
add esp, 0xc
push str.TEXTURE_hud_button
mov byte [0x10130d69], bl
mov byte [0x10227752], bl
call dword [0x10139328]
add esp, 4
cmp byte [0x10227709], 0
jne 0x1000697a
call fcn.10011a60
cmp dword [0x10133e64], ebx
je 0x1000698a
cmp dword [0x1020ea74], ebx
jne 0x10006990
mov dword [0x2e6c110], edi
cmp byte [0x1022797e], 0
jne 0x100069ac
call fcn.1000f8f0
test al, al
jne 0x100069ac
push str.Please_Play_At_FREE_2___CANAL_1_Channel
call fcn.1000f940
cmp dword [0x1017bfe0], ebx
jne 0x10006b11
cmp byte [0x1022770a], 0
jne 0x10006a9b
cmp byte [0x102277c4], 0
jne 0x10006a74
cmp byte [0x10227709], 0
jne 0x10006a67
mov eax, dword [0x10227788]
mov ecx, dword [0x10227d88]
push eax
push ecx
push str.Welcome_to_XNova_Patch___
push 0x102275c0
call fcn.10096d80
mov ecx, dword [0x102279f0]
add esp, 0x10
push 0x102275c0
call fcn.10007e90
xor ebp, ebp
mov edx, dword [ebp + 0x1012d684]
add edx, dword [0x1020fc2c]
push 0x1016f0d0
push ebx
lea esi, [ebp + 0x102277f8]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp dword [esi], 4
jne 0x10006a56
mov edi, dword [ebp + 0x1012d684]
add edi, dword [0x1020fc2c]
push 0x1019e204
mov esi, ebx
call fcn.10007c20
xor edi, edi
add ebp, 4
cmp ebp, 0x18
jl 0x10006a10
mov byte [0x10227753], 0
jmp 0x10006a9b
mov eax, dword [0x10227d88]
push eax
push str.Welcome_to_XNova_Patch___
jmp 0x10006a7e
push 0x101392a0
push str.__s___Event_ASP_2015_
push 0x102275c0
call fcn.10096d80
mov ecx, dword [0x102279f0]
add esp, 0xc
push 0x102275c0
call fcn.10007e90
xor eax, eax
mov dword [0x10227810], eax
mov dword [0x10227814], eax
mov dword [0x10227818], eax
mov dword [0x1022781c], eax
mov dword [0x10227820], eax
mov dword [0x10227824], eax
mov dword [0x10210854], edi
mov dword [0x10227900], edi
mov dword [0x1017c050], edi
mov byte [0x10227750], al
mov dword [0x1017bfe0], edi
jmp 0x10006b11
cmp eax, 2
jne 0x10006af2
call fcn.10010870
mov dword [0x10227788], edi
mov dword [0x1017d21c], edi
jmp 0x10006b0b
cmp eax, 4
jne 0x10006b11
cmp byte [0x10227709], 0
jne 0x10006b05
call fcn.10011a60
mov byte [0x10133b2e], bl
mov dword [0x1017bfe0], ebx
mov ecx, dword [0x10227c80]
cmp dword [ecx], ebx
jne 0x10006bfe
cmp byte [0x10139237], 0
je 0x10006c10
cmp dword [0x1022775c], edi
je 0x10006c10
mov edx, dword [0x10227cc8]
cmp dword [edx], 0x19999
jne 0x10006b4b
call fcn.10004b50
call fcn.10009080
test al, al
je 0x10006b9a
cmp dword [0x1016b984], ebx
jne 0x10006c10
cmp dword [0x10227704], edi
jne 0x10006b88
cmp byte [0x10227709], 0
jne 0x10006b88
mov edi, dword [0x10227c20]
push 0x1012d668
mov esi, 0x10
call fcn.10007c20
xor edi, edi
mov dword [0x1022794c], edi
mov dword [0x1016b984], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
cmp byte [0x10227709], 0
je 0x10006bac
cmp byte [0x1022770a], 0
je 0x10006bbf
call fcn.100108c0
cmp byte [0x1022770a], 0
jne 0x10006bbf
call fcn.1000eff0
mov eax, dword [0x10227cc8]
cmp dword [eax], 0x19999
jne 0x10006bd1
call fcn.1000ec00
call fcn.1000f740
cmp dword [0x1017c050], eax
jge 0x10006be4
add dword [0x1017c050], ebx
mov ecx, dword [0x1016d954]
cmp ecx, dword [0x10227900]
jge 0x10006c10
add dword [0x1016d954], ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov dword [0x1016b984], ebx
mov dword [0x1022775c], edi
mov byte [0x1012d64e], bl
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret