Function at 0x1000e1f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019bc0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x10023018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, str._knFpjkm
sub esi, 0x74bf9ec2
mov ecx, esi
lea eax, [ebp - 0x1c]
call fcn.10016030
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
test eax, eax
setne al
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp al, bl
je 0x1000e2eb
mov ecx, esi
lea eax, [ebp - 0x1c]
call fcn.10016030
mov dword [ebp - 4], 1
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
add eax, 7
mov dword [0x1011f4d8], eax
mov dword [ebp - 4], edi
je 0x1000e2eb
mov ecx, esi
lea eax, [ebp - 0x1c]
mov dword [0x1011faac], 1
call fcn.10016030
cmp byte [0x1011f946], 1
jne 0x1000e2c0
mov dword [ebp - 4], 2
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
mov ecx, eax
call fcn.10002c40
mov dword [ebp - 4], edi
jmp 0x1000e2eb
mov dword [ebp - 4], 3
mov ecx, dword [0x1011f940]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
mov esi, eax
call fcn.10002c00
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov word [ebp - 0x14], ax
cmp dword [0x1011fb08], ebx
je 0x1000e428
mov eax, dword [0x1011fae4]
cmp eax, 4
ja case.0x1000e301.0
jmp dword [eax*4 + 0x1000e688]
mov eax, 5
jmp 0x1000e322
mov eax, 4
jmp 0x1000e322
mov eax, 2
jmp 0x1000e322
mov eax, 6
fld dword [0x1001e7d8]
push eax
push ecx
fstp dword [esp]
call fcn.10009b60
push eax
call fcn.10009770
mov esi, eax
mov dword [0x1011fafc], ebx
mov dword [0x1011fb00], ebx
cmp dword [0x1011faac], ebx
je 0x1000e3b0
mov eax, dword [0x1011fac4]
cmp esi, ebx
je 0x1000e3c9
cmp eax, 3
ja case.0x1000e35c.0
jmp dword [eax*4 + 0x1000e69c]
fld dword [0x1001e7dc]
jmp 0x1000e381
fld dword [0x1001e7d8]
jmp 0x1000e381
fld dword [0x1001e7d4]
jmp 0x1000e381
fld dword [0x1001e7d0]
fstp dword [ebp - 0x20]
push 0xffff0000
fld dword [ebp - 0x20]
push 0x23
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
cmp esi, ebx
je 0x1000e422
mov eax, dword [0x1011fae4]
cmp eax, 4
ja case.0x1000e3c2.0
jmp dword [eax*4 + 0x1000e6ac]
cmp eax, 3
ja case.0x1000e3ce.0
jmp dword [eax*4 + 0x1000e6c0]
fld dword [0x1001e7dc]
jmp 0x1000e3f3
fld dword [0x1001e7d8]
jmp 0x1000e3f3
fld dword [0x1001e7d4]
jmp 0x1000e3f3
fld dword [0x1001e7d0]
fstp dword [ebp - 0x20]
push 0xff00ff00
fld dword [ebp - 0x20]
push 0x23
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
mov byte [0x1011f946], bl
cmp dword [0x1011fa94], ebx
je 0x1000e66b
mov eax, dword [0x1011fae4]
cmp eax, 4
ja case.0x1000e442.0
jmp dword [eax*4 + 0x1000e6d0]
mov edi, 5
jmp 0x1000e463
mov edi, 4
jmp 0x1000e463
mov edi, 2
jmp 0x1000e463
mov edi, 6
push esi
call fcn.10008aa0
mov esi, eax
call fcn.100089c0
fld dword [eax + 0x30]
fstp dword [ebp - 0x2c]
call fcn.100089c0
fld dword [eax + 0x34]
fstp dword [ebp - 0x28]
call fcn.100089c0
fld dword [eax + 0x38]
mov ecx, dword [ebp - 0x2c]
fstp dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
fld dword [ebp - 0x28]
push 1
fadd qword [0x1001eda8]
mov dword [0x10120098], ecx
mov dword [0x101200a0], eax
fstp dword [ebp - 0x28]
mov edx, dword [ebp - 0x28]
mov dword [0x1012009c], edx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne cl
mov byte [0x1011f946], cl
jmp 0x1000e428
mov eax, 5
jmp 0x1000e4e5
mov eax, 4
jmp 0x1000e4e5
mov eax, 2
jmp 0x1000e4e5
mov eax, 6
mov ecx, dword [0x1011fac4]
cmp ecx, 3
ja case.0x1000e4f0.0
jmp dword [ecx*4 + 0x1000e6e4]
fld dword [0x1001e7dc]
jmp 0x1000e515
fld dword [0x1001e7d8]
jmp 0x1000e515
fld dword [0x1001e7d4]
jmp 0x1000e515
fld dword [0x1001e7d0]
fstp dword [ebp - 0x20]
push eax
fld dword [ebp - 0x20]
push ecx
fstp dword [esp]
call fcn.10009b60
push eax
call fcn.10009770
mov esi, eax
cmp dword [0x1011fac0], ebx
je 0x1000e59b
mov eax, dword [0x1011fac4]
cmp esi, ebx
je 0x1000e5da
cmp eax, 3
ja case.0x1000e547.0
jmp dword [eax*4 + 0x1000e6f4]
fld dword [0x1001e7dc]
jmp 0x1000e56c
fld dword [0x1001e7d8]
jmp 0x1000e56c
fld dword [0x1001e7d4]
jmp 0x1000e56c
fld dword [0x1001e7d0]
fstp dword [ebp - 0x20]
push 0xffff0000
fld dword [ebp - 0x20]
push 0x1e
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
cmp esi, ebx
je 0x1000e633
test byte [0x1012011c], 1
jne 0x1000e5cf
or dword [0x1012011c], 1
push str.mouse_event
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10120118], eax
push ebx
push ebx
push ebx
push ebx
push 2
jmp 0x1000e665
cmp eax, 3
ja case.0x1000e5df.0
jmp dword [eax*4 + 0x1000e704]
fld dword [0x1001e7dc]
jmp 0x1000e604
fld dword [0x1001e7d8]
jmp 0x1000e604
fld dword [0x1001e7d4]
jmp 0x1000e604
fld dword [0x1001e7d0]
fstp dword [ebp - 0x20]
push 0xff36e7ff
fld dword [ebp - 0x20]
push 0x1e
sub esp, 0xc
fstp dword [esp + 8]
fld dword [0x1011c570]
fstp dword [esp + 4]
fld dword [0x1011f4d4]
fstp dword [esp]
call fcn.1000bba0
add esp, 0x14
test byte [0x1012011c], 1
jne 0x1000e65f
or dword [0x1012011c], 1
push str.mouse_event
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10120118], eax
push ebx
push ebx
push ebx
push ebx
push 4
call dword [0x10120118]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017c55
mov esp, ebp
pop ebp
ret