Function at 0x10042fc3
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x100bd040]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [0x100c353c]
mov dword [esp + 0x14], edi
test ecx, ecx
je case.default.0x100433a5
add ecx, 8
mov dword [esp + 0x10], ecx
call fcn.100420e2
xor ebx, ebx
mov esi, eax
mov eax, 0x204
inc ebx
cmp edx, eax
ja 0x1004337c
je 0x10043182
mov eax, 0x100
cmp edx, 0x104
ja 0x10043149
je 0x1004324c
mov eax, edx
sub eax, 7
je 0x10043135
sub eax, ebx
je 0x10043135
sub eax, 0x18
je 0x10043114
sub eax, 0xe0
je 0x10043102
sub eax, ebx
je 0x10043102
sub eax, ebx
jne case.default.0x100433a5
push edi
call dword [sym.imp.USER32.dll_IsWindowUnicode]
test eax, eax
je 0x1004308b
mov edx, dword [ebp + 8]
lea eax, [edx - 1]
cmp eax, 0xfffe
ja case.default.0x100433a5
mov ecx, dword [esp + 0x10]
push edx
call fcn.10002816
jmp case.default.0x100433a5
and dword [esp + 0x30], 0
lea ecx, [esp + 0x30]
xor eax, eax
inc eax
push eax
push ecx
push eax
lea ecx, [ebp + 8]
push ecx
push eax
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movzx eax, word [esp + 0x30]
test eax, eax
je case.default.0x100433a5
mov ecx, dword [esp + 0x10]
cmp byte [ecx + 0x3761], 0
je case.default.0x100433a5
mov ecx, dword [0x100c353c]
xorps xmm0, xmm0
and dword [esp + 0x2c], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [ecx + 0x3780]
movlpd qword [esp + 0x28], xmm0
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 2
call fcn.1001b95e
jmp case.default.0x100433a5
mov eax, 0x100
cmp edx, eax
je 0x1004324c
jmp 0x1004324a
xor ebx, ebx
inc ebx
cmp word [ebp + 0xc], bx
jne case.default.0x100433a5
call fcn.10042215
test al, al
je case.default.0x100433a5
mov eax, ebx
jmp 0x10043475
cmp edx, 7
sete al
movzx eax, al
push eax
call fcn.10002be7
jmp case.default.0x100433a5
mov eax, edx
sub eax, 0x105
je 0x10043245
sub eax, 0xfb
je 0x100431f1
sub eax, 1
je case.0x100433a5.518
sub eax, 1
je case.0x100433a5.517
sub eax, 1
jne case.default.0x100433a5
xor edi, edi
cmp edx, 0x206
jne 0x10043184
mov edi, ebx
cmp edx, 0x207
je 0x10043194
cmp edx, 0x209
jne 0x10043197
push 2
pop edi
cmp edx, 0x20b
je 0x100431a7
cmp edx, 0x20d
jne 0x100431be
mov eax, dword [ebp + 8]
xor ecx, ecx
shr eax, 0x10
cmp ax, bx
setne cl
add ecx, 3
mov dword [esp + 0x30], ecx
mov edi, ecx
cmp dword [esi + 0xc], 0
jne 0x100431d8
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
jne 0x100431d8
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x10]
bts eax, edi
push ebx
mov dword [esi + 0xc], eax
push edi
call fcn.10002b21
jmp case.default.0x100433a5
cmp byte [esi + 8], 0
mov dword [esi + 4], edi
jne 0x10043222
and dword [esp + 0x24], 0
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], edi
call dword [sym.imp.USER32.dll_TrackMouseEvent]
mov byte [esi + 8], 1
mov ecx, dword [ebp + 0xc]
mov eax, ecx
shr eax, 0x10
cwde
movd xmm2, eax
movsx eax, cx
mov ecx, dword [esp + 0x10]
cvtdq2ps xmm2, xmm2
movd xmm1, eax
cvtdq2ps xmm1, xmm1
jmp 0x1004346e
mov eax, 0x100
xor bl, bl
cmp dword [ebp + 8], eax
jae case.default.0x100433a5
call fcn.100423af
mov esi, dword [ebp + 8]
cmp esi, 0xd
jne 0x10043275
mov eax, dword [ebp + 0xc]
shr eax, 0x10
bt ax, 8
mov eax, 0x10d
cmovb esi, eax
mov ecx, esi
call fcn.10042a7e
test eax, eax
je 0x1004328d
push ecx
push esi
mov dl, bl
mov ecx, eax
call fcn.100422b9
pop ecx
pop ecx
cmp esi, 0x10
jne 0x100432d9
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0xa0
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne 0x100432b9
push ecx
push edi
mov dl, bl
mov ecx, 0x210
call fcn.100422b9
pop ecx
pop ecx
mov edi, 0xa1
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne case.default.0x100433a5
push ecx
mov ecx, 0x214
jmp 0x1004336d
cmp esi, 0x11
jne 0x10043322
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0xa2
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne 0x10043305
push ecx
push edi
mov dl, bl
mov ecx, 0x20f
call fcn.100422b9
pop ecx
pop ecx
mov edi, 0xa3
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne case.default.0x100433a5
push ecx
mov ecx, 0x213
jmp 0x1004336d
cmp esi, 0x12
jne case.default.0x100433a5
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov edi, 0xa4
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne 0x10043352
push ecx
push edi
mov dl, bl
mov ecx, 0x211
call fcn.100422b9
pop ecx
pop ecx
mov edi, 0xa5
push edi
call esi
shr eax, 0xf
and al, 1
cmp al, bl
jne case.default.0x100433a5
push ecx
mov ecx, 0x215
push edi
mov dl, bl
call fcn.100422b9
pop ecx
pop ecx
jmp case.default.0x100433a5
mov eax, 0x219
cmp edx, eax
ja 0x1004344e
je 0x10043442
lea eax, [edx - 0x205]
cmp eax, 9
ja case.default.0x100433a5
movzx eax, byte [eax + 0x10043497]
jmp dword [eax*4 + 0x10043487]
xor ebx, ebx
cmp edx, 0x205
sete bl
cmp edx, 0x208
jne 0x100433c4
push 2
pop ebx
jmp 0x100433de
cmp edx, 0x20c
jne 0x100433de
mov eax, dword [ebp + 8]
xor ebx, ebx
shr eax, 0x10
cmp ax, 1
setne bl
add ebx, 3
mov eax, dword [esi + 0xc]
btr eax, ebx
mov dword [esi + 0xc], eax
test eax, eax
jne 0x100433ff
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, edi
jne 0x100433fb
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov ecx, dword [esp + 0x10]
push 0
push ebx
jmp 0x100431e7
mov eax, dword [ebp + 8]
xorps xmm1, xmm1
shr eax, 0x10
cwde
movd xmm2, eax
cvtdq2ps xmm2, xmm2
divss xmm2, dword [0x100b1c08]
call fcn.10002b8f
jmp case.default.0x100433a5
mov eax, dword [ebp + 8]
xorps xmm2, xmm2
shr eax, 0x10
cwde
movd xmm1, eax
cvtdq2ps xmm1, xmm1
divss xmm1, dword [0x100b1c08]
jmp 0x10043420
cmp dword [ebp + 8], 7
jne case.default.0x100433a5
mov byte [esi + 0x25], 1
jmp case.default.0x100433a5
cmp edx, 0x2a3
jne case.default.0x100433a5
cmp dword [esi + 4], edi
jne 0x1004345f
and dword [esi + 4], 0
movss xmm1, dword [0x100b1d0c]
mov byte [esi + 8], 0
movaps xmm2, xmm1
call fcn.10002a63
xor eax, eax
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10069b82
mov esp, ebp
pop ebp
ret