Function at 0x101b7320
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov ecx, dword [eax + 4]
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
lea eax, [ecx - 0xd]
cmp eax, 0x1b
ja case.0x101b734a.14
movzx eax, byte [eax + 0x101b7580]
jmp dword [eax*4 + 0x101b755c]
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je case.0x101b734a.27
cmp dword [ecx + 0x10], 0
je 0x101b7370
pop edi
pop esi
mov eax, 0x10000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ecx + 4], 0x800
je case.0x101b734a.27
mov eax, dword [ecx + 8]
test al, 3
jne case.0x101b734a.27
mov edx, 0x8010
test eax, 0x10000
jne 0x101b739f
mov eax, dword [ecx + 0xc]
mov edx, 0xc010
mov dword [ebx + 8], eax
mov ecx, dword [ecx + 0xc]
mov eax, edx
pop edi
pop esi
mov dword [ebx + 0xc], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0x800
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0x1000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0x200
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0x80
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0x100
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0x400
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push ecx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswalnum]
add esp, 4
test eax, eax
je 0x101b754e
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call esi
test ax, ax
js 0x101b754e
push 0x11
call esi
test ax, ax
js 0x101b754e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x101b754e
mov edx, dword [eax + 0x14]
xor ecx, ecx
mov esi, dword [eax + 0x10]
mov edi, edx
mov dword [ebp + 8], edx
mov ebx, edx
mov dword [ebp + 0x10], ecx
cmp esi, edx
je 0x101b74ce
mov eax, dword [esi]
mov dword [ebp - 0xc], eax
add eax, 0x1c
mov dword [ebp - 0x10], esi
cmp dword [eax + 0x14], 8
jb 0x101b746a
mov eax, dword [eax]
push 0x26
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcschr]
add esp, 8
test eax, eax
je 0x101b7480
movzx eax, word [eax + 2]
jmp 0x101b7482
xor eax, eax
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towupper]
mov ecx, dword [ebp + 0xc]
add esp, 4
cmp ax, word [ebp - 8]
mov eax, dword [ebp + 8]
mov ecx, dword [ecx + 0x14]
jne 0x101b74af
cmp eax, ecx
jne 0x101b74a7
cmp edi, ecx
jne 0x101b74ac
mov edi, esi
jmp 0x101b74ac
cmp ebx, ecx
cmove ebx, esi
inc dword [ebp + 0x10]
mov edx, dword [ebp - 0xc]
add esi, 4
test byte [edx + 4], 0x80
mov edx, dword [ebp - 0x10]
cmove edx, eax
mov dword [ebp + 8], edx
cmp esi, ecx
jne 0x101b7457
mov eax, dword [ebp + 0xc]
mov edx, ecx
mov ecx, dword [ebp + 0x10]
cmp ebx, edx
jne 0x101b74d8
cmp edi, edx
je 0x101b754e
mov ebx, edi
mov esi, dword [ebx]
test esi, esi
je 0x101b754e
cmp ecx, 1
jg 0x101b7529
cmp dword [esi + 0xc], 0
jne 0x101b7529
mov eax, dword [esi + 4]
test al, 3
je 0x101b74fe
pop edi
pop esi
mov eax, 0x4000
pop ebx
mov esp, ebp
pop ebp
ret 0x10
test eax, 0x10000
mov edx, 0x8010
mov eax, dword [ebp - 4]
jne 0x101b7518
mov ecx, dword [esi + 8]
mov edx, 0xc010
mov dword [eax + 8], ecx
mov ecx, dword [esi + 8]
pop edi
pop esi
mov dword [eax + 0xc], ecx
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push ecx
mov edx, 0x80
mov ecx, eax
call fcn.10121290
add esp, 4
mov eax, 0x8400
or dword [esi + 4], 0x80
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10