Function at 0x1001fb20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x1015819f], 0
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x1001fb7d
mov eax, dword [0x1011f218]
mov ecx, dword [0x10158198]
dec eax
cmp eax, 3
ja case.default.0x1001fb4e
jmp dword [eax*4 + 0x1001fd84]
push ecx
call esi
test ax, ax
setne al
jmp 0x1001fb79
push ecx
call edi
test ax, ax
setne al
jmp 0x1001fb79
push ecx
call esi
test ax, ax
sete al
jmp 0x1001fb79
mov al, byte [ebp - 1]
test al, al
jne case.0x1001fb4e.1
call fcn.1001a8f0
mov byte [eax + 0x19], 0
cmp byte [0x101581a4], 0
je 0x1001fbcf
mov eax, dword [0x1011f21c]
mov ecx, dword [0x10158178]
dec eax
cmp eax, 3
ja case.default.0x1001fba0
jmp dword [eax*4 + 0x1001fd94]
push ecx
call esi
test ax, ax
setne al
jmp 0x1001fbcb
push ecx
call edi
test ax, ax
setne al
jmp 0x1001fbcb
push ecx
call esi
test ax, ax
sete al
jmp 0x1001fbcb
mov al, byte [ebp - 1]
test al, al
jne case.0x1001fba0.1
call fcn.1001a8f0
mov byte [eax + 0x1b], 0
cmp byte [0x1015819e], 0
je 0x1001fbee
push dword [0x101581a0]
call esi
test ax, ax
jne 0x1001fbf7
call fcn.1001a8f0
mov byte [eax + 0x18], 0
cmp byte [0x10158171], 0
je 0x1001fc40
mov eax, dword [0x1011f208]
mov ecx, dword [0x10158184]
dec eax
cmp eax, 3
ja case.default.0x1001fc11
jmp dword [eax*4 + 0x1001fda4]
push ecx
call esi
test ax, ax
setne al
jmp 0x1001fc3c
push ecx
call edi
test ax, ax
setne al
jmp 0x1001fc3c
push ecx
call esi
test ax, ax
sete al
jmp 0x1001fc3c
mov al, byte [ebp - 1]
test al, al
jne case.0x1001fc11.1
call fcn.1001a8f0
mov byte [eax + 0x1a], 0
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x1001fcb5
mov ecx, dword [0x10122698]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001fcb5
mov edi, dword [0x101227d4]
test edi, edi
je 0x1001fcb5
mov eax, dword [0x101226d4]
test eax, eax
jne 0x1001fcaf
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x101100f5
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x101226d4], eax
cmp dword [eax + edi], 0
jg 0x1001fcd9
call fcn.1001a8f0
mov byte [eax + 0x18], 0
call fcn.1001a8f0
mov byte [eax + 0x19], 0
call fcn.1001a8f0
mov byte [eax + 0x1a], 0
call fcn.1001a8f0
mov byte [eax + 0x1b], 0
call fcn.1000f990
cmp eax, 9
je 0x1001fced
call fcn.1000f990
cmp eax, 8
jne 0x1001fd11
call fcn.1001a8f0
mov byte [eax + 0x18], 0
call fcn.1001a8f0
mov byte [eax + 0x19], 0
call fcn.1001a8f0
mov byte [eax + 0x1a], 0
call fcn.1001a8f0
mov byte [eax + 0x1b], 0
mov eax, dword [0x10122680]
mov edi, dword [0x101227d4]
test eax, eax
jne 0x1001fd51
call fcn.10003520
mov edx, 0xe80c2f78
mov ecx, 0x10110001
call fcn.10001980
mov edx, 0xc10bf213
mov ecx, 0x1011000d
mov esi, eax
call fcn.10001980
push esi
push eax
call fcn.1008c3b0
mov dword [0x10122680], eax
test byte [eax + edi], 1
je 0x1001fd7b
call fcn.1001a8f0
mov byte [eax + 0x18], 0
call fcn.1001a8f0
mov byte [eax + 0x19], 0
call fcn.1001a8f0
mov byte [eax + 0x1a], 0
call fcn.1001a8f0
mov byte [eax + 0x1b], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret