Function at 0x10021380
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [0x101205a0], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0xc], ebx
je 0x100216e3
mov eax, dword [0x1011e218]
mov ecx, dword [0x10120590]
dec eax
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
cmp eax, 3
ja case.default.0x100213b8
jmp dword [eax*4 + 0x100216ec]
push ecx
call edi
test ax, ax
setne al
jmp 0x100213e3
push ecx
call esi
test ax, ax
setne al
jmp 0x100213e3
push ecx
call edi
test ax, ax
sete al
jmp 0x100213e3
mov al, byte [ebp + 0xb]
test al, al
je 0x100216e3
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x6c]
call eax
test al, al
je 0x100216e3
mov ecx, dword [0x101202f8]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x100216e3
mov eax, dword [0x10120420]
mov dword [ebp - 8], eax
test eax, eax
je 0x100216e3
mov eax, dword [0x10120334]
test eax, eax
jne 0x10021465
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110195
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x10120334], eax
mov ecx, dword [ebp - 8]
cmp dword [eax + ecx], 0
jle 0x100216e3
call fcn.1000f8e0
cmp eax, 9
je 0x100216e3
call fcn.1000f8e0
cmp eax, 8
je 0x100216e3
mov eax, dword [0x1011e208]
mov ecx, dword [0x10120588]
dec eax
cmp eax, 3
ja case.default.0x1002149f
jmp dword [eax*4 + 0x100216fc]
push ecx
call edi
test ax, ax
setne al
jmp 0x100214ca
push ecx
call esi
test ax, ax
setne al
jmp 0x100214ca
push ecx
call edi
test ax, ax
sete al
jmp 0x100214ca
mov al, byte [ebp + 0xb]
test al, al
je 0x100214e1
mov dword [0x101209f8], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [ebx + 1], 0
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x30]
mov dword [ebp - 4], ecx
jne 0x100216b7
xor ebx, ebx
mov dword [ebp - 8], ebx
nop dword [eax]
mov eax, dword [0x101204a8]
mov ecx, dword [eax + 0x1c]
dec ecx
call fcn.1001f950
mov ecx, dword [esi + 0x30]
mov eax, ecx
or eax, 4
and ecx, 0xfffffffb
test ebx, ebx
cmovne ecx, eax
xor edi, edi
mov dword [esi + 0x30], ecx
call fcn.10023560
push esi
mov ecx, eax
call fcn.1000fb40
call fcn.10023560
mov ecx, dword [0x10120420]
mov esi, eax
mov dword [ecx + 0x3348], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0xffffffff
mov ecx, dword [0x101204cc]
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [0x101202ec]
mov ecx, dword [esi]
mov ebx, dword [0x10120420]
mov dword [ebp - 0x10], ebx
mov dword [eax + 0x10], ecx
mov eax, dword [0x101202ec]
mov ecx, dword [esi + 4]
mov dword [eax + 0x14], ecx
mov ecx, dword [0x101204a8]
mov al, byte [esi + 0x28]
mov byte [ecx + 8], al
mov al, byte [esi + 0x29]
mov byte [ecx + 0x18], al
mov eax, dword [0x101202e0]
mov byte [esi + 0xf0], 0
test eax, eax
jne 0x100215db
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x101100a1
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100ad
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov ebx, dword [0x10120420]
mov dword [0x101202e0], eax
mov ecx, dword [ebp - 0x10]
test byte [eax + ecx], 1
jne 0x1002167f
mov eax, dword [0x101204a4]
test eax, eax
jne 0x10021622
call fcn.100034c0
mov edx, 0xe80c2f78
mov ecx, 0x10110509
call fcn.100018f0
mov edx, 0xc10bf213
mov ecx, 0x101100c5
mov esi, eax
call fcn.100018f0
push esi
push eax
call fcn.1008e510
mov dword [0x101204a4], eax
movss xmm0, dword [eax + ebx + 8]
movss dword [ebp - 0x10], xmm0
call fcn.10023560
movss xmm0, dword [0x10117040]
comiss xmm0, dword [eax + 0x18]
jbe 0x10021652
movss xmm0, dword [ebp - 0x10]
ucomiss xmm0, dword [0x10117168]
lahf
test ah, 0x44
jnp 0x10021667
mov ebx, dword [ebp - 0xc]
inc edi
mov esi, dword [ebp + 8]
mov byte [ebx + 1], 0
cmp edi, 4
jge 0x10021682
jmp 0x10021523
cmp dword [ebp - 8], 0
mov ebx, dword [ebp - 0xc]
mov byte [ebx + 1], 1
je 0x100216a1
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x30]
mov dword [ebp - 4], eax
jmp 0x10021685
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, 2
jl 0x10021500
mov dword [esi + 0x30], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov byte [ebx + 1], 0
mov dword [eax + 0x30], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
or ecx, 4
mov dword [esi + 0x30], ecx
cmp eax, dword [0x101209f8]
jle 0x100216e3
call fcn.10023560
movss xmm0, dword [eax + 0x18]
ucomiss xmm0, dword [0x10117168]
lahf
test ah, 0x44
jnp 0x100216e3
mov byte [ebx + 1], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4