Function at 0x10022be0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10186e00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp byte [0x1027351c], 0
je 0x1002372d
mov ecx, dword [0x1023d1cc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov ecx, dword [0x1023d20c]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push eax
call edx
mov al, byte [0x10237a94]
mov byte [ebp - 0x1a], al
mov al, byte [0x1026ebf0]
mov byte [ebp - 0x19], al
mov edi, dword [0x1023d288]
test edi, edi
je 0x100236dd
mov eax, dword [0x1023d284]
test eax, eax
jne 0x10022c93
mov edx, 0xe80c2f78
mov ecx, 0x1021170d
call fcn.100050d0
mov esi, eax
mov edx, 0xc10bf213
mov ecx, 0x10211635
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d284], eax
cmp dword [edi + eax], 0
jle 0x100236dd
push dword [0x10273518]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
cwde
shr eax, 0x10
test eax, eax
je 0x10022cd5
cmp byte [0x1026ebf0], 0
jne 0x10022cd5
cmp byte [0x10237a94], 0
jne 0x10022cd5
cmp byte [0x102370b4], 0
jne 0x10022cd5
mov byte [0x1026ebf0], 1
push dword [0x10273508]
call esi
cwde
shr eax, 0x10
test eax, eax
je 0x10022d04
cmp byte [0x10237a94], 0
jne 0x10022d04
mov byte [0x1026ebf0], 0
mov ecx, dword [ebx + 8]
add ecx, 0xc
lea eax, [ebp - 0x44]
push eax
call fcn.1011f650
push dword [0x10273514]
call esi
cwde
shr eax, 0x10
test eax, eax
je 0x1002300a
cmp byte [0x1026ebf0], 0
jne 0x1002300a
cmp byte [0x10237a94], 0
jne 0x1002300a
cmp byte [0x102370b4], 0
jne 0x1002300a
mov edi, dword [0x1026ec04]
mov ecx, edi
mov esi, dword [0x1026ec00]
sub ecx, esi
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1002300a
or ecx, 0xffffffff
mov dword [ebp - 0x24], ecx
movss xmm3, dword [0x1022fc14]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], ecx
nop
sub edi, esi
mov eax, 0x88888889
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ecx
jbe 0x10023743
mov edi, dword [ebp - 0x28]
mov ecx, dword [edi + esi + 0x34]
sub ecx, dword [edi + esi + 0x30]
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10023748
mov eax, dword [edi + esi + 0x30]
movss xmm1, dword [eax + 0x1c]
subss xmm1, dword [0x1023992c]
movss xmm2, dword [eax + 0x20]
subss xmm2, dword [0x10239930]
movss xmm0, dword [eax + 0x24]
subss xmm0, dword [0x10239934]
mov dword [ebp - 0x48], 0
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
movss dword [ebp - 0x28], xmm2
sqrtss xmm0, dword [ebp - 0x28]
movss dword [ebp - 0x48], xmm0
comiss xmm3, dword [ebp - 0x48]
jbe 0x10022e97
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov ecx, dword [edi + esi + 0x34]
mov esi, dword [edi + esi + 0x30]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10023748
movss xmm1, dword [esi + 0x1c]
subss xmm1, dword [0x1023992c]
movss xmm2, dword [esi + 0x20]
subss xmm2, dword [0x10239930]
movss xmm0, dword [esi + 0x24]
subss xmm0, dword [0x10239934]
mov dword [ebp - 0x38], 0
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
movss dword [ebp - 0x28], xmm2
sqrtss xmm0, dword [ebp - 0x28]
movss dword [ebp - 0x38], xmm0
movss xmm3, dword [ebp - 0x38]
inc dword [ebp - 0x20]
add edi, 0x3c
mov dword [ebp - 0x28], edi
mov edi, dword [0x1026ec04]
mov ecx, edi
mov esi, dword [0x1026ec00]
sub ecx, esi
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, dword [ebp - 0x20]
cmp ecx, eax
jb 0x10022d80
mov ecx, dword [ebp - 0x24]
cmp ecx, 0xffffffff
je 0x1002372d
sub edi, esi
mov eax, 0x88888889
imul edi
add edx, edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, ecx
jbe 0x10023743
mov edi, ecx
shl edi, 4
sub edi, ecx
shl edi, 2
mov ecx, dword [edi + esi + 0x34]
mov esi, dword [edi + esi + 0x30]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x1002300a
movss xmm1, dword [esi + 0x1c]
subss xmm1, dword [0x1023992c]
movss xmm2, dword [esi + 0x20]
subss xmm2, dword [0x10239930]
movss xmm0, dword [esi + 0x24]
subss xmm0, dword [0x10239934]
mov dword [ebp - 0x48], 0
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
movss dword [ebp - 0x28], xmm2
sqrtss xmm0, dword [ebp - 0x28]
movss dword [ebp - 0x48], xmm0
movss xmm0, dword [0x10237454]
comiss xmm0, dword [ebp - 0x48]
jbe 0x1002300a
mov esi, dword [0x1026ec00]
mov ecx, dword [0x1026ec04]
sub ecx, esi
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, dword [ebp - 0x24]
jbe 0x10023743
lea eax, [esi + 0x30]
add eax, edi
push eax
lea ecx, [ebp - 0x38]
call fcn.100244e0
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x38]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
mov ecx, 0x1026ebf4
call fcn.100252a0
lea ecx, [ebp - 0x38]
call fcn.10024930
mov byte [0x1023d33e], 1
cmp byte [0x10237458], 0
je 0x10023001
mov byte [0x1023d33d], 1
mov byte [0x1023d33c], 1
jmp 0x10023017
cmp byte [0x1023d33e], 0
je 0x10023168
mov esi, dword [0x1026ebf4]
mov ecx, dword [0x1026ebf8]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10023748
movss xmm1, dword [0x1023992c]
subss xmm1, dword [esi + 0x1c]
movss xmm2, dword [0x10239930]
subss xmm2, dword [esi + 0x20]
movss xmm0, dword [0x10239934]
subss xmm0, dword [esi + 0x24]
mov dword [ebp - 0x48], 0
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
movss dword [ebp - 0x28], xmm2
sqrtss xmm0, dword [ebp - 0x28]
movss dword [ebp - 0x48], xmm0
movss xmm0, dword [0x1022f8fc]
comiss xmm0, dword [ebp - 0x48]
jb 0x100230a2
mov byte [0x1023d33e], 0
movss xmm1, dword [0x1023992c]
movss xmm0, dword [0x10239930]
mov esi, dword [0x1026ebf4]
mov ecx, dword [0x1026ebf8]
sub ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10023748
subss xmm1, dword [esi + 0x1c]
movss dword [ebp - 0x24], xmm1
subss xmm0, dword [esi + 0x20]
movss dword [ebp - 0x28], xmm0
mov esi, dword [ebx + 8]
movss xmm0, dword [esi + 0x10]
mulss xmm0, dword [0x1022f8c0]
cvtps2pd xmm1, xmm0
mulsd xmm1, qword [0x1022fa30]
movaps xmm0, xmm1
call fcn.10184c60
movaps xmm1, xmm0
shufpd xmm1, xmm0, 1
xorps xmm2, xmm2
cvtsd2ss xmm2, xmm1
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movss xmm4, dword [ebp - 0x28]
movaps xmm3, xmm4
mulss xmm3, xmm1
movss xmm5, dword [ebp - 0x24]
movaps xmm0, xmm5
mulss xmm0, xmm2
addss xmm3, xmm0
mulss xmm4, xmm2
mulss xmm5, xmm1
subss xmm4, xmm5
mulss xmm3, dword [0x1022fcac]
movss dword [esi + 0x24], xmm3
mulss xmm4, dword [0x1022fafc]
movss dword [esi + 0x28], xmm4
jmp 0x1002316b
mov esi, dword [ebx + 8]
movss xmm2, dword [0x1022f8fc]
mov al, byte [0x1023d33d]
test al, al
je 0x10023247
xor eax, eax
mov dword [esi + 0x48], eax
mov ecx, dword [0x1026ebf8]
sub ecx, dword [0x1026ebf4]
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10023748
mov eax, dword [0x1026ebf4]
movss xmm1, dword [eax + 4]
lea edi, [esi + 0xc]
movss xmm0, dword [eax]
subss xmm0, dword [edi]
subss xmm1, dword [esi + 0x10]
movss dword [ebp - 0x34], xmm0
movss dword [ebp - 0x30], xmm1
mov dword [ebp - 0x2c], 0
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
call fcn.10004fc0
comiss xmm2, xmm0
ja 0x100231f2
cmp byte [0x10237458], 0
jne 0x100231f9
mov byte [0x1023d33d], 0
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x34]
call fcn.1011f650
movss xmm1, dword [0x1022f9c8]
divss xmm1, dword [0x10237450]
movaps xmm0, xmm1
mulss xmm0, dword [ebp - 0x34]
addss xmm0, dword [edi]
movss dword [edi], xmm0
mulss xmm1, dword [ebp - 0x30]
addss xmm1, dword [esi + 0x10]
movss dword [esi + 0x10], xmm1
mov ecx, dword [0x1023d1cc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
push edi
call eax
mov al, byte [0x1023d33d]
cmp byte [0x1023d33c], 0
je 0x100233a8
test al, al
jne 0x100233a8
cmp byte [0x1023d33e], al
jne 0x100233a8
mov ecx, dword [0x1026ebf4]
mov edx, dword [0x1026ebf8]
cmp ecx, edx
je 0x100233a8
sub edx, ecx
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10023748
movss xmm1, dword [0x1023992c]
subss xmm1, dword [ecx + 0x1c]
movss xmm2, dword [0x10239930]
subss xmm2, dword [ecx + 0x20]
movss xmm0, dword [0x10239934]
subss xmm0, dword [ecx + 0x24]
mov dword [ebp - 0x48], 0
mulss xmm2, xmm2
mulss xmm1, xmm1
addss xmm2, xmm1
mulss xmm0, xmm0
addss xmm2, xmm0
movss dword [ebp - 0x28], xmm2
sqrtss xmm0, dword [ebp - 0x28]
movss dword [ebp - 0x48], xmm0
movss xmm2, dword [0x1022f8fc]
comiss xmm2, dword [ebp - 0x48]
jbe 0x100233a8
mov edi, dword [0x1026ebf4]
mov ecx, dword [0x1026ebf8]
sub ecx, edi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
je 0x10023748
movss xmm1, dword [edi + 4]
movss xmm0, dword [edi]
subss xmm0, dword [esi + 0xc]
subss xmm1, dword [esi + 0x10]
mov dword [ebp - 0x48], 0
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm0, xmm1
movss dword [ebp - 0x28], xmm0
sqrtss xmm0, dword [ebp - 0x28]
movss dword [ebp - 0x48], xmm0
comiss xmm2, dword [ebp - 0x48]
ja 0x10023361
cmp byte [0x10237458], 0
jne 0x100233a8
mov byte [0x10237a94], 1
mov ecx, dword [0x10237a9c]
cmp ecx, 0x1026ebf4
je 0x1002339c
mov esi, dword [0x1026ebf4]
mov edx, dword [0x1026ebf8]
sub edx, esi
mov eax, 0x66666667
imul edx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
push eax
push esi
call fcn.100252a0
mov byte [0x1023d33c], 0
jmp 0x1002372d
push dword [0x10273510]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x1002343a
cmp byte [0x10237a94], 0
je 0x1002343a
cmp byte [0x1026ebf0], 0
jne 0x1002343a
mov byte [0x1023d33e], 0
mov byte [0x1023d33d], 0
mov eax, dword [0x10237a9c]
mov edi, dword [eax]
mov ecx, dword [eax + 4]
sub ecx, edi
mov eax, 0x66666667
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov edx, dword [0x10237a98]
cmp ecx, edx
jbe 0x10023748
lea eax, [edx + edx*4]
movss xmm1, dword [edi + eax*8]
lea eax, [edx + edx*4]
movss xmm0, dword [edi + eax*8 + 4]
movss dword [esi + 0xc], xmm1
movss dword [esi + 0x10], xmm0
mov dword [esi + 0x14], 0
mov byte [0x10237a94], 0
mov dword [0x10237a98], 0
cmp byte [ebp - 0x19], 0
je 0x1002359e
mov eax, dword [0x102733ac]
mov edi, dword [eax + 0x1c]
dec edi
mov ecx, dword [0x1023d190]
mov eax, dword fs:[0x2c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1027b74c]
cmp eax, dword [ecx + 4]
jle 0x100234a0
push 0x1027b74c
call fcn.1018369a
add esp, 4
cmp dword [0x1027b74c], 0xffffffff
jne 0x100234a0
mov edx, str.55_8B_EC_8B_4D___56_E8_________8B_75
mov ecx, str.client.dll
call fcn.10007fd0
mov dword [0x1027b750], eax
push 0x1027b74c
call fcn.10183649
add esp, 4
push edi
push 0
call dword [0x1027b750]
mov edi, dword [0x1023d288]
mov eax, dword [0x1023d21c]
test eax, eax
jne 0x100234e9
mov edx, 0xe80c2f78
mov ecx, 0x10211651
call fcn.100050d0
mov esi, eax
mov edx, 0xc10bf213
mov ecx, 0x1021165d
call fcn.100050d0
mov edx, esi
mov ecx, eax
call fcn.1011f760
mov dword [0x1023d21c], eax
mov esi, dword [ebx + 8]
movq xmm0, qword [eax + edi]
movq qword [ebp - 0x34], xmm0
mov eax, dword [eax + edi + 8]
mov dword [ebp - 0x2c], eax
movss xmm0, dword [esi + 0xc]
movss dword [ebp - 0x70], xmm0
movss xmm0, dword [esi + 0x10]
movss dword [ebp - 0x6c], xmm0
movss xmm0, dword [esi + 0x24]
movss dword [ebp - 0x68], xmm0
movss xmm0, dword [esi + 0x28]
movss dword [ebp - 0x64], xmm0
movss xmm0, dword [esi + 0x2c]
movss dword [ebp - 0x60], xmm0
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x5c], eax
movzx eax, word [esi + 0x48]
mov word [ebp - 0x58], ax
movzx eax, word [esi + 0x4a]
mov word [ebp - 0x56], ax
movss xmm0, dword [ebp - 0x34]
movss dword [ebp - 0x54], xmm0
movss xmm0, dword [ebp - 0x30]
movss dword [ebp - 0x50], xmm0
movss xmm0, dword [ebp - 0x2c]
movss dword [ebp - 0x4c], xmm0
mov eax, dword [0x1026ebf8]
cmp eax, dword [0x1026ebfc]
je 0x1002358f
movups xmm0, xmmword [ebp - 0x70]
movups xmmword [eax], xmm0
movups xmm0, xmmword [ebp - 0x60]
movups xmmword [eax + 0x10], xmm0
movq xmm0, qword [ebp - 0x50]
movq qword [eax + 0x20], xmm0
add dword [0x1026ebf8], 0x28
jmp 0x1002359e
lea ecx, [ebp - 0x70]
push ecx
push eax
mov ecx, 0x1026ebf4
call fcn.10025920
cmp byte [ebp - 0x1a], 0
je 0x100236e0
mov ecx, dword [0x10237a98]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
wait
lea edi, [esi + 0xc]
movq xmm0, qword [edi]
movq qword [ebp - 0x34], xmm0
mov eax, dword [edi + 8]
mov dword [ebp - 0x2c], eax
push ecx
mov ecx, 0x1026ebf4
call fcn.100244a0
mov edx, eax
mov ecx, dword [edx]
mov dword [edi], ecx
movss xmm0, dword [edx + 4]
movss dword [esi + 0x10], xmm0
movss xmm0, dword [edx + 8]
movss dword [esi + 0x24], xmm0
movss xmm0, dword [edx + 0xc]
movss dword [esi + 0x28], xmm0
movss xmm0, dword [edx + 0x10]
movss dword [esi + 0x2c], xmm0
mov eax, dword [edx + 0x14]
mov dword [esi + 0x30], eax
movzx eax, word [edx + 0x18]
mov word [esi + 0x48], ax
movzx eax, word [edx + 0x1a]
mov word [esi + 0x4a], ax
movq xmm0, qword [edi]
movq qword [ebp - 0x44], xmm0
mov eax, dword [edi + 8]
mov dword [ebp - 0x3c], eax
cmp byte [0x10237458], 0
je 0x10023642
mov ecx, dword [0x1023d1cc]
mov eax, dword [ecx]
mov eax, dword [eax + 0x4c]
push edi
call eax
jmp 0x10023669
movss xmm0, dword [ebp - 0x34]
movss dword [edi], xmm0
movss xmm0, dword [ebp - 0x30]
movss dword [esi + 0x10], xmm0
movss xmm0, dword [ebp - 0x2c]
movss dword [esi + 0x14], xmm0
lea edx, [ebp - 0x44]
mov ecx, esi
call fcn.1001d510
mov edi, dword [ebp - 0x28]
inc edi
mov ecx, dword [0x1026ebf8]
sub ecx, dword [0x1026ebf4]
mov eax, 0x66666667
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jne 0x100236a9
mov byte [0x10237a94], 0
mov dword [0x10237a98], 0
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x100236e0
mov dword [0x10237a98], edi
wait
mov dword [ebp - 4], 0xffffffff
jmp 0x100236e0
mov esi, dword [ebx + 8]
push dword [0x1027350c]
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
shr eax, 0x10
test eax, eax
je 0x10023721
cmp byte [0x102370b4], 0
jne 0x10023721
cmp byte [0x1026ebf0], 0
jne 0x10023721
cmp byte [0x10237a94], 0
jne 0x10023721
mov eax, dword [0x1026ebf4]
cmp eax, dword [0x1026ebf8]
je 0x10023721
mov dword [0x1026ebf8], eax
lea eax, [ebp - 0x44]
push eax
lea ecx, [esi + 0xc]
call fcn.1011f650
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4
call fcn.10024920
call fcn.10024920
int3