Function at 0x1001ddc0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b0d41
mov eax, dword fs:[0]
push eax
sub esp, 0x15c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x164], esi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x15c], eax
cmp ebx, 0x100
je 0x1001de15
cmp ebx, 0x101
jne 0x1001de21
cmp edi, 0xff
je 0x1001e254
cmp ebx, 0x100
je 0x1001de35
cmp ebx, 0x101
jne 0x1001df60
cmp edi, 0xd
jne 0x1001df60
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1001df60
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1001df60
mov eax, dword [esi + 0x108]
lea ecx, [ebp - 0x128]
add eax, 0xedc
push eax
call fcn.10009bd0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x128]
cmp dword [ebp - 0x114], 0x10
mov ecx, 0x100bd370
cmovae eax, dword [ebp - 0x128]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001dec1
test dl, dl
je 0x1001debd
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001dec1
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001dea1
xor eax, eax
jmp 0x1001dec6
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001e0b4
cmp dword [ebp - 0x114], 0x10
lea eax, [ebp - 0x128]
mov ecx, 0x100bd380
cmovae eax, dword [ebp - 0x128]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x1001df07
test dl, dl
je 0x1001df03
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x1001df07
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001dee7
xor eax, eax
jmp 0x1001df0c
sbb eax, eax
or eax, 1
test eax, eax
je 0x1001e0b4
mov edx, 0x100bd398
lea ecx, [ebp - 0x128]
call fcn.10012400
test al, al
je 0x1001df3b
mov eax, dword [esi + 0x108]
cmp byte [eax + 0xeb8], 3
je 0x1001e0b4
mov ecx, dword [esi + 0x108]
call fcn.1001dd10
test al, al
jne 0x1001e0b4
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], 0xffffffff
call fcn.10003e50
cmp ebx, 0x100
jne 0x1001e185
lea eax, [edi - 1]
cmp eax, 0xfe
ja 0x1001e254
cmp edi, 0xe5
je 0x1001e254
cmp byte [ebp + 0x18], 0
jne 0x1001e254
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp - 0x158]
sar ebx, 0x10
push 0x100bd3ac
and ebx, 0xff
call fcn.10003df0
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x140]
mov eax, dword [esi + 0x108]
add eax, 0xedc
push eax
call fcn.10009bd0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x148]
cmp dword [ebp - 0x130], ecx
jb 0x1001e00e
cmp dword [ebp - 0x144], 0x10
lea eax, [ebp - 0x158]
push ecx
cmovae eax, dword [ebp - 0x158]
push ecx
push eax
lea ecx, [ebp - 0x140]
call fcn.1001e280
mov ecx, dword [ebp - 0x130]
sub ecx, dword [ebp - 0x148]
cmp eax, ecx
je 0x1001e03a
mov edx, str.com.ldspace.sdk.demo
lea ecx, [ebp - 0x140]
call fcn.10012400
test al, al
jne 0x1001e03a
mov edx, 0x100bd3c8
lea ecx, [ebp - 0x140]
call fcn.10012400
test al, al
je 0x1001e0c4
push 1
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
push ecx
mov ecx, dword [esi + 0x108]
push eax
call fcn.10024ad0
test al, al
jne 0x1001e0c4
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor eax, eax
push eax
push 2
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x110]
push eax
push ebx
push edi
call dword [sym.imp.USER32.dll_ToUnicode]
test eax, eax
jle 0x1001e0c4
mov ecx, dword [esi + 0x108]
lea eax, [ebp - 0x160]
push eax
call fcn.1001dc60
lea ecx, [ebp - 0x140]
call fcn.10003e50
lea ecx, [ebp - 0x158]
call fcn.10003e50
jmp 0x1001e254
lea ecx, [ebp - 0x128]
call fcn.10003e50
jmp 0x1001e254
mov ecx, dword [esi + 0x108]
mov al, byte [ecx + 0xeb4]
test al, al
jne 0x1001e0dd
call fcn.1001dd10
test al, al
jne 0x1001e099
push 0
push ecx
mov ecx, dword [esi + 0x108]
push edi
call fcn.10024ad0
test al, al
je 0x1001e100
mov eax, dword [esi + 0x108]
mov al, byte [eax + 0xeb4]
test al, al
jne 0x1001e099
push 0
push 0x14
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp ebx, eax
je 0x1001e099
push 0
push 0x90
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp ebx, eax
je 0x1001e099
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
and al, 1
cmp al, byte [esi + 4]
je 0x1001e15a
mov byte [esi + 4], al
mov esi, dword [ebp - 0x15c]
push 0
push 0x14
mov esi, dword [esi]
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebp - 0x15c]
push eax
call dword [esi + 0xc]
mov esi, dword [ebp - 0x164]
mov eax, dword [ebp - 0x15c]
mov edx, ebx
push 1
push ecx
mov byte [edi + esi + 6], 1
mov ecx, edi
mov esi, dword [eax]
call fcn.10024a00
mov ecx, dword [ebp - 0x15c]
add esp, 4
push eax
call dword [esi + 8]
jmp 0x1001e099
cmp ebx, 0x101
je 0x1001e195
cmp ebx, 0x105
jne 0x1001e1f7
mov ebx, dword [ebp + 0x14]
sar ebx, 0x10
and ebx, 0xff
cmp edi, 0xe5
jne 0x1001e1b4
push 1
push ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov edi, eax
cmp byte [esi + edi + 6], 0
lea eax, [esi + edi]
je 0x1001e1f4
lea ecx, [edi - 1]
cmp ecx, 0xfe
ja 0x1001e1f4
mov byte [eax + 6], 0
mov edx, ebx
mov eax, dword [ebp - 0x15c]
push 0
push ecx
mov ecx, edi
mov esi, dword [eax]
call fcn.10024a00
mov ecx, dword [ebp - 0x15c]
add esp, 4
push eax
call dword [esi + 8]
mov esi, dword [ebp - 0x164]
mov ebx, dword [ebp + 0xc]
cmp ebx, 8
je 0x1001e201
cmp ebx, 7
jne 0x1001e254
xor edi, edi
lea ebx, [esi + 6]
cmp byte [ebx + edi], 0
je 0x1001e24b
push edi
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x1001e24b
push 0
push edi
mov byte [ebx + edi], 0
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov esi, dword [ebp - 0x15c]
mov edx, eax
push 0
push ecx
mov ecx, edi
mov esi, dword [esi]
call fcn.10024a00
mov ecx, dword [ebp - 0x15c]
add esp, 4
push eax
call dword [esi + 8]
inc edi
cmp edi, 0x100
jl 0x1001e206
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100ad688
mov esp, ebp
pop ebp
ret 0x18