Function at 0x10071cc8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.10042bde
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test ax, ax
setl al
push 0x11
mov byte [esi + 9], al
call edi
test ax, ax
setl al
and byte [esi + 8], 0
and byte [esi + 0xb], 0
and byte [esi + 0xc], 0
push 0x90
mov byte [esi + 0xa], al
mov byte [esi + 0xd], 1
call edi
and eax, 1
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x10071f48
mov ebx, dword [ebp + 8]
push ebx
call edi
push 0x10
test ax, ax
pop ecx
setl al
cmp ebx, ecx
mov byte [esi + 0xc], al
je 0x10071f3c
push 0x11
pop edx
cmp ebx, edx
je 0x10071f3c
cmp dword [ebp - 4], 0
je 0x10071d5b
cmp ebx, 0x5f
jle 0x10071d5b
cmp ebx, 0x6a
jge 0x10071d5b
mov byte [esi + 0xb], 1
add ebx, 0xffffffd0
jmp 0x10071d7f
cmp ebx, 0x69
jle 0x10071d6e
cmp ebx, 0x70
jge 0x10071d6e
mov byte [esi + 0xb], 1
add ebx, 0xffffffc0
jmp 0x10071d7f
cmp ebx, 0x6f
jle 0x10071d86
cmp ebx, 0x7f
jge 0x10071d86
mov byte [esi + 8], 1
add ebx, 0xffffffb9
mov dword [esi], ebx
jmp 0x10071f4d
cmp ebx, 0x24
jg 0x10071e68
je 0x10071e59
cmp ebx, 0x14
jg 0x10071e08
je 0x10071df9
push 8
mov eax, ebx
pop ecx
sub eax, ecx
je 0x10071e86
dec eax
je 0x10071dea
sub eax, 3
je 0x10071ddb
dec eax
je 0x10071dcc
sub eax, 6
jne 0x10071eee
mov byte [esi + 8], 1
mov dword [esi], 0x16
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0xd
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 7
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x12
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x17
jmp 0x10071f4d
mov eax, ebx
sub eax, 0x1b
je 0x10071e4a
sub eax, 5
je 0x10071e3b
dec eax
je 0x10071e86
dec eax
je 0x10071e30
dec eax
jne 0x10071eee
mov byte [esi + 8], 1
mov dword [esi], 4
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], edx
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x20
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x13
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 3
jmp 0x10071f4d
cmp ebx, 0x2e
jg 0x10071ed9
je 0x10071ecd
mov eax, ebx
sub eax, 0x25
je 0x10071ebe
dec eax
je 0x10071eaf
dec eax
je 0x10071ea0
dec eax
je 0x10071e91
push 5
pop ecx
sub eax, ecx
jne 0x10071eee
mov byte [esi + 8], 1
mov dword [esi], ecx
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0xf
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 2
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0xe
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 1
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 6
jmp 0x10071f4d
mov eax, ebx
sub eax, 0x5b
je 0x10071f30
dec eax
je 0x10071f24
dec eax
je 0x10071f18
sub eax, 0x33
je 0x10071f0c
dec eax
je 0x10071f00
push ebx
mov ecx, esi
call fcn.10072014
movzx eax, al
mov dword [esi], eax
mov dword [esi + 4], ebx
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x19
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x18
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x3a
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x39
jmp 0x10071f4d
mov byte [esi + 8], 1
mov dword [esi], 0x38
jmp 0x10071f4d
mov byte [esi + 8], 1
add ebx, 0x55
jmp 0x10071d7f
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8