Function at 0x6f9651
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x37c
mov eax, 0x7af79b
call fcn.00774621
mov ebx, ecx
xor eax, eax
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x380], eax
push 0x6b
pop ecx
mov esi, str.ksUtrb497cgheqLu89QrHH5FF1lfLvIuaiYAAEadGo6NfRxbH9KqfbLGI61EDxXflPGbnxNSriSHHcCPydvWSSTYDOAtVl4cj6C36jNhT3FUkwCp5yKeGPOemFWwbKSmpcxMflkPw6GZ3KmoRCtFAW5aSfJ15WDMJjeBmLWH2Mqtr1M29NHb5tLrFGtEx5vVxr9X7kyoZizNGaSEZ9DPTBkcXnK2fXmKdME2Wbaz1EmPrL993vkkjukFR7F4sUqteAXhzrx09WXq9sSKm1RMmAhjyKw6YjtUAprfyLYfy4sT2GDQKiqaJGJRJvFFD00Rv6NprZuFFnhYOJ91dNR8jPoUNZNUUhWdAFcAnIR3j9lAKitXOCQMkjdrwLeSHLYSzlfqB59IwfJC8tjDsIaWlXgwY3EpQiAy9PAW5wgC2aGV
mov dword [ebp - 4], eax
lea edi, [ebp - 0x338]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x338]
push eax
lea ecx, [ebp - 0x370]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
xor eax, eax
lea ecx, [ebp - 0x388]
inc eax
mov dword [ebp - 0x37c], eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x370]
push eax
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x370]
mov byte [ebp - 4], 0
call fcn.006eb1be
lea ecx, [ebx + 0xec]
xor edi, edi
call fcn.00402e90
test eax, eax
jle 0x6f9725
mov esi, dword [ebp + 8]
push edi
lea ecx, [ebx + 0xec]
mov byte [ebp - 0x371], 0
call fcn.006f51b5
lea ecx, [ebp - 0x371]
push ecx
push dword [ebp + 0x10]
mov edx, dword [eax]
mov ecx, eax
push dword [ebp + 0xc]
push esi
call dword [edx]
cmp byte [ebp - 0x371], 0
jne 0x6f986b
lea ecx, [ebx + 0xec]
inc edi
call fcn.00402e90
cmp edi, eax
jl 0x6f96e1
xor eax, eax
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x35c], eax
push 0x5d
pop ecx
mov esi, str.FKDvKfjEtd5pdJfzhhoOwHuK6um4mzSdlUtsoILtSHMxDIw8hp2TmzN3p6yAtF6o1KJODYAi6Z7mwlzvGTEOn3Xipxul6tdE62iV4Vr559le7EM7QPI8UMkHM24kvOltkh2r8lFEDG3sPhPxwLAyKzJVjJPrNgb7N8sDvyt7c8mAEHHbDeZEurResYYAfgzPsRvBO59jO5qGFBdnMmubrPtOf7s9LQg1l7r3AtGEJ1KYhvgyRnwHH1E97Qb6oY2lWDVC2WDUDh9kBPOv9B0S8vWjeYIFNETecE4iqwceUXCLDFqDdMLYSLETzZob9URcucb1HZsmpjozEqbubw1FkZxjrVQbRNdTRRxP89WoSqyqpfPOiOg1uF
mov byte [ebp - 4], 2
lea edi, [ebp - 0x188]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x350]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.00405a00
lea eax, [ebp - 0x350]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x364]
call fcn.00407ea0
push 0
push 1
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 2
call fcn.006eb1be
mov eax, dword [ebp + 8]
sub eax, 0x100
je 0x6f9884
sub eax, 4
je 0x6f97f6
dec eax
sub eax, 1
jne 0x6f9859
push dword [ebp + 0xc]
mov dword [ebp - 0x378], eax
call fcn.007613bd
pop ecx
mov ecx, dword [ebx + 0x5c]
lea edx, [ebp - 0x378]
push reloc.WS2_32.dll_ioctlsocket
mov word [ebp - 0x378], ax
push edx
mov eax, dword [ecx]
push 0x6fb06c
call dword [eax + 0x10c]
mov esi, eax
test esi, esi
je 0x6f9859
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x100]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x28]
jmp 0x6f98da
cmp dword [ebx + 0x60], 0
je 0x6f9859
xor eax, eax
lea edi, [ebp - 0x354]
push 7
pop ecx
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov word [ebp - 0x344], ax
mov eax, dword [ebx + 0x70]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebx + 0x74]
mov dword [ebp - 0x358], 6
mov dword [ebp - 0x348], eax
call fcn.006f75d0
mov word [ebp - 0x342], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebx + 0x60]
lea edx, [ebp - 0x358]
mov dword [ebp - 0x350], eax
push edx
mov eax, dword [ecx]
call dword [eax + 0x118]
mov byte [ebp - 0x37c], 0
lea ecx, [ebp - 0x364]
call fcn.006eb210
lea ecx, [ebp - 0x388]
call fcn.006eb210
mov al, byte [ebp - 0x37c]
call fcn.007745cb
ret 0x10
cmp dword [ebp + 0xc], 9
jne 0x6f9859
mov ecx, dword [ebx + 0x60]
test ecx, ecx
je 0x6f98c1
mov eax, dword [ecx]
call dword [eax + 0xd8]
test al, al
je 0x6f98c1
mov ecx, dword [ebx + 0x60]
mov eax, dword [ecx]
call dword [eax + 0xe4]
test al, al
je 0x6f98c1
mov ecx, dword [ebx + 0x60]
push str.RichEditUI
mov eax, dword [ecx]
call dword [eax + 0x1c]
push eax
call fcn.00750665
pop ecx
pop ecx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ecx, ebx
setns al
movzx eax, al
push eax
call fcn.006fa7fb
xor ebx, ebx
inc ebx
mov dword [ebp - 0x37c], ebx
jmp 0x6f9860