Function at 0x1011d230
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1011d33b
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1011d33b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x40]
call eax
test eax, eax
je 0x1011d33b
mov ecx, esi
call fcn.101171b0
test al, al
je 0x1011d33b
mov eax, dword [ebp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
push eax
call esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
shr eax, 0xf
and eax, 0xffffff01
shr ecx, 1
mov dword [esp + 8], eax
and cl, 1
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x18], eax
mov dword [edx + 0x30], edi
mov byte [edi + 0x1c], cl
mov ecx, dword [ebp + 0x18]
mov al, cl
and al, 1
mov dword [edi + 0xc], edx
mov byte [edi + 0x1e], al
mov eax, ecx
shr eax, 2
and al, 1
mov byte [edi + 0x23], al
mov eax, ecx
shr eax, 3
and al, 1
mov byte [edi + 0x24], al
mov eax, ecx
shr eax, 4
and al, 1
mov byte [edi + 0x25], al
mov eax, ecx
shr eax, 5
and al, 1
mov byte [edi + 0x26], al
mov eax, ecx
shr eax, 8
and al, 1
push 1
mov byte [edi + 0x27], al
call esi
mov esi, dword [ebp + 8]
shr eax, 0xf
and al, 1
mov byte [edi + 0x1d], al
mov byte [esi + 0x79], 0
mov eax, dword [edi + 0xc]
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1011d328
cmp byte [edi + 0x23], 0
jne 0x1011d328
mov eax, dword [edi + 0xc]
push 0
push 0
push 0x211
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
mov ecx, edi
call fcn.1011f430
test al, al
jne 0x1011d345
mov ecx, esi
call fcn.101173a0
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp byte [edi + 0x23], 0
mov eax, dword [esp + 8]
mov byte [edi + 0x1f], al
mov byte [edi + 0x1d], al
jne 0x1011d37f
mov eax, dword [edi + 0xc]
push 0
push dword [esi + 0x20]
push 0x117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
push eax
push 0
push 0x2117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push 0x10
push dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1011d3ad
mov eax, dword [ebp + 0x1c]
movups xmm0, xmmword [eax]
jmp 0x1011d3b0
xorps xmm0, xmm0
movups xmmword [esi + 0xc4], xmm0
movzx eax, byte [edi + 0x26]
mov ecx, esi
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10117040
mov ecx, dword [ebp + 0x18]
mov eax, ecx
shr eax, 7
and al, 1
shr ecx, 6
movzx eax, al
and cl, 1
push eax
movzx eax, cl
push eax
push dword [ebp + 0x1c]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.1011e390
push 0x250
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x20]
push dword [esp + 0x20]
push 0xffffffffffffffff
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.10116ff0
push ecx
mov ecx, edi
call fcn.1011f4b0
cmp byte [edi + 0x2b], 0
jne 0x1011d33b
mov ecx, esi
call fcn.10117020
push esi
mov ecx, edi
call fcn.1011e0e0
mov ecx, esi
call fcn.101173a0
cmp byte [edi + 0x1e], 0
je 0x1011d33b
mov eax, dword [edi + 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18