Function at 0x4ea400
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push esi
mov esi, ecx
push edi
push 0x10
mov dword [esi], ebx
mov byte [esi + 8], bl
mov byte [esi + 9], bl
mov byte [esi + 0xa], bl
mov byte [esi + 0xb], bl
mov dword [esi + 4], 0xffffffff
mov byte [esi + 0xd], 1
mov byte [esi + 0xc], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
call ebp
test ax, ax
setl al
push 0x11
mov byte [esi + 9], al
call ebp
test ax, ax
jge 0x4ea457
push 0x12
call ebp
test ax, ax
jl 0x4ea457
mov eax, 1
jmp 0x4ea459
xor eax, eax
push 0x90
mov byte [esi + 0xa], al
mov byte [esi + 8], bl
mov byte [esi + 0xb], bl
mov byte [esi + 0xc], bl
mov byte [esi + 0xd], 1
mov dword [esi + 0x10], ebx
call ebp
and eax, 1
mov dword [esp + 0x10], eax
cmp byte [esp + 0x1c], bl
je 0x4ea759
mov edi, dword [esp + 0x18]
push edi
call ebp
test ax, ax
setl cl
cmp edi, 0x10
mov byte [esi + 0xc], cl
jne 0x4ea4c0
push 0xa1
mov byte [esi + 8], 1
mov dword [esi], 0x65
call ebp
xor edx, edx
test ax, ax
setl dl
pop edi
mov eax, esi
inc edx
mov dword [esi + 0x10], edx
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x11
jne 0x4ea4ec
push 0xa3
mov byte [esi + 8], 1
mov dword [esi], 0x66
call ebp
xor ecx, ecx
test ax, ax
setl cl
pop edi
mov eax, esi
inc ecx
mov dword [esi + 0x10], ecx
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp dword [esp + 0x10], ebx
je 0x4ea516
cmp edi, 0x5f
jle 0x4ea516
cmp edi, 0x6a
jge 0x4ea516
add edi, 0xffffffd0
mov dword [esi], edi
pop edi
mov byte [esi + 0xb], 1
mov dword [esi + 0x10], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x69
jle 0x4ea53a
cmp edi, 0x70
jge 0x4ea53a
add edi, 0xffffffc0
mov dword [esi], edi
pop edi
mov byte [esi + 0xb], 1
mov dword [esi + 0x10], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
cmp edi, 0x6f
jle 0x4ea557
cmp edi, 0x7f
jge 0x4ea557
add edi, 0xffffffb9
mov dword [esi], edi
pop edi
mov byte [esi + 8], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
lea eax, [edi - 8]
cmp eax, 0x89
ja case.0x4ea56c.10
movzx edx, byte [eax + 0x4ea7cc]
jmp dword [edx*4 + 0x4ea76c]
pop edi
mov byte [esi + 8], 1
mov dword [esi], 1
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 2
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 3
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 4
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 5
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 6
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 7
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 8
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x12
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xd
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xe
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0xf
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x10
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x11
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x16
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x17
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x18
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x19
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x13
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x20
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x38
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x39
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
pop edi
mov byte [esi + 8], 1
mov dword [esi], 0x3a
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
push edi
mov ecx, esi
call fcn.004ea380
movzx eax, al
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x18]
pop edi
mov dword [esi], ecx
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret 8