Function at 0x5127e0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
push esi
mov eax, dword [ecx + 0x70]
push edi
push ebp
mov esi, ecx
test eax, eax
jne 0x5127fc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov edi, dword [esp + 0x2c]
cmp edi, 0x206
ja 0x512838
cmp edi, 0x200
jae 0x5128f9
cmp edi, 0x100
je 0x512aaa
cmp edi, 0x102
je 0x512aaa
cmp edi, 0x104
je 0x512aaa
mov ebp, dword [esi + 0xd4]
mov ebx, dword [esp + 0x30]
test ebp, ebp
je 0x512869
mov ecx, dword [ebp]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x28]
push eax
push ebx
mov eax, dword [ecx]
push edi
push edx
call dword [eax + 0x4c]
test eax, eax
jne 0x512b88
mov ebp, dword [ebp + 4]
test ebp, ebp
jne 0x512846
cmp edi, 0x400
ja case.0x51287e.274
je 0x5128e2
sub edi, 0x111
cmp edi, 4
ja case.0x51287e.274
jmp dword [edi*4 + 0x512b94]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x34]
mov ecx, esi
push eax
push ebx
mov ebx, dword [esi]
call dword [ebx + 0x64]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x34]
mov ecx, esi
push eax
push ebx
mov ebx, dword [esi]
call dword [ebx + 0x6c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, ebx
and ebx, 0xffff
shr eax, 0x10
mov ecx, esi
and eax, 0xffff
push eax
push ebx
mov eax, dword [esi]
call dword [eax + 0x70]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x34]
mov ecx, esi
push eax
push ebx
mov ebx, dword [esi]
call dword [ebx + 0x68]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esi + 0x20]
mov edx, dword [esp + 0x28]
cmp dword [eax + 4], edx
jne 0x512a9e
mov ecx, 0x6e48b0
call fcn.00511a70
test eax, eax
je 0x512a9e
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ebx, dword [esp + 0x38]
push edx
push eax
mov ecx, esi
push ebx
call fcn.00513610
mov ecx, 0x6e48b0
call fcn.00511270
mov ecx, 0x6e48b0
test eax, eax
je 0x512955
call fcn.00511270
jmp 0x51297f
call fcn.00511280
mov ecx, 0x6e48b0
test eax, eax
je 0x51296a
call fcn.00511280
jmp 0x51297f
call fcn.00511290
mov ecx, esi
test eax, eax
je 0x512981
mov ecx, 0x6e48b0
call fcn.00511290
mov ecx, eax
lea eax, [edi - 0x200]
cmp eax, 6
ja case.default.0x512990
jmp dword [eax*4 + 0x512ba8]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
mov ebp, dword [ecx]
push eax
call dword [ebp + 0x78]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
mov ebp, dword [ecx]
push eax
push 1
call dword [ebp + 0x74]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
mov ebp, dword [ecx]
push eax
push 1
call dword [ebp + 0x7c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
mov ebp, dword [ecx]
push eax
push 1
call dword [ebp + pe_nt_image_headers32]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
mov ebp, dword [ecx]
push eax
push 2
call dword [ebp + 0x74]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
mov ebp, dword [ecx]
push eax
push 2
call dword [ebp + 0x7c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
mov ebp, dword [ecx]
push eax
push 2
call dword [ebp + pe_nt_image_headers32]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
mov ebx, dword [esp + 0x30]
mov eax, dword [esi + 0x20]
mov edx, dword [esp + 0x28]
cmp dword [eax + 4], edx
jne 0x512b86
mov ecx, 0x6e48b0
call fcn.00511a70
test eax, eax
je 0x512b86
mov ecx, 0x6e48b0
call fcn.00511280
mov ecx, 0x6e48b0
test eax, eax
je 0x512aea
call fcn.00511280
jmp 0x512afd
call fcn.00511290
test eax, eax
je 0x512aff
mov ecx, 0x6e48b0
call fcn.00511290
mov esi, eax
cmp edi, 0x100
je 0x512b26
cmp edi, 0x104
je 0x512b26
mov eax, dword [esp + 0x34]
mov ecx, esi
push eax
push ebx
mov ebx, dword [esi]
call dword [ebx + 0x60]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
push 0x12
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
call edi
mov ecx, dword [esp + 0x20]
push 0x11
mov edx, ecx
xor edx, ecx
test ax, ax
mov dword [esp + 0x24], edx
setl byte [esp + 0x24]
call edi
xor ecx, ecx
push 0x10
test ax, ax
setl cl
mov dword [esp + 0x18], ecx
call edi
xor ecx, ecx
mov edx, dword [esp + 0x20]
test ax, ax
mov eax, dword [esp + 0x14]
setl cl
mov dword [esp + 0x10], ecx
push ecx
mov ecx, dword [esp + 0x38]
push eax
push edx
mov eax, dword [esi]
push ecx
push ebx
mov ecx, esi
call dword [eax + 0x5c]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0x10