Function at 0x1011b620
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1011b72b
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1011b72b
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x40]
call eax
test eax, eax
je 0x1011b72b
mov ecx, esi
call fcn.101155a0
test al, al
je 0x1011b72b
mov eax, dword [ebp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
push eax
call esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
shr eax, 0xf
and eax, 0xffffff01
shr ecx, 1
mov dword [esp + 8], eax
and cl, 1
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x18], eax
mov dword [edx + 0x30], edi
mov byte [edi + 0x1c], cl
mov ecx, dword [ebp + 0x18]
mov al, cl
and al, 1
mov dword [edi + 0xc], edx
mov byte [edi + 0x1e], al
mov eax, ecx
shr eax, 2
and al, 1
mov byte [edi + 0x23], al
mov eax, ecx
shr eax, 3
and al, 1
mov byte [edi + 0x24], al
mov eax, ecx
shr eax, 4
and al, 1
mov byte [edi + 0x25], al
mov eax, ecx
shr eax, 5
and al, 1
mov byte [edi + 0x26], al
mov eax, ecx
shr eax, 8
and al, 1
push 1
mov byte [edi + 0x27], al
call esi
mov esi, dword [ebp + 8]
shr eax, 0xf
and al, 1
mov byte [edi + 0x1d], al
mov byte [esi + 0x79], 0
mov eax, dword [edi + 0xc]
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1011b718
cmp byte [edi + 0x23], 0
jne 0x1011b718
mov eax, dword [edi + 0xc]
push 0
push 0
push 0x211
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
mov ecx, edi
call fcn.1011d820
test al, al
jne 0x1011b735
mov ecx, esi
call fcn.10115790
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp byte [edi + 0x23], 0
mov eax, dword [esp + 8]
mov byte [edi + 0x1f], al
mov byte [edi + 0x1d], al
jne 0x1011b76f
mov eax, dword [edi + 0xc]
push 0
push dword [esi + 0x20]
push 0x117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
push eax
push 0
push 0x2117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push 0x10
push dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1011b79d
mov eax, dword [ebp + 0x1c]
movups xmm0, xmmword [eax]
jmp 0x1011b7a0
xorps xmm0, xmm0
movups xmmword [esi + 0xc4], xmm0
movzx eax, byte [edi + 0x26]
mov ecx, esi
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10115430
mov ecx, dword [ebp + 0x18]
mov eax, ecx
shr eax, 7
and al, 1
shr ecx, 6
movzx eax, al
and cl, 1
push eax
movzx eax, cl
push eax
push dword [ebp + 0x1c]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.1011c780
push 0x250
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x20]
push dword [esp + 0x20]
push 0xffffffffffffffff
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.101153e0
push ecx
mov ecx, edi
call fcn.1011d8a0
cmp byte [edi + 0x2b], 0
jne 0x1011b72b
mov ecx, esi
call fcn.10115410
push esi
mov ecx, edi
call fcn.1011c4d0
mov ecx, esi
call fcn.10115790
cmp byte [edi + 0x1e], 0
je 0x1011b72b
mov eax, dword [edi + 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18