Function at 0x5027e0ea
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebx
push ebp
push edi
mov edi, ecx
mov eax, dword [edi + 8]
test byte [eax + 0xec], 0x60
jne 0x5027e39b
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push esi
xor ebp, ebp
xor esi, esi
cmp eax, 9
mov dword [esp + 0x10], ebp
jne 0x5027e12f
push 0x10
mov dword [esp + 0x14], 1
call ebx
shr eax, 0xe
not eax
and eax, 2
or eax, 0x25
cmp eax, 0x25
ja 0x5027e238
je 0x5027e1ce
sub eax, 0xd
je 0x5027e24b
sub eax, 0xe
je 0x5027e1a9
sub eax, 8
je 0x5027e16c
dec eax
jne 0x5027e39a
mov esi, dword [edi + 0x10]
mov eax, dword [edi + 8]
cmp dword [eax + 0x74], esi
je 0x5027e39a
jmp 0x5027e371
mov esi, dword [edi + 0x10]
jmp 0x5027e17a
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x5027e17e
mov esi, eax
cmp esi, ebp
jne 0x5027e171
mov eax, dword [edi + 8]
cmp dword [eax + 0x74], esi
je 0x5027e1a2
push 0x11
call ebx
test ah, ah
js 0x5027e1a2
push 0x10
call ebx
test ah, ah
jns 0x5027e371
mov esi, dword [esi + 0x14]
jmp 0x5027e371
xor esi, esi
jmp 0x5027e371
mov eax, dword [edi + 0x10]
mov esi, dword [eax + 0xc]
cmp esi, ebp
mov dword [esp + 0x10], 1
jne 0x5027e375
mov edi, dword [edi + 8]
mov eax, dword [edi]
push ebp
push edi
call dword [eax + 0x14]
jmp 0x5027e39a
mov eax, dword [edi + 0x18]
cmp eax, ebp
je 0x5027e1f2
cmp dword [eax + 0x18], ebp
mov eax, dword [edi + 0x10]
je 0x5027e1e2
mov esi, dword [eax + 0xc]
jmp 0x5027e1e8
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x14]
mov dword [esp + 0x10], 1
jmp 0x5027e1ff
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x74]
cmp eax, ebp
je 0x5027e207
mov esi, dword [eax + 0x14]
cmp esi, ebp
jne 0x5027e375
mov eax, dword [edi + 8]
test byte [eax + 0x5c], 8
jne 0x5027e39a
mov eax, dword [eax + 0x6c]
mov esi, dword [eax + 0x10]
cmp esi, ebp
je 0x5027e39a
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x5027e371
mov esi, eax
cmp esi, ebp
jne 0x5027e222
jmp 0x5027e371
sub eax, 0x26
je 0x5027e312
dec eax
je 0x5027e29e
dec eax
jne 0x5027e39a
mov edx, dword [edi + 0x18]
cmp edx, ebp
je 0x5027e27e
mov ecx, dword [edi + 8]
mov eax, dword [ecx + 0x74]
cmp eax, ebp
je 0x5027e267
mov esi, dword [eax + 0x18]
cmp esi, ebp
jne 0x5027e375
cmp dword [edx + 0x18], ebp
jne 0x5027e276
test byte [ecx + 0x5c], 8
je 0x5027e335
mov esi, dword [edi + 0x10]
jmp 0x5027e371
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x74]
cmp eax, ebp
je 0x5027e28f
mov esi, dword [eax + 0x10]
cmp esi, ebp
jne 0x5027e291
mov esi, eax
mov dword [esp + 0x10], 1
jmp 0x5027e371
cmp dword [edi + 0x18], ebp
mov eax, dword [edi + 8]
je 0x5027e2f0
mov ecx, dword [eax + 0x74]
cmp ecx, ebp
je 0x5027e2c1
call fcn.5027b334
test eax, eax
je 0x5027e2c1
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x74]
mov esi, dword [ecx + 0x10]
jmp 0x5027e300
mov eax, dword [edi + 8]
test byte [eax + 0x5c], 8
jne 0x5027e371
mov esi, dword [eax + 0x74]
cmp esi, ebp
je 0x5027e304
mov ecx, dword [esi + 0x1c]
cmp dword [ecx + 0x18], ebp
je 0x5027e2e7
mov ecx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
cmp esi, ebp
jne 0x5027e2d5
cmp esi, ebp
je 0x5027e304
mov esi, dword [esi + 0x18]
jmp 0x5027e300
test byte [eax + 0x5c], 8
jne 0x5027e371
mov ecx, dword [eax + 0x74]
cmp ecx, ebp
je 0x5027e304
mov esi, dword [ecx + 0x18]
cmp esi, ebp
jne 0x5027e375
test byte [eax + 0x5c], 8
jne 0x5027e371
mov eax, dword [eax + 0x6c]
mov esi, dword [eax + 0x10]
jmp 0x5027e371
mov edx, dword [edi + 0x18]
cmp edx, ebp
je 0x5027e353
mov ecx, dword [edi + 8]
mov eax, dword [ecx + 0x74]
cmp eax, ebp
je 0x5027e32a
mov esi, dword [eax + 0x14]
cmp esi, ebp
jne 0x5027e375
cmp dword [edx + 0x18], ebp
jne 0x5027e348
test byte [ecx + 0x5c], 8
jne 0x5027e348
mov eax, dword [edi + 0x10]
mov esi, dword [eax + 0xc]
jmp 0x5027e371
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x5027e291
mov esi, eax
cmp esi, ebp
jne 0x5027e33d
jmp 0x5027e291
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x74]
cmp eax, ebp
je 0x5027e39a
mov esi, dword [eax + 0x10]
cmp esi, ebp
je 0x5027e39a
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x5027e371
mov esi, eax
cmp esi, ebp
jne 0x5027e364
cmp esi, ebp
je 0x5027e39a
mov ecx, dword [esi + 0x1c]
cmp ecx, ebp
je 0x5027e39a
mov eax, dword [edi + 8]
cmp esi, dword [eax + 0x74]
je 0x5027e39a
mov eax, dword [esi + 0x38]
push 1
push dword [esp + 0x14]
shr eax, 6
and eax, 1
push eax
push esi
call fcn.50272bbe
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret 4