Function at 0x56e629
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push edi
push ecx
lea edi, [ebp - 0x3c]
mov ecx, 0xf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x104
ja 0x56e602
cmp dword [ebp - 0x18], 0x104
je case.0x56e622.0
mov edx, dword [ebp - 0x18]
sub edx, 0xa1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x5f
ja case.0x56e622.3
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 0x56e9a8]
jmp dword [ecx*4 + 0x56e99c]
mov edx, dword [ebp - 0x18]
sub edx, 0x200
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 8
ja case.0x56e622.3
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 0x56ea10]
jmp dword [ecx*4 + 0x56ea08]
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc0], 0xffffffff
je case.0x56e622.0
mov esi, esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.00710bc0
cwde
and eax, 0x8000
je case.0x56e622.0
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x21
je 0x56e7c1
cmp dword [ebp - 0x1c], 0x22
je 0x56e674
jmp case.0x56e622.0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc0]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x56e68e
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc0]
mov edx, dword [ebp - 4]
add ecx, dword [edx + 0xbc]
cmp dword [ebp - 8], ecx
jge 0x56e7b7
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cdq
idiv dword [ecx + 0xbc]
mov dword [ebp - 0xc], edx
mov esi, esp
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x284]
mov dword [ebp - 0x20], edx
mov edi, esp
mov ecx, dword [ebp - 0x20]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x20]
cmp esi, esp
call fcn.00710bc0
test eax, eax
je 0x56e7b2
mov eax, dword [ebp - 4]
mov dword [eax + 0x24c], 1
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x21c]
mov dword [ebp - 0x24], ecx
mov edi, esp
mov ecx, dword [ebp - 0x24]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x24]
cmp esi, esp
call fcn.00710bc0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [eax + 0x218]
mov dword [ebp - 0x28], ecx
mov edi, esp
mov ecx, dword [ebp - 0x28]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x28]
cmp esi, esp
call fcn.00710bc0
mov ecx, eax
call fcn.004266b0
mov esi, esp
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc0]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x278]
mov dword [ebp - 0x2c], eax
mov edi, esp
mov ecx, dword [ebp - 0x2c]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x2c]
cmp esi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24c], 0
jmp 0x56e7b7
jmp 0x56e685
mov eax, 1
jmp 0x56e988
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc0]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xbc]
lea eax, [eax + edx - 1]
mov dword [ebp - 0x10], eax
jmp 0x56e7e5
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 0xc0]
jle 0x56e905
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cdq
idiv dword [ecx + 0xbc]
mov dword [ebp - 0x14], edx
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x284]
mov dword [ebp - 0x30], edx
mov edi, esp
mov ecx, dword [ebp - 0x30]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x30]
cmp esi, esp
call fcn.00710bc0
test eax, eax
je 0x56e900
mov eax, dword [ebp - 4]
mov dword [eax + 0x24c], 1
mov esi, esp
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x21c]
mov dword [ebp - 0x34], ecx
mov edi, esp
mov ecx, dword [ebp - 0x34]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x34]
cmp esi, esp
call fcn.00710bc0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [eax + 0x218]
mov dword [ebp - 0x38], ecx
mov edi, esp
mov ecx, dword [ebp - 0x38]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x38]
cmp esi, esp
call fcn.00710bc0
mov ecx, eax
call fcn.004266b0
mov esi, esp
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc0]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x278]
mov dword [ebp - 0x3c], eax
mov edi, esp
mov ecx, dword [ebp - 0x3c]
call dword [0x770a74]
cmp edi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
call dword [ebp - 0x3c]
cmp esi, esp
call fcn.00710bc0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x24c], 0
jmp 0x56e905
jmp 0x56e7dc
mov eax, 1
jmp 0x56e988
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xfc]
call fcn.004201f0
test eax, eax
je 0x56e930
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0xfc]
call fcn.0049b420
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0xf8]
call fcn.004201f0
test eax, eax
je case.0x56e622.3
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0xf8]
call fcn.0049b420
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0x203
jne 0x56e97c
mov ecx, dword [ebp - 4]
add ecx, 0x2250
call fcn.004201f0
mov ecx, dword [ebp + 8]
cmp dword [ecx], eax
jne 0x56e97c
mov eax, 1
jmp 0x56e988
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.0055d7e0
pop edi
pop esi
add esp, 0x3c
cmp ebp, esp
call fcn.00710bc0
mov esp, ebp
pop ebp
ret 4