Function at 0x5fb2f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x148], ecx
mov byte [ebp - 3], dl
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5fb7eb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x642ddc], 0x7fffffff
mov byte [ebp - 0xd], 0
mov byte [ebp - 4], 0
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
mov byte [ebp - 7], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
call fcn.0040a974
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jns 0x5fb361
call fcn.004081f4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [0x642ddc]
jle 0x5fb377
mov eax, dword [0x642ddc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x5fb7cb
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jge 0x5fb7c0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
movzx eax, word [eax + edx*2]
cmp eax, 0x2b
jg 0x5fb3b4
je 0x5fb432
sub eax, 0x25
je 0x5fb40b
sub eax, 3
je 0x5fb3d4
dec eax
je 0x5fb3ec
jmp 0x5fb758
sub eax, 0x5e
je 0x5fb459
sub eax, 0x1d
je 0x5fb480
sub eax, 3
je 0x5fb735
jmp 0x5fb758
mov byte [ebp - 4], 1
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
mov byte [ebp - 4], 0
push ebp
call fcn.005fb28c
pop ecx
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
mov byte [ebp - 7], 1
push ebp
xor ecx, ecx
mov dx, 1
mov al, 0x12
call fcn.005faddc
pop ecx
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
mov byte [ebp - 5], 1
push ebp
xor ecx, ecx
mov dx, 1
mov al, 0x10
call fcn.005faddc
pop ecx
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
mov byte [ebp - 6], 1
push ebp
xor ecx, ecx
mov dx, 1
mov al, 0x11
call fcn.005faddc
pop ecx
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
mov word [ebp - 0x1a], 1
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [eax + edx*2 + 2], 0x7b
jne 0x5fb4d2
mov word [ebp - 2], 0xdb
push ebp
lea eax, [ebp - 1]
mov dl, 1
call fcn.005fad5c
pop ecx
push ebp
mov cl, 1
mov dx, 1
mov ax, word [ebp - 2]
call fcn.005faf74
pop ecx
push ebp
call fcn.005fb28c
pop ecx
add dword [ebp - 0x14], 3
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0xe], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jg 0x5fb5a7
add dword [ebp - 0x14], 1
jno 0x5fb4f1
call fcn.004081fc
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [eax + edx*2], 0x7d
jne 0x5fb516
mov byte [ebp - 0xe], 1
add dword [ebp - 0x14], 1
jno 0x5fb5a7
call fcn.004081fc
jmp 0x5fb5a7
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov ax, word [eax + edx*2]
mov word [ebp - 0x22], ax
mov ax, word [ebp - 0x22]
mov word [ebp - 0x24], ax
mov ax, word [ebp - 0x22]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x5fb545
mov ax, word [ebp - 0x22]
and ax, 0xffdf
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x3d]
call fcn.0040b114
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x148]
mov dx, word [ebp - 0x24]
call fcn.0040afb4
mov edx, dword [ebp - 0x148]
pop eax
call fcn.0040b1a4
mov edx, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
mov ecx, 0xff
call fcn.0040b0a8
lea edx, [ebp - 0x140]
lea eax, [ebp - 0x3d]
mov cl, 0x14
call fcn.0040ab28
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jle 0x5fb4e6
cmp byte [ebp - 0xe], 0
jne 0x5fb5be
push ebp
mov eax, 0x5fb7fc
call fcn.005fad30
pop ecx
jmp 0x5fb7cb
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [eax + edx*2], 0x7d
jne 0x5fb609
mov word [ebp - 2], 0xdd
push ebp
lea eax, [ebp - 1]
mov dl, 1
call fcn.005fad5c
pop ecx
push ebp
mov cl, 1
mov dx, 1
mov ax, word [ebp - 2]
call fcn.005faf74
pop ecx
push ebp
call fcn.005fb28c
pop ecx
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x3d]
call fcn.0040b114
mov edx, dword [ebp - 0x14c]
mov ecx, 1
mov eax, 0x5fb81c
call fcn.0040b4c0
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, 0xff
jbe 0x5fb63e
call fcn.004081f4
mov byte [ebp - 0xf], al
cmp byte [ebp - 0xf], 0
je 0x5fb6db
lea eax, [ebp - 0x168]
push eax
xor ecx, ecx
mov cl, byte [ebp - 0x3d]
xor eax, eax
mov al, byte [ebp - 0xf]
sub ecx, eax
jno 0x5fb665
call fcn.004081fc
xor edx, edx
mov dl, byte [ebp - 0xf]
add edx, 1
jno 0x5fb674
call fcn.004081fc
lea eax, [ebp - 0x3d]
call fcn.0040ab44
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x150]
call fcn.0040b114
mov eax, dword [ebp - 0x150]
call fcn.00426da0
cmp eax, 0xffff
jbe 0x5fb6a4
call fcn.004081f4
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x168]
push eax
xor ecx, ecx
mov cl, byte [ebp - 0xf]
sub ecx, 1
jno 0x5fb6be
call fcn.004081fc
lea eax, [ebp - 0x3d]
mov edx, 1
call fcn.0040ab44
lea edx, [ebp - 0x168]
lea eax, [ebp - 0x3d]
mov cl, 0x14
call fcn.0040ab28
cmp byte [ebp - 0x3d], 1
jne 0x5fb701
xor eax, eax
mov al, byte [ebp - 0x3c]
push eax
call sub.user32.dll_VkKeyScanW
movsx eax, ax
cmp eax, 0xffff
jbe 0x5fb6fb
call fcn.004081f4
mov word [ebp - 2], ax
jmp 0x5fb70f
push ebp
lea eax, [ebp - 0x3d]
call fcn.005fb0f8
pop ecx
mov word [ebp - 2], ax
cmp word [ebp - 2], 0xffff
je 0x5fb7b4
push ebp
mov cl, 1
mov dx, word [ebp - 0x1a]
mov ax, word [ebp - 2]
call fcn.005faf74
pop ecx
push ebp
call fcn.005fb28c
pop ecx
jmp 0x5fb7b4
push ebp
mov cl, 1
mov dx, 1
mov al, 0xd
call fcn.005faddc
pop ecx
push ebp
call fcn.005fb28c
pop ecx
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
jmp 0x5fb7b4
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov ax, word [eax + edx*2]
push eax
call sub.user32.dll_VkKeyScanW
movsx eax, ax
cmp eax, 0xffff
jbe 0x5fb777
call fcn.004081f4
mov word [ebp - 2], ax
cmp word [ebp - 2], 0xffff
je 0x5fb79d
push ebp
mov cl, 1
mov dx, 1
mov ax, word [ebp - 2]
call fcn.005faf74
pop ecx
push ebp
call fcn.005fb28c
pop ecx
jmp 0x5fb7a9
push ebp
mov eax, 0x5fb820
call fcn.005fad30
pop ecx
add dword [ebp - 0x14], 1
jno 0x5fb7b4
call fcn.004081fc
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jl 0x5fb38d
mov byte [ebp - 0xd], 1
push ebp
call fcn.005fb28c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5fb7f2
lea eax, [ebp - 0x150]
mov edx, 4
call fcn.0040a4e0
pop eax
jmp eax