Function at 0x10063bd3
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x6c
mov eax, 0x100e1f85
call fcn.100bf38d
mov esi, ecx
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
push 0x10
shr eax, 0xf
and eax, 1
mov dword [ebp - 0x28], eax
call edi
push dword [esi + 0xd8]
lea ecx, [ebp - 0x14]
shr eax, 0xf
and eax, 1
mov dword [ebp - 0x2c], eax
call fcn.10007eee
push 1
push 0x17
lea eax, [ebp - 0x78]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.1005b5f7
mov edi, dword [ebp - 0x64]
mov dword [ebp - 0x1c], edi
cmp dword [esi + 0x128], ebx
je 0x10063c5b
mov eax, dword [esi + 0x128]
mov ecx, dword [eax]
push 0x40
push eax
call dword [ecx + 0x78]
test eax, eax
jne 0x10063c5b
mov eax, dword [ebp - 0x14]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x10063c54
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
jmp 0x100640ce
movzx eax, word [ebp + 8]
add eax, 0xffffffdf
cmp eax, 7
ja case.default.0x10063c6b
jmp dword [eax*4 + 0x100640d7]
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.1005d1a5
mov eax, dword [eax]
mov edi, dword [ebp - 0x14]
cmp edi, eax
je 0x10063c99
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10007848
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x10063ddf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10063ddf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, esi
call fcn.1005c3bf
mov eax, dword [eax]
mov edi, dword [ebp - 0x14]
cmp edi, eax
je 0x10063cd4
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10007848
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
jmp 0x10063c9c
cmp dword [esi + 0x128], ebx
je 0x10063c43
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x6c]
add eax, edi
cmp ecx, eax
jl 0x10063cf3
mov ecx, eax
mov eax, dword [esi + 0x128]
mov edx, dword [eax]
push 1
push ecx
push eax
call dword [edx + 0xf8]
sub edi, eax
push edi
mov ecx, esi
call fcn.1005d911
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x9c]
jmp 0x10063c43
cmp dword [esi + 0x128], ebx
je 0x10063c43
mov eax, dword [esi + 0x128]
mov ecx, dword [eax]
push 1
push ebx
push eax
call dword [ecx + 0xf8]
sub edi, eax
push edi
mov ecx, esi
call fcn.1005c965
jmp 0x10063d0f
cmp dword [esi + 0x128], ebx
je 0x10063d69
mov eax, dword [esi + 0x128]
mov ecx, dword [eax]
push 0x10000000
push eax
call dword [ecx + 0x64]
test eax, eax
jne 0x10063d69
mov cl, 1
jmp 0x10063d6b
xor cl, cl
mov eax, dword [esi + 0xec]
cmp eax, ebx
je case.default.0x10063c6b
cmp cl, bl
je case.default.0x10063c6b
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x40]
mov eax, dword [esi + 0x164]
mov ecx, eax
sub ecx, dword [ebp - 0x38]
push ebx
add dword [ebp - 0x30], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0xec]
mov ecx, dword [eax]
lea edx, [ebp - 0x3c]
push edx
push eax
call dword [ecx + 0x44]
push ebx
mov ecx, esi
call fcn.1005d911
cmp dword [esi + 0x128], ebx
je 0x10063dd2
mov eax, dword [esi + 0x128]
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0xf8]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x9c]
mov edi, dword [ebp - 0x14]
cmp dword [ebp - 0x28], ebx
jne 0x10063e12
cmp edi, ebx
je 0x100640bd
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
and eax, 4
push eax
push ecx
mov dword [ebp - 0x2c], esp
mov eax, esp
push ecx
mov dword [ebp - 0x2c], esp
mov ecx, esp
push edi
mov dword [eax], ebx
call fcn.10007eee
mov ecx, esi
call fcn.10062901
cmp edi, ebx
je 0x100640bd
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov eax, dword [edi]
push edi
call dword [eax + 0x40]
cmp word [ebp + 8], 0x28
jne 0x1006406e
lea eax, [esi + 0x160]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
call dword [sym.imp.USER32.dll_IntersectRect]
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x30]
add eax, ecx
sub ecx, eax
push ecx
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.1005d911
cmp dword [esi + 0x128], ebx
je 0x10063e96
mov eax, dword [esi + 0x128]
mov ecx, dword [eax]
push 1
push dword [ebp + 8]
push eax
call dword [ecx + 0xf8]
mov ecx, esi
call fcn.1006183f
mov eax, dword [edi]
or dword [ebp - 4], 0xffffffff
push edi
call dword [eax + 8]
jmp 0x10063c54
cmp dword [esi + 0x128], ebx
je 0x10063ecd
mov eax, dword [esi + 0x128]
mov ecx, dword [eax]
push 0x10000000
push eax
call dword [ecx + 0x64]
mov byte [ebp - 0xd], 1
test eax, eax
je 0x10063ed0
mov byte [ebp - 0xd], bl
lea ecx, [esi + 0x8c]
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
test eax, 0xfffffffc
jne 0x10063ee7
xor eax, eax
jmp 0x10063ef9
mov eax, dword [ecx + 0x10]
sub eax, dword [ecx + 0xc]
sar eax, 2
dec eax
push eax
call fcn.10017997
mov eax, dword [eax]
mov edi, dword [ebp - 0x14]
cmp edi, eax
je 0x10063f0f
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.10007848
mov edi, dword [ebp - 0x14]
jmp 0x10063f11
mov eax, edi
lea ecx, [esi + 0xf0]
push eax
call fcn.1005683a
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.1005cdc4
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10063f90
lea eax, [esi + 0xf0]
cmp dword [eax], ecx
je 0x10063f44
push ecx
push eax
call fcn.10007848
mov eax, dword [esi + 0xf0]
lea edx, [ebp - 0x3c]
push edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x40]
mov eax, dword [esi + 0x16c]
sub eax, dword [ebp - 0x30]
push ebx
add eax, dword [ebp - 0x38]
lea edx, [ebp - 0x3c]
mov ecx, eax
sub ecx, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 0xf0]
add dword [ebp - 0x30], ecx
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x44]
push ebx
mov ecx, esi
call fcn.1005c965
cmp dword [esi + 0x128], ebx
je 0x10063fb4
cmp byte [ebp - 0xd], bl
je 0x10063fb4
mov eax, dword [esi + 0x128]
mov ecx, dword [eax]
push 1
push dword [esi + 0xf8]
push eax
call dword [ecx + 0xf8]
mov eax, dword [esi]
push ebx
push esi
call dword [eax + 0x9c]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], bl
jmp 0x10063c9c
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x10063ddf
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
neg eax
sbb al, al
inc al
push 0x100
mov byte [ebp - 0xd], al
mov eax, dword [edi]
push edi
call dword [eax + 0x78]
neg eax
sbb al, al
inc al
cmp byte [ebp - 0xd], bl
je 0x10063ddf
cmp al, bl
je 0x10063ddf
push 1
push 0x100
push ebx
jmp 0x1006404e
mov edi, dword [ebp - 0x14]
cmp edi, ebx
je 0x10063ddf
mov eax, dword [edi]
push edi
call dword [eax + 0xd0]
test eax, eax
mov eax, dword [edi]
push 0x100
push edi
setne byte [ebp - 0xd]
call dword [eax + 0x78]
neg eax
sbb al, al
inc al
cmp byte [ebp - 0xd], bl
jne 0x10064059
cmp al, bl
jne 0x10064059
push 1
push ebx
push 0x100
mov eax, dword [edi]
push edi
call dword [eax + 0x70]
jmp 0x10063ddf
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], ebx
mov eax, dword [edi]
push edi
call dword [eax + 0xcc]
jmp 0x10063ddf
cmp word [ebp + 8], 0x26
jne 0x10063e9d
lea eax, [esi + 0x160]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x5c]
push eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call dword [sym.imp.USER32.dll_IntersectRect]
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x30]
add eax, dword [ebp - 0x38]
add eax, ecx
sub ecx, eax
push ecx
mov ecx, esi
mov dword [ebp + 8], eax
call fcn.1005c965
jmp 0x10063e7a
or dword [ebp - 4], 0xffffffff
cmp edi, ebx
je 0x100640cb
mov eax, dword [edi]
push edi
call dword [eax + 8]
xor eax, eax
inc eax
call fcn.100bf465
ret 0xc