Function at 0xec5130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 4]
xor ebx, ebx
cmp dword [edi + 0x28], ebx
jne 0xec5158
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x38]
push edx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne case.default.0xec520f
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
push 4
and edi, 8
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 0x10
push 0x10
or esi, edi
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
and edi, 4
push 2
or edi, esi
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 2
push 1
or esi, edi
call ebx
test al, 0xfe
mov eax, dword [ebp + 0xc]
mov ecx, 0
setne cl
shr eax, 0x10
add eax, 0xfffffe00
or ecx, esi
cmp eax, 9
ja case.default.0xec520f
jmp dword [eax*4 + 0xec538c]
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00ec3af0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00ec4fe0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.00ec4fb0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00ec32d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00ec5050
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push 0
call fcn.00ec5070
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00ec37a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00ec5030
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.00ec5000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00ec39f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8