Function at 0x640ff075
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 4], 0x20a
push esi
mov esi, ecx
jne 0x640ff0bf
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x640ff0bf
call fcn.640fe92e
test eax, eax
je 0x640ff0bf
push dword [ebx + 0xc]
mov eax, dword [esi + 0x54]
push dword [ebx + 8]
mov ecx, dword [eax + 0xb4]
push dword [ebx + 4]
call fcn.64002390
xor eax, eax
inc eax
jmp 0x640ff2d7
cmp dword [ebx + 4], 0x100
push edi
jne 0x640ff2ce
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ax, ax
jl 0x640ff1bc
push 0x11
call edi
test ax, ax
jl 0x640ff1bc
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x640ff1bc
mov eax, dword [ebx + 8]
cmp eax, 0xd
je 0x640ff12f
cmp eax, 0x20
jbe 0x640ff1bc
cmp eax, 0x24
jbe 0x640ff122
cmp eax, 0x26
je 0x640ff122
cmp eax, 0x28
jne 0x640ff1bc
call fcn.640fe92e
test eax, eax
je 0x640ff1bc
mov ecx, esi
call fcn.640269fa
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
call fcn.640fe92e
test eax, eax
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
je 0x640ff164
push dword [ebx + 0xc]
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.64002390
jmp 0x640ff2c9
call fcn.64024996
test eax, eax
je 0x640ff2c9
mov eax, dword [esi + 0x54]
add eax, 0xb8
push eax
mov ecx, esi
call fcn.640249ce
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
test eax, eax
jne 0x640ff192
xor edi, edi
jmp 0x640ff195
mov edi, dword [eax + 0x20]
mov esi, dword [esi + 0x54]
mov ecx, dword [esi + 0xb4]
movzx esi, word [esi + 0x20]
call fcn.64024996
push edi
push esi
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x640ff2c9
mov eax, dword [ebx + 8]
sub eax, 9
je 0x640ff298
sub eax, 0x12
je 0x640ff270
sub eax, 0xb
je 0x640ff1de
dec eax
dec eax
jne 0x640ff2ce
push 0x12
call edi
test ax, ax
jl 0x640ff2ce
push 0x11
call edi
test ax, ax
jl 0x640ff2ce
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x640ff2ce
call fcn.640fe92e
test eax, eax
jne 0x640ff2c9
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
push 1
call fcn.640fe8a8
mov eax, dword [esi + 0x54]
mov eax, dword [eax + 0xb4]
push dword [eax + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.6402331c
test eax, eax
je 0x640ff2c9
mov esi, dword [esi + 0x54]
lea ebx, [esi + 0x90]
mov esi, dword [esi + 0xb4]
push dword [esi + 0x20]
call edi
push eax
call fcn.6402331c
push 1
push ebx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x640ff2c9
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 0xb4]
test ecx, ecx
je 0x640ff284
push 0
call fcn.640fe8a8
mov ecx, esi
call fcn.6402445c
test eax, eax
je 0x640ff2ce
mov ecx, esi
call fcn.6402445c
jmp 0x640ff2c2
push dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
push eax
call fcn.6402331c
test eax, eax
je 0x640ff2ce
push dword [esi + 0x20]
call edi
push eax
call fcn.6402331c
push 0
push esi
mov ecx, eax
call fcn.6401f74c
mov ecx, eax
call fcn.640269fa
xor eax, eax
inc eax
jmp 0x640ff2d6
push ebx
mov ecx, esi
call fcn.6402112e
pop edi
pop esi
pop ebx
pop ebp
ret 4