Function at 0x277fdeca
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp dword [ebp + 0x10], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi]
mov dword [ebp - 4], ecx
je 0x277fdf5a
test byte [esi + 0x20], 0x40
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
je 0x277fdf61
mov eax, dword [esi + 0xe8]
test al, 8
je 0x277fdf61
test al, 4
je 0x277fdf61
mov edi, dword [ebp + 0xc]
cmp edi, 0x10
je 0x277fdf5a
cmp edi, 0x11
je 0x277fdf5a
cmp edi, 0x12
je 0x277fdf5a
cmp edi, 0xd
je 0x277fdf5a
push 0x2e
push ecx
call dword [sym.imp.USER32.dll_KillTimer]
and dword [esi + 0xe8], 0xfffffff7
lea eax, [esi + 0xec]
push eax
push 0xffffffffffffff8e
push esi
call fcn.277b9878
push dword [ebp - 4]
call ebx
test eax, eax
je 0x277fdf5a
mov eax, dword [ebp + 0x18]
mov word [ebp - 0xc], di
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0x18]
push eax
push 0xffffff65
push esi
call fcn.277b9878
test eax, eax
je 0x277fdf66
inc dword [esi + 0x7c]
pop edi
pop esi
pop ebx
leave
ret 0x14
mov edi, dword [ebp + 0xc]
jmp 0x277fdf3a
cmp dword [esi + 0x7c], 0
je 0x277fdf8a
mov edi, 0x102
push 1
push edi
push edi
lea eax, [ebp - 0x34]
push dword [esi]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x277fdf8a
dec dword [esi + 0x7c]
jne 0x277fdf71
test byte [esi + 9], 0x10
je 0x277fe03b
mov eax, dword [esi + 0x15c]
test eax, eax
je 0x277fdf5a
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
xor ecx, ecx
push 0x10
test ax, ax
setl cl
mov dword [ebp + 8], ecx
call edi
nop
xor ecx, ecx
test ax, ax
setl cl
cmp dword [ebp + 0xc], 0xd
mov dword [ebp + 0x10], ecx
je 0x277fe132
cmp dword [ebp + 0xc], 0x20
je 0x277fe0e9
cmp dword [ebp + 0xc], 0x6b
jne 0x277fe045
mov eax, dword [esi + 8]
and eax, 3
cmp al, 1
jne 0x277fe045
push 0x11
call edi
test ax, ax
jge 0x277fe045
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
push eax
call ebx
and dword [ebp + 0xc], 0
cmp dword [esi + 0x120], 0
lea edi, [esi + 0x120]
mov dword [ebp + 8], eax
jle 0x277fe031
push 0xffffffffffffffff
push dword [ebp + 0xc]
push esi
call fcn.2781d7ed
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [edi]
jl 0x277fe01c
push dword [ebp + 8]
call ebx
jmp 0x277fdf5a
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
jmp 0x277fdf9a
push 0x12
call edi
test ax, ax
jl 0x277fdf5a
test byte [esi + 8], 4
je 0x277fe0c8
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0x10], ebx
push dword [ebp + 0xc]
push dword [esi + 0x54]
push esi
call fcn.27801c61
mov edi, eax
cmp edi, 0xffffffff
je 0x277fe09c
cmp dword [ebp + 0x10], ebx
je 0x277fe0cc
push 1
push edi
push esi
call fcn.277fda18
push ebx
push ebx
push ebx
push edi
push esi
call fcn.277fdd97
push ebx
push ebx
call fcn.27810e07
push 0x277cbb30
call fcn.278113e7
push 0x2b
push 0x200
push esi
call fcn.277ff7da
test eax, eax
je 0x277fdf5a
push ebx
push dword [esi + 0x54]
push esi
call fcn.277ffb7b
push dword [esi]
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x277fdf5a
xor ebx, ebx
jmp 0x277fe060
cmp dword [ebp + 8], ebx
jne 0x277fe0d4
mov dword [esi + 0x58], edi
xor eax, eax
cmp dword [ebp + 8], ebx
push ebx
sete al
push eax
xor eax, eax
cmp dword [ebp + 8], ebx
sete al
push eax
jmp 0x277fe084
cmp dword [ebp + 8], 0
je 0x277fe0ff
mov eax, dword [esi + 0x54]
push eax
push esi
mov dword [esi + 0x58], eax
call fcn.277fd9ed
inc dword [esi + 0x7c]
cmp dword [ebp + 0x10], 0
je 0x277fe110
push 1
push dword [esi + 0x54]
push esi
call fcn.277fda18
test byte [esi + 0x20], 4
je 0x277fdf5a
mov eax, dword [esi + 0x54]
cmp eax, 0xffffffff
je 0x277fdf5a
push eax
push esi
call fcn.277ff1f3
jmp 0x277fdf5a
xor edi, edi
push edi
push 0xfffffffffffffffc
push esi
call fcn.277b9878
push dword [ebp - 4]
call ebx
test eax, eax
je 0x277fdf5a
mov eax, dword [esi + 0x54]
or dword [ebp - 0x28], 0xffffffff
or dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], edi
call fcn.277fde97
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x48]
push eax
push 0xffffffffffffff8e
push esi
call fcn.277b9878
push dword [ebp - 4]
jmp 0x277fe034