Function at 0x5e9d30
Capabilities:
Log keystrokes via polling

Disassembly:
push edi
push ebx
mov ebx, ecx
mov edi, dword [esp + 0xc]
cmp edx, 0x102
jne 0x5e9da7
cmp edi, 0x10
je 0x5e9f30
cmp edi, 0x12
je 0x5e9f30
cmp edi, 0x11
je 0x5e9f30
lea ecx, [edi - 8]
cmp ecx, 0x20
jae 0x5e9d76
mov eax, 1
shl eax, cl
test eax, 0x1080027
je 0x5e9d76
pop ebx
pop edi
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x5e9d8b
or edi, 0x20000
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x5e9da0
or edi, 0x40000
mov dword [ebx], edi
pop ebx
pop edi
ret 8
lea eax, [edi - 3]
cmp eax, 0x78
ja case.0x5e9dba.4
mov eax, dword [eax*4 + 0x6d9440]
jmp eax
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x2c]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x28]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edx, dword [eax]
lea edi, [edx + edi - 0x70]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x54]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x50]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x70]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x48]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x40]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x34]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x3c]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x30]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x44]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x4c]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x38]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x5c]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x58]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x74]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x60]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x68]
jmp 0x5e9ee5
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
mov edi, dword [eax + 0x6c]
jmp 0x5e9ee5
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x5e9ed1
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x5e9ed1
pop ebx
pop edi
ret 8
cmp edi, 0x30
jb 0x5e9f30
cmp edi, 0x39
jbe 0x5e9ee5
cmp edi, 0x41
jb 0x5e9f30
cmp edi, 0x5a
ja 0x5e9f30
mov dword [ebx], edi
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x5e9efc
or dword [ebx], 0x20000
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x5e9f11
or dword [ebx], 0x40000
mov eax, dword [str.__b__b_b__b__b__bA_bB_bC_bD_bW_bX_bG_bH_bI_bK_bM_bO_bP_bQ_bR_bS_b]
cmp edi, dword [eax + 0x5c]
je 0x5e9f30
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jge 0x5e9f30
or dword [ebx], 0x10000
pop ebx
pop edi
ret 8