Function at 0x275c79c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push 1
pop ebx
lea eax, [ebp - 0x18]
push eax
push 0xfffffe64
push esi
mov dword [ebp - 4], ebx
mov word [ebp - 0xc], di
call fcn.27582d58
push 0x11
mov dword [ebp + 0xc], eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x275d78ac
cmp edi, 0xd
jbe 0x275d78f8
cmp edi, 0x6a
ja 0x275d7a78
je 0x275d7a5d
lea eax, [edi - 0x20]
cmp eax, 8
jbe switch.0x275d7931
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x275d7ab1
mov eax, dword [esi + 0x64]
test eax, eax
jne 0x275d7ab9
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
lea eax, [edi - 0x21]
cmp eax, 7
ja case.default.0x275d78b8
jmp dword [eax*4 + 0x275d7aea]
push 0
push 0
push esi
call fcn.27624889
jmp 0x275c7a24
push 0
push ebx
jmp 0x275d78c3
push 2
pop eax
push 0
push eax
push esi
call fcn.2762491f
jmp 0x275c7a24
push 6
jmp 0x275d78d5
push 3
jmp 0x275d78d5
push 7
jmp 0x275d78d5
xor eax, eax
jmp 0x275d78d6
mov eax, ebx
jmp 0x275d78d6
je 0x275d791f
cmp edi, 8
jne case.default.0x275d78b8
mov eax, dword [esi + 0x20]
mov dword [ebp + 0xc], ebx
test eax, eax
je 0x275c7a24
cmp byte [eax + 0x1a], 0
jne 0x275d79f5
xor eax, eax
jmp 0x275d7960
push 0
push 0xfffffffffffffffc
push esi
call fcn.27582d58
mov dword [ebp + 0xc], eax
jmp 0x275c7a24
jmp dword [eax*4 + 0x275d7b0a]
mov eax, dword [esi + 0x20]
test eax, eax
je case.0x275d7931.36
movzx ecx, word [esi + 0xb8]
movzx eax, word [eax + 0x18]
lea edx, [ecx - 1]
cmp eax, edx
jle case.0x275d7931.36
sub eax, ecx
inc eax
push eax
mov eax, dword [esi + 0x1c]
push dword [eax + 8]
call fcn.275962d5
test eax, eax
je 0x275c7a24
push 2
push ebx
push ebx
push eax
push 9
push esi
call fcn.275a6c94
cmp edi, 0x25
jne 0x275c7a24
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275c7a24
test byte [esi + 9], 4
je 0x275c7a24
push ebx
push eax
mov al, byte [eax + 0x10]
and al, 0x20
neg al
sbb eax, eax
inc eax
inc eax
push eax
push esi
call fcn.27594de6
jmp 0x275c7a24
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x275d79b7
xor eax, eax
jmp 0x275d7954
movzx ecx, word [esi + 0xb8]
movzx eax, word [eax + 0x18]
lea eax, [ecx + eax - 1]
cmp eax, dword [esi + 0xbc]
nop
jb 0x275d7954
mov eax, dword [esi + 0xbc]
dec eax
jmp 0x275d7954
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275c7a24
test byte [eax + 0x10], 0x20
je 0x275d7909
push ebx
push eax
push ebx
jmp 0x275d79a1
mov eax, dword [eax]
jmp 0x275d7960
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275d7a31
push eax
call fcn.276166a6
jmp 0x275d7960
mov eax, dword [esi + 0x20]
test eax, eax
je case.0x275d7931.40
test byte [eax + 0x10], 0x20
je 0x275d7aa8
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275d7a31
push eax
call fcn.27583b00
jmp 0x275d7960
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 8]
jmp 0x275d7960
test byte [esi + 9], 1
je 0x275c7a24
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275c7a24
push eax
push esi
call fcn.27616b6c
jmp 0x275c7a24
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275c7a24
push ebx
push eax
push esi
mov dword [ebp + 0xc], ebx
call fcn.2761680a
jmp 0x275c7a24
mov eax, edi
sub eax, 0x6b
je 0x275d7a9a
dec eax
dec eax
jne case.default.0x275d78b8
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275c7a24
mov dword [ebp + 0xc], ebx
jmp 0x275d79f0
mov eax, dword [esi + 0x20]
test eax, eax
je 0x275c7a24
mov dword [ebp + 0xc], ebx
push ebx
push eax
push 2
jmp 0x275d79a1
inc dword [esi + 0x64]
jmp 0x275c7a39
jle 0x275c7a39
mov edi, 0x102
push ebx
push edi
push edi
lea eax, [ebp - 0x34]
push dword [esi]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x275c7a39
dec dword [esi + 0x64]
cmp dword [esi + 0x64], 0
jle 0x275c7a39
jmp 0x275d7ac4