Function at 0x3ef5790
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xc], ecx
mov byte [ebp - 3], dl
mov esi, eax
xor eax, eax
push ebp
push 0x3ef5aea
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [0x3f382e0], 0x7fffffff
mov byte [ebp - 0xd], 0
mov byte [ebp - 4], 0
mov byte [ebp - 5], 0
mov byte [ebp - 6], 0
mov byte [ebp - 7], 0
xor ebx, ebx
mov eax, esi
call fcn.03cb836c
mov edi, eax
cmp edi, dword [0x3f382e0]
jle 0x3ef57f1
mov edi, dword [0x3f382e0]
test edi, edi
je 0x3ef5ac7
cmp edi, ebx
jle 0x3ef5abc
movzx eax, word [esi + ebx*2]
cmp eax, 0x2b
jg 0x3ef581e
je 0x3ef586a
sub eax, 0x25
je 0x3ef5851
sub eax, 3
je 0x3ef5836
dec eax
je 0x3ef5840
jmp 0x3ef5a7e
sub eax, 0x5e
je 0x3ef5883
sub eax, 0x1d
je 0x3ef589c
sub eax, 3
je 0x3ef5a65
jmp 0x3ef5a7e
mov byte [ebp - 4], 1
inc ebx
jmp 0x3ef5aad
mov byte [ebp - 4], 0
push ebp
call fcn.03ef572c
pop ecx
inc ebx
jmp 0x3ef5aad
mov byte [ebp - 7], 1
push ebp
xor ecx, ecx
mov dx, 1
mov al, 0x12
call fcn.03ef5458
pop ecx
inc ebx
jmp 0x3ef5aad
mov byte [ebp - 5], 1
push ebp
xor ecx, ecx
mov dx, 1
mov al, 0x10
call fcn.03ef5458
pop ecx
inc ebx
jmp 0x3ef5aad
mov byte [ebp - 6], 1
push ebp
xor ecx, ecx
mov dx, 1
mov al, 0x11
call fcn.03ef5458
pop ecx
inc ebx
jmp 0x3ef5aad
mov word [ebp - 0x12], 1
cmp word [esi + ebx*2 + 2], 0x7b
jne 0x3ef58da
mov word [ebp - 2], 0xdb
lea eax, [ebp - 1]
mov dl, 1
call fcn.03ef5408
push ebp
mov cl, 1
mov dx, 1
movzx eax, word [ebp - 2]
call fcn.03ef5588
pop ecx
push ebp
call fcn.03ef572c
pop ecx
add ebx, 3
jmp 0x3ef5ab4
lea eax, [ebp - 0xc]
call fcn.03cb7e50
mov byte [ebp - 0xe], 0
cmp edi, ebx
jl 0x3ef593d
inc ebx
cmp word [esi + ebx*2], 0x7d
jne 0x3ef58f9
mov byte [ebp - 0xe], 1
inc ebx
jmp 0x3ef593d
movzx eax, word [esi + ebx*2]
mov word [ebp - 0x16], ax
movzx eax, word [ebp - 0x16]
mov word [ebp - 0x18], ax
movzx eax, word [ebp - 0x16]
add eax, 0xffffff9f
sub ax, 0x1a
jae 0x3ef5922
movzx eax, word [ebp - 0x16]
and ax, 0xffdf
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x24]
movzx edx, word [ebp - 0x18]
call fcn.03cb8dc0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0xc]
call fcn.03cb8f94
cmp edi, ebx
jge 0x3ef58ea
cmp byte [ebp - 0xe], 0
je 0x3ef5ac7
cmp word [esi + ebx*2], 0x7d
jne 0x3ef597c
mov word [ebp - 2], 0xdd
lea eax, [ebp - 1]
mov dl, 1
call fcn.03ef5408
push ebp
mov cl, 1
mov dx, 1
movzx eax, word [ebp - 2]
call fcn.03ef5588
pop ecx
push ebp
call fcn.03ef572c
pop ecx
inc ebx
jmp 0x3ef5ab4
mov ecx, 1
mov edx, dword [ebp - 0xc]
mov eax, 0x3ef5b08
call fcn.03cb936c
mov byte [ebp - 0xf], al
cmp byte [ebp - 0xf], 0
je 0x3ef59ea
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x3ef59ae
mov eax, dword [ebp - 0x1c]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
movzx eax, byte [ebp - 0xf]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
movzx edx, byte [ebp - 0xf]
inc edx
mov eax, dword [ebp - 0xc]
call fcn.03cb915c
mov eax, dword [ebp - 0x28]
call fcn.03cd2604
mov word [ebp - 0x12], ax
lea eax, [ebp - 0xc]
push eax
movzx ecx, byte [ebp - 0xf]
dec ecx
mov edx, 1
mov eax, dword [ebp - 0xc]
call fcn.03cb915c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x3ef5a01
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jne 0x3ef5a21
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
mov word [ebp - 0x14], ax
movzx eax, word [ebp - 0x14]
push eax
call sub.user32.dll_VkKeyScanW
mov word [ebp - 2], ax
jmp 0x3ef5a43
lea eax, [ebp - 0x128]
mov edx, dword [ebp - 0xc]
mov ecx, 0xff
call fcn.03cb8e9c
lea eax, [ebp - 0x128]
call fcn.03ef5660
mov word [ebp - 2], ax
cmp word [ebp - 2], 0xffff
je 0x3ef5aad
push ebp
mov cl, 1
movzx edx, word [ebp - 0x12]
movzx eax, word [ebp - 2]
call fcn.03ef5588
pop ecx
push ebp
call fcn.03ef572c
pop ecx
jmp 0x3ef5ab4
push ebp
mov cl, 1
mov dx, 1
mov al, 0xd
call fcn.03ef5458
pop ecx
push ebp
call fcn.03ef572c
pop ecx
inc ebx
jmp 0x3ef5aad
movzx eax, word [esi + ebx*2]
push eax
call sub.user32.dll_VkKeyScanW
mov word [ebp - 2], ax
cmp word [ebp - 2], 0xffff
je 0x3ef5aac
push ebp
mov cl, 1
mov dx, 1
movzx eax, word [ebp - 2]
call fcn.03ef5588
pop ecx
push ebp
call fcn.03ef572c
pop ecx
inc ebx
push 5
call sub.kernel32.dll_Sleep_2
cmp edi, ebx
jg 0x3ef5801
mov byte [ebp - 0xd], 1
push ebp
call fcn.03ef572c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ef5af1
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.03cb7eb0
lea eax, [ebp - 0xc]
call fcn.03cb7e50
ret