Function at 0x6f1bf0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.user32.dll_GetActiveWindow]
cmp eax, dword [ebp + 8]
jne 0x6f2013
mov eax, dword [ebp + 4]
lea ebx, [ebp + 0x6c]
lea edi, [ebp + 0x16c]
mov ecx, 0x40
mov esi, ebx
push ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push 0x100
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x6f1c65
mov eax, dword [ebp + 4]
test eax, eax
je 0x6f1cde
mov edx, dword [eax]
push eax
call dword [edx + 0x1c]
test eax, eax
je 0x6f1c4b
cmp eax, 1
jne 0x6f1cde
mov ecx, 0x40
xor eax, eax
lea edi, [ebp + 0x16c]
rep stosd dword es:[edi], eax
mov ecx, 0x40
mov edi, ebx
rep stosd dword es:[edi], eax
jmp 0x6f1cde
mov edx, 0xffffff94
mov dword [ebp + 0xa6c], 1
mov eax, ebx
lea ecx, [ebp + 0x66c]
sub edx, ebp
mov bl, byte [eax + 0x100]
test bl, bl
jne 0x6f1c99
cmp byte [eax], 0
je 0x6f1c99
mov dword [ecx - 0x400], 1
jmp 0x6f1ca3
mov dword [ecx - 0x400], 0
mov bl, byte [eax + 0x100]
test bl, bl
je 0x6f1cba
cmp byte [eax], 0
jne 0x6f1cba
mov dword [ecx], 1
jmp 0x6f1cc0
mov dword [ecx], 0
cmp byte [eax], 0
je 0x6f1ccf
mov dword [ebp + 0xa6c], 0
add ecx, 4
inc eax
lea esi, [edx + eax]
cmp esi, 0x100
jl 0x6f1c7e
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x20]
lea esi, [ebp + 0x1c]
mov dword [ebp + 0x24], eax
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
push edx
push eax
mov dword [ebp + 0x28], ecx
call dword [sym.imp.user32.dll_GetClientRect]
push esi
call dword [sym.imp.user32.dll_GetCursorPos]
mov ecx, dword [ebp + 8]
push esi
push ecx
call dword [sym.imp.user32.dll_ScreenToClient]
mov edx, dword [esi + 4]
mov eax, dword [esi]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.user32.dll_PtInRect]
test eax, eax
je 0x6f2013
mov edx, dword [ebp + 0xc]
mov edi, dword [sym.imp.user32.dll_GetAsyncKeyState]
push 1
mov dword [ebp + 0x10], edx
mov dword [ebp + 0xc], 0
call edi
and al, 0
test ax, ax
je 0x6f1d4e
mov eax, dword [ebp + 0xc]
or al, 4
mov dword [ebp + 0xc], eax
push 4
call edi
and al, 0
test ax, ax
je 0x6f1d61
mov eax, dword [ebp + 0xc]
or al, 0x20
mov dword [ebp + 0xc], eax
mov ebx, 2
push ebx
call edi
and al, 0
test ax, ax
je 0x6f1d79
mov eax, dword [ebp + 0xc]
or ah, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov edi, ecx
and edi, 4
jne 0x6f1d8f
mov eax, dword [ebp + 0xc]
test al, 4
je 0x6f1d8f
or al, 1
mov dword [ebp + 0xc], eax
mov edx, ecx
and edx, 0x20
jne 0x6f1da2
mov eax, dword [ebp + 0xc]
test al, 0x20
je 0x6f1da2
or al, 8
mov dword [ebp + 0xc], eax
and ecx, 0x100
jne 0x6f1db7
mov eax, dword [ebp + 0xc]
test ah, 1
je 0x6f1db7
or al, 0x40
mov dword [ebp + 0xc], eax
test edi, edi
je 0x6f1dc7
mov eax, dword [ebp + 0xc]
test al, 4
jne 0x6f1dc7
or eax, ebx
mov dword [ebp + 0xc], eax
test edx, edx
je 0x6f1dd7
mov eax, dword [ebp + 0xc]
test al, 0x20
jne 0x6f1dd7
or al, 0x10
mov dword [ebp + 0xc], eax
test ecx, ecx
je 0x6f1de8
mov eax, dword [ebp + 0xc]
test ah, 1
jne 0x6f1de8
or al, 0x80
mov dword [ebp + 0xc], eax
mov al, byte [0x93ca90]
test al, 1
jne 0x6f1e03
or al, 1
mov byte [0x93ca90], al
call dword [sym.imp.user32.dll_GetDoubleClickTime]
mov dword [0x93ca94], eax
test byte [ebp + 0xc], bl
je 0x6f1e93
mov al, byte [0x93ca90]
test bl, al
jne 0x6f1e2c
or al, bl
mov byte [0x93ca90], al
mov eax, dword [esi]
mov dword [0x93ca98], eax
mov ecx, dword [esi + 4]
mov dword [0x93ca9c], ecx
mov eax, dword [0x93ca98]
mov ecx, dword [esi]
sub eax, ecx
cdq
mov edi, eax
mov eax, dword [0x93ca9c]
xor edi, edx
sub edi, edx
mov edx, dword [ebp + 0x20]
sub eax, edx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, ecx
mov dword [0x93ca98], edx
mov eax, dword [esi + 4]
mov dword [0x93ca9c], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov ecx, dword [0x93ca94]
mov edx, dword [0x93caa4]
add edx, ecx
cmp eax, edx
jae 0x6f1e88
cmp edi, 5
jg 0x6f1e88
cmp ebx, 5
jg 0x6f1e88
mov eax, dword [ebp + 0xc]
or ah, 2
mov dword [ebp + 0xc], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [0x93caa4], eax
test byte [ebp + 0xc], 0x10
je 0x6f1f24
mov al, byte [0x93ca90]
test al, 4
jne 0x6f1ebd
or al, 4
mov byte [0x93ca90], al
mov eax, dword [esi]
mov dword [0x93ca88], eax
mov ecx, dword [esi + 4]
mov dword [0x93ca8c], ecx
mov eax, dword [0x93ca88]
mov ecx, dword [esi]
sub eax, ecx
cdq
mov edi, eax
mov eax, dword [0x93ca8c]
xor edi, edx
sub edi, edx
mov edx, dword [ebp + 0x20]
sub eax, edx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, ecx
mov dword [0x93ca88], edx
mov eax, dword [esi + 4]
mov dword [0x93ca8c], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov ecx, dword [0x93ca94]
mov edx, dword [0x93caa8]
add edx, ecx
cmp eax, edx
jae 0x6f1f19
cmp edi, 5
jg 0x6f1f19
cmp ebx, 5
jg 0x6f1f19
mov eax, dword [ebp + 0xc]
or ah, 4
mov dword [ebp + 0xc], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [0x93caa8], eax
test byte [ebp + 0xc], 0x80
je 0x6f1fb5
mov al, byte [0x93ca90]
test al, 8
jne 0x6f1f4e
or al, 8
mov byte [0x93ca90], al
mov eax, dword [esi]
mov dword [0x93ca80], eax
mov ecx, dword [esi + 4]
mov dword [0x93ca84], ecx
mov eax, dword [0x93ca80]
mov ecx, dword [esi]
sub eax, ecx
cdq
mov edi, eax
mov eax, dword [0x93ca84]
xor edi, edx
sub edi, edx
mov edx, dword [ebp + 0x20]
sub eax, edx
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, ecx
mov dword [0x93ca80], edx
mov eax, dword [esi + 4]
mov dword [0x93ca84], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov ecx, dword [0x93ca94]
mov edx, dword [0x93caac]
add edx, ecx
cmp eax, edx
jae 0x6f1faa
cmp edi, 5
jg 0x6f1faa
cmp ebx, 5
jg 0x6f1faa
mov eax, dword [ebp + 0xc]
or ah, 8
mov dword [ebp + 0xc], eax
call dword [sym.imp.winmm.dll_timeGetTime]
mov dword [0x93caac], eax
mov eax, dword [ebp + 0xc]
test al, 4
je 0x6f1fc7
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x34], ecx
mov dword [ebp + 0x38], edx
test al, 0x20
je 0x6f1fd6
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x44], ecx
mov dword [ebp + 0x48], edx
test ah, 1
je 0x6f1fe6
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x54], ecx
mov dword [ebp + 0x58], edx
test al, 1
je 0x6f1ff5
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0x30], edx
test al, 8
je 0x6f2004
mov ecx, dword [esi]
mov edx, dword [ebp + 0x20]
mov dword [ebp + 0x3c], ecx
mov dword [ebp + 0x40], edx
test al, 0x40
je 0x6f2013
mov eax, dword [esi]
mov ecx, dword [ebp + 0x20]
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x50], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret