Function at 0x1105eab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, ecx
je 0x1105eb27
cmp ebx, 0x56
jne 0x1105eb27
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1105ead9
mov ecx, esi
call fcn.1105e920
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
cmp dword [ebp + 0x10], 0
je 0x1105ed4d
cmp ebx, 0xd
jne 0x1105eb8c
mov ecx, dword [esi + 0x3c]
sub ecx, dword [esi + 0x38]
test ecx, 0xfffffffe
je 0x1105ed4d
mov edx, dword [esi]
mov eax, dword [edx + 0x1c]
push 0
push 0x4e1
push 0x111
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp ebx, 0x1b
jne 0x1105ead9
mov ecx, dword [esi + 0x3c]
mov edi, dword [esi + 0x38]
cmp edi, ecx
je 0x1105eb53
mov eax, ecx
sub eax, ecx
sar eax, 1
lea ebx, [eax + eax]
push ebx
push ecx
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
add ebx, edi
mov dword [esi + 0x3c], ebx
mov ebx, dword [ebp + 0xc]
cmp dword [esi + 0xc], 0
mov dword [esi + 0x34], 0
jne 0x1105eb77
push 0x1d4
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_InvalidateRect]
push 1
push 0
push eax
call edi
jmp 0x1105eadf
cmp ebx, 0x25
jne 0x1105ebce
mov eax, dword [esi + 0x34]
test eax, eax
jle 0x1105ed4d
dec eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x34], eax
jne 0x1105ebbd
push 0x1d4
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov ecx, dword [esi + 0xc]
push 1
push 0
push ecx
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp ebx, 0x27
jne 0x1105ec19
mov edx, dword [esi + 0x3c]
sub edx, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
sar edx, 1
dec edx
cmp eax, edx
jge 0x1105ed4d
inc eax
cmp dword [esi + 0xc], 0
mov dword [esi + 0x34], eax
jne 0x1105ec08
push 0x1d4
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov eax, dword [esi + 0xc]
push 1
push 0
push eax
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp ebx, 9
jne 0x1105ec59
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
and eax, 0x80
shr eax, 7
push eax
mov eax, dword [edx + 0x1c]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetNextDlgTabItem]
test eax, eax
je 0x1105ed4d
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp ebx, 8
jne 0x1105ecef
mov eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x38]
lea ecx, [esi + 0x38]
sar eax, 1
je 0x1105ed4d
mov edx, dword [esi + 0x34]
lea ebx, [eax - 1]
cmp edx, ebx
jl 0x1105ec99
cmp edx, eax
jl 0x1105ec85
dec edx
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x34]
mov eax, dword [ecx]
lea eax, [eax + edx*2]
push eax
lea edx, [ebp + 0xc]
push edx
call fcn.1105c090
jmp 0x1105ecb6
cmp edx, eax
jge 0x1105ecb6
mov ecx, dword [ecx]
cmp word [ecx + edx*2], 0x20
jne 0x1105ecaa
dec edx
mov dword [esi + 0x34], edx
mov eax, dword [esi + 0x34]
mov edx, 0x20
mov word [ecx + eax*2], dx
mov ecx, esi
call fcn.11059770
cmp dword [esi + 0xc], 0
jne 0x1105ec08
push 0x1d4
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
mov eax, dword [esi + 0xc]
add esp, 0xc
push 1
push 0
push eax
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
cmp ebx, 0x2e
jne 0x1105ed4d
mov ecx, dword [esi + 0x3c]
sub ecx, dword [esi + 0x38]
mov eax, dword [esi + 0x34]
sar ecx, 1
cmp eax, ecx
jge 0x1105ed4d
mov edx, dword [esi + 0x38]
mov ecx, 0x20
mov word [edx + eax*2], cx
mov eax, dword [esi + 0x3c]
sub eax, dword [esi + 0x38]
sar eax, 1
cmp dword [esi + 0x34], eax
jle 0x1105ed1f
mov dword [esi + 0x34], eax
mov ecx, esi
call fcn.11059770
cmp dword [esi + 0xc], 0
jne 0x1105ed43
push 0x1d4
push str.e:_nsmsrc_nsm14101410fctl32wndclass.h
push 0x111f761c
call fcn.11067750
add esp, 0xc
mov edx, dword [esi + 0xc]
push 1
push 0
push edx
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14