Function at 0x5f5e10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
push 0x4e
push str.D:_a_work1_s_src_vctoolsVC7LibsShipATLMFCSrcMFColedrop1.cpp
mov eax, dword [ebp - 4]
push eax
call fcn.0047ca40
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], 0
mov esi, esp
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00784930
movsx ecx, ax
test ecx, ecx
jge 0x5f5e92
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3c]
or eax, 1
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x3c], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x38]
or eax, 2
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x38], eax
jmp 0x5f5ec8
mov esi, esp
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.00784930
movsx edx, ax
test edx, edx
jge 0x5f5ec8
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
or ecx, 2
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x38]
or ecx, 1
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], ecx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp esi, esp
call fcn.00784930
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 8]
call fcn.0041f6f0
nop
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x5f6009
call fcn.0041cf20
cmp eax, dword [ebp + 8]
je 0x5f5f02
jmp 0x5f6009
mov esi, esp
push 1
push 0x209
push 0x200
push 0
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp esi, esp
call fcn.00784930
test eax, eax
jne 0x5f5f4c
mov esi, esp
push 1
push 0x109
push 0x100
push 0
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp esi, esp
call fcn.00784930
test eax, eax
je 0x5f5fbf
cmp dword [ebp - 0x28], 0x202
je 0x5f5f70
cmp dword [ebp - 0x28], 0x205
je 0x5f5f70
cmp dword [ebp - 0x28], 0x201
je 0x5f5f70
cmp dword [ebp - 0x28], 0x204
jne 0x5f5f75
jmp 0x5f6009
cmp dword [ebp - 0x28], 0x100
jne 0x5f5f89
cmp dword [ebp - 0x24], 0x1b
jne 0x5f5f89
jmp 0x5f6009
mov eax, dword [ebp - 4]
add eax, 0x24
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x34]
call fcn.0043d8e0
test eax, eax
jne 0x5f5faf
mov dword [ebp - 0x38], 1
jmp 0x5f5fb6
mov dword [ebp - 0x38], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x38]
mov dword [eax + 0x34], ecx
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
cmp esi, esp
call fcn.00784930
sub eax, dword [ebp - 0xc]
sbb edx, dword [ebp - 8]
mov ecx, dword [0x888668]
xor esi, esi
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], esi
mov edx, dword [ebp - 0x3c]
cmp edx, dword [ebp - 0x44]
jb 0x5f6004
ja 0x5f5ffa
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x48]
jbe 0x5f6004
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], 1
jmp 0x5f5ee6
mov esi, esp
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp esi, esp
call fcn.00784930
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x34]
push edx
mov ecx, ebp
push eax
lea edx, [0x5f6044]
call fcn.007848d0
pop eax
pop edx
pop edi
pop esi
add esp, 0x48
cmp ebp, esp
call fcn.00784930
mov esp, ebp
pop ebp
ret 4