Function at 0xb85130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 4]
xor ebx, ebx
cmp dword [edi + 0x28], ebx
jne 0xb85158
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x38]
push edx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne case.default.0xb8520f
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
push 4
and edi, 8
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 0x10
push 0x10
or esi, edi
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
and edi, 4
push 2
or edi, esi
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 2
push 1
or esi, edi
call ebx
test al, 0xfe
mov eax, dword [ebp + 0xc]
mov ecx, 0
setne cl
shr eax, 0x10
add eax, 0xfffffe00
or ecx, esi
cmp eax, 9
ja case.default.0xb8520f
jmp dword [eax*4 + 0xb8538c]
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00b83af0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00b84fe0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.00b84fb0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00b832d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00b85050
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push 0
call fcn.00b85070
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00b837a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00b85030
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.00b85000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00b839f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8