Function at 0x11354ee4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], 0x1b
push edi
mov ebx, ecx
jne 0x11354f30
cmp dword [ebx + 0x2a8], esi
jl 0x11354f0e
or ecx, 0xffffffff
push esi
mov eax, ecx
push ecx
push eax
mov ecx, ebx
call fcn.1135190f
cmp dword [ebx + 0x2cc], esi
lea edi, [ebx + 0x2cc]
je 0x11354f30
mov eax, dword [ebx]
push 0xffffffffffffffff
mov ecx, ebx
call dword [eax + 0x124]
mov dword [edi], esi
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp dword [ebx + 0x2a8], esi
jge 0x11355496
cmp dword [ebx + 0x2cc], esi
jne 0x11355496
cmp dword [ebx + 0x2e0], esi
jne 0x11354f5c
cmp dword [ebx + 0x434], esi
je 0x11355496
mov ecx, ebx
call fcn.11352f1a
mov edi, eax
mov eax, dword [ebp + 8]
cmp eax, 0x26
ja 0x11355432
je 0x1135530d
sub eax, 0xd
je 0x1135549d
sub eax, 0x14
je 0x11355256
dec eax
je 0x11355195
dec eax
je 0x11355162
dec eax
je 0x1135512c
dec eax
jne 0x11355496
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x1135549d
mov eax, dword [ebx + 0x318]
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
cmp dword [ebx + 0x434], esi
mov edi, dword [ebx + 0x31c]
mov dword [ebp + 8], eax
je 0x11354ffe
mov eax, dword [ebx + 0x310]
mov edi, dword [ebx + 0x314]
push eax
mov ecx, ebx
call fcn.11356c34
mov ecx, eax
cmp ecx, esi
mov dword [ebp + 8], ecx
je 0x11354ffc
push edi
call fcn.1134d264
mov edi, eax
jmp 0x11354ffe
xor edi, edi
cmp edi, esi
je 0x1135506b
cmp dword [ebx + 0x434], esi
je 0x1135502a
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.1134933c
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
cmp eax, esi
jle 0x11355024
dec eax
jmp 0x11355068
or dword [ebp - 0x14], 0xffffffff
jmp 0x1135506b
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.11349170
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0xc]
push edx
add eax, 0xfffffffe
lea edx, [ebp - 4]
dec ecx
push edx
push ecx
mov ecx, dword [edi + 0x18]
push eax
mov dword [ebp - 0xc], esi
call fcn.1134d3ec
test eax, eax
je 0x1135506b
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], esi
jge 0x11355079
cmp dword [ebp - 0x14], esi
jl 0x11355123
cmp dword [ebp + 8], esi
je 0x11355123
cmp dword [ebp - 0x18], esi
jl 0x11355099
cmp dword [ebp - 0x14], 0xffffffff
jne 0x11355099
cmp dword [ebx + 0x298], esi
jg 0x11355123
lea esi, [ebx + 0x320]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
push 1
mov ecx, ebx
movsd dword es:[edi], dword [esi]
pop eax
push eax
mov dword [ebx + 0x334], eax
push dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
call fcn.11356723
cmp dword [ebx + 0x36c], 0
jne 0x11355114
mov esi, dword [ebp - 0x18]
test esi, esi
jl 0x113550d3
cmp dword [ebp - 0x14], 0xffffffff
je 0x113550e8
lea eax, [ebp - 0x18]
lea ecx, [ebx + 0x380]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.113514ce
jmp 0x11355105
mov ecx, ebx
call fcn.11356577
mov edx, dword [ebp - 0x18]
lea ecx, [ebx + 0x380]
dec eax
and dword [ecx], 0
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], esi
lea eax, [ebp - 0x38]
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
and dword [ebx + 0x334], 0
push dword [ebp + 8]
jmp 0x11355893
push esi
push esi
push 6
jmp 0x113558a3
lea eax, [ebx + 0x310]
xor ecx, ecx
cmp dword [eax], esi
jge 0x1135513d
cmp dword [eax + 4], esi
jl 0x11355145
mov eax, dword [ebx + 0x314]
jmp 0x11355147
xor eax, eax
push 1
push eax
push ecx
mov ecx, ebx
call fcn.11356723
push esi
push esi
push 6
mov ecx, ebx
call fcn.11354884
jmp 0x1135549d
mov ecx, ebx
call fcn.1135486d
lea ecx, [ebx + 0x310]
dec eax
cmp dword [ecx], esi
jge 0x11355179
cmp dword [ecx + 4], esi
jl 0x11355181
mov ecx, dword [ebx + 0x314]
jmp 0x11355183
xor ecx, ecx
push 1
push ecx
push eax
mov ecx, ebx
call fcn.11356723
push esi
push esi
jmp 0x1135524f
cmp edi, esi
je 0x11355311
cmp dword [ebx + 0x294], esi
je 0x1135549d
mov eax, dword [ebx + 0x314]
cmp dword [ebx + 0x434], esi
mov ecx, dword [ebx + 0x310]
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x318]
je 0x113551ce
push ecx
mov ecx, ebx
call fcn.11356c34
cmp eax, esi
je 0x1135549d
lea esi, [eax + 0x24]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x30]
lea edx, [ebp + 8]
or dword [ebp - 0x10], 0xffffffff
or dword [ebp - 0xc], 0xffffffff
lea ecx, [eax - 1]
mov eax, dword [ebx + 0x294]
sub eax, dword [ebx + 0x248]
and dword [ebp + 8], 0
push 0
push edx
add eax, dword [ebp - 0x34]
lea edx, [ebp - 0x10]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.11352dd5
mov esi, eax
test esi, esi
je 0x1135521f
mov eax, dword [esi + 0x48]
jmp 0x11355227
mov ecx, ebx
call fcn.1135486d
dec eax
mov ecx, dword [ebp - 0x14]
xor edi, edi
cmp eax, edi
jge 0x11355238
cmp ecx, edi
jl 0x1135549d
push 1
push ecx
push eax
mov ecx, ebx
call fcn.11356723
cmp esi, edi
je 0x1135524d
push esi
jmp 0x11355893
push edi
push edi
push 7
jmp 0x11355156
cmp edi, esi
je 0x11355311
cmp dword [ebx + 0x294], esi
je 0x1135549d
mov eax, dword [ebx + 0x314]
cmp dword [ebx + 0x434], esi
mov ecx, dword [ebx + 0x310]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x318]
je 0x1135528f
push ecx
mov ecx, ebx
call fcn.11356c34
cmp eax, esi
je 0x1135549d
lea esi, [eax + 0x24]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x30]
lea edx, [ebp + 8]
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
lea ecx, [eax - 1]
mov eax, dword [ebx + 0x248]
sub eax, dword [ebx + 0x294]
and dword [ebp + 8], 0
push 0
push edx
add eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x18]
push edx
push eax
push ecx
mov ecx, ebx
call fcn.11352dd5
mov esi, eax
test esi, esi
je 0x113552e0
mov eax, dword [esi + 0x48]
jmp 0x113552e2
xor eax, eax
xor edi, edi
cmp eax, edi
jge 0x113552f1
cmp dword [ebp - 0xc], edi
jl 0x1135549d
push 1
mov ecx, ebx
push dword [ebp - 0xc]
push eax
call fcn.11356723
cmp esi, edi
jne 0x11355247
push edi
push edi
jmp 0x11355154
cmp edi, esi
jne 0x1135531e
xor eax, eax
xor ecx, ecx
push 1
push ecx
push eax
jmp 0x1135514b
mov eax, dword [ebx + 0x314]
cmp dword [ebx + 0x434], esi
mov ecx, dword [ebx + 0x310]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x318]
je 0x11355343
push ecx
mov ecx, ebx
call fcn.11356c34
cmp eax, esi
je 0x1135549d
lea esi, [eax + 0x24]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
push 1
push edx
lea edx, [ebp - 0x18]
add ecx, 0xfffffffe
dec eax
push edx
push ecx
push eax
mov ecx, ebx
call fcn.11352dd5
test eax, eax
mov dword [ebp + 8], eax
je 0x11355429
mov eax, dword [eax + 0x48]
mov ecx, dword [ebp - 4]
test eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jge 0x113553a1
test ecx, ecx
jl 0x1135549d
push 1
pop ecx
push ecx
mov dword [ebx + 0x334], ecx
push dword [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.11356723
cmp dword [ebx + 0x36c], 0
jne 0x1135541a
lea esi, [ebx + 0x320]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
test esi, esi
jl 0x113553d9
cmp dword [ebp - 0x14], 0xffffffff
je 0x113553ee
lea eax, [ebp - 0x18]
lea ecx, [ebx + 0x380]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.113514ce
jmp 0x1135540b
mov ecx, ebx
call fcn.11356577
mov edx, dword [ebp - 0x18]
lea ecx, [ebx + 0x380]
dec eax
and dword [ecx], 0
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], esi
lea eax, [ebp - 0x38]
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
and dword [ebx + 0x334], 0
push dword [ebp + 8]
jmp 0x11355893
push 0
push 0
jmp 0x11355154
sub eax, 0x27
je 0x113556f4
dec eax
je 0x113555b1
sub eax, 6
je 0x113554a4
sub eax, 0x43
je 0x11355481
dec eax
dec eax
jne 0x11355496
cmp edi, esi
je 0x11355496
cmp dword [edi + 0x3c], esi
je 0x11355496
mov eax, dword [ebx]
push esi
push edi
mov ecx, ebx
call dword [eax + 0x14c]
test eax, eax
je 0x11355496
push edi
mov ecx, ebx
call fcn.11352f66
cmp eax, esi
je 0x1135549d
test byte [eax + 0xb8], 3
jmp 0x113555d0
cmp edi, esi
je 0x11355496
cmp dword [edi + 0x3c], esi
je 0x11355496
mov eax, dword [ebx]
push esi
push edi
mov ecx, ebx
call dword [eax + 0x14c]
mov ecx, ebx
call fcn.114eb53e
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [ebx + 0x348], esi
jne 0x1135549d
cmp dword [ebx + 0x36c], esi
je 0x11355506
push esi
mov ecx, ebx
call fcn.11352f66
mov edi, eax
cmp edi, esi
je 0x1135549d
mov eax, dword [edi + 0x18]
cmp dword [eax + 0x40], esi
je 0x1135549d
cmp dword [eax + 0x3c], esi
je 0x1135549d
cmp dword [edi + 0xb4], esi
je 0x1135549d
cmp dword [edi + 0xb0], esi
je 0x1135549d
cmp dword [edi + 0x6c], esi
jne 0x1135549d
push 1
mov ecx, edi
call fcn.11349744
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x18]
mov eax, dword [ebx]
push dword [ecx + 0x48]
mov ecx, ebx
push edi
call dword [eax + 0x160]
jmp 0x1135549d
lea ecx, [ebx + 0x380]
call fcn.1134d523
test eax, eax
je 0x1135549d
mov edi, dword [ebx + 0x384]
cmp edi, dword [ebx + 0x38c]
mov dword [ebp - 4], edi
jg 0x1135549d
push edi
mov ecx, ebx
call fcn.11352d23
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x113555ab
cmp dword [eax + 0x40], esi
je 0x113555ab
cmp dword [eax + 0x3c], esi
je 0x113555ab
cmp dword [eax + 0x34], esi
jne 0x113555ab
mov eax, dword [ebx + 0x380]
cmp eax, dword [ebx + 0x388]
mov dword [ebp + 8], eax
jg 0x113555ab
push dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
call fcn.1134d264
mov edi, eax
cmp edi, esi
je 0x1135559a
cmp dword [edi + 0xb4], esi
je 0x1135559a
cmp dword [edi + 0xb0], esi
je 0x1135559a
push 1
mov ecx, edi
call fcn.11349744
push dword [edi + 0xbc]
mov ecx, dword [edi + 0x18]
mov eax, dword [ebx]
push dword [ecx + 0x48]
mov ecx, ebx
push edi
call dword [eax + 0x160]
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebx + 0x388]
jle 0x11355559
mov edi, dword [ebp - 4]
inc edi
jmp 0x1135551b
cmp edi, esi
je 0x11355311
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
je 0x113555e9
push edi
mov ecx, ebx
call fcn.11352f66
cmp eax, esi
je 0x1135549d
mov esi, dword [eax]
or edx, 0xffffffff
mov ecx, edx
push edx
push ecx
mov ecx, eax
call dword [esi + 0x44]
jmp 0x1135549d
mov eax, dword [ebx + 0x314]
cmp dword [ebx + 0x434], esi
mov ecx, dword [ebx + 0x310]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x318]
je 0x1135560e
push ecx
mov ecx, ebx
call fcn.11356c34
cmp eax, esi
je 0x1135549d
lea esi, [eax + 0x24]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
and dword [ebp - 0xc], 0
lea edx, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
push 1
push edx
lea edx, [ebp - 0x18]
add ecx, 2
dec eax
push edx
push ecx
push eax
mov ecx, ebx
call fcn.11352dd5
test eax, eax
mov dword [ebp + 8], eax
je 0x1135549d
mov eax, dword [eax + 0x48]
mov ecx, dword [ebp - 4]
test eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ecx
jge 0x1135566c
test ecx, ecx
jl 0x1135549d
push 1
pop ecx
push ecx
mov dword [ebx + 0x334], ecx
push dword [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.11356723
cmp dword [ebx + 0x36c], 0
jne 0x113556e5
lea esi, [ebx + 0x320]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x18]
test esi, esi
jl 0x113556a4
cmp dword [ebp - 0x14], 0xffffffff
je 0x113556b9
lea eax, [ebp - 0x18]
lea ecx, [ebx + 0x380]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.113514ce
jmp 0x113556d6
mov ecx, ebx
call fcn.11356577
mov edx, dword [ebp - 0x18]
lea ecx, [ebx + 0x380]
dec eax
and dword [ecx], 0
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], esi
lea eax, [ebp - 0x38]
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
and dword [ebx + 0x334], 0
push dword [ebp + 8]
jmp 0x11355893
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ah, 0x80
jne 0x1135549d
mov eax, dword [ebx + 0x318]
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x14], 0xffffffff
cmp dword [ebx + 0x434], esi
mov edi, dword [ebx + 0x31c]
mov dword [ebp + 8], eax
je 0x1135574d
mov eax, dword [ebx + 0x310]
mov edi, dword [ebx + 0x314]
push eax
mov ecx, ebx
call fcn.11356c34
mov ecx, eax
cmp ecx, esi
mov dword [ebp + 8], ecx
je 0x1135574b
push edi
call fcn.1134d264
mov edi, eax
jmp 0x1135574d
xor edi, edi
cmp edi, esi
je 0x113557d8
cmp dword [ebx + 0x434], esi
je 0x11355795
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.1134933c
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov eax, dword [eax + 4]
cmp eax, esi
mov dword [ebp - 0x14], eax
jl 0x1135578f
push 1
lea ecx, [ebx + 0x25c]
call fcn.1134e947
dec eax
cmp dword [ebp - 0x14], eax
jge 0x1135578f
inc dword [ebp - 0x14]
jmp 0x113557e8
or dword [ebp - 0x14], 0xffffffff
jmp 0x113557e8
lea eax, [ebp - 0x38]
mov ecx, edi
push eax
call fcn.11349170
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
lea edx, [ebp - 0xc]
push edx
add eax, 2
lea edx, [ebp - 4]
dec ecx
push edx
push ecx
mov ecx, dword [edi + 0x18]
push eax
mov dword [ebp - 0xc], esi
call fcn.1134d3ec
test eax, eax
je 0x113557e8
mov eax, dword [edi + 0x18]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
jmp 0x113557e8
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x113557e8
mov eax, dword [eax + 0x48]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], esi
jge 0x113557f6
cmp dword [ebp - 0x14], esi
jl 0x1135589f
cmp dword [ebp + 8], esi
je 0x1135589f
cmp dword [ebp - 0x18], esi
jl 0x1135580e
cmp dword [ebp - 0x14], 0xffffffff
je 0x1135589f
lea esi, [ebx + 0x320]
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
push 1
mov ecx, ebx
movsd dword es:[edi], dword [esi]
pop eax
push eax
mov dword [ebx + 0x334], eax
push dword [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x18]
movsd dword es:[edi], dword [esi]
call fcn.11356723
cmp dword [ebx + 0x36c], 0
jne 0x11355889
mov esi, dword [ebp - 0x18]
test esi, esi
jl 0x11355848
cmp dword [ebp - 0x14], 0xffffffff
je 0x1135585d
lea eax, [ebp - 0x18]
lea ecx, [ebx + 0x380]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.113514ce
jmp 0x1135587a
mov ecx, ebx
call fcn.11356577
mov edx, dword [ebp - 0x18]
lea ecx, [ebx + 0x380]
dec eax
and dword [ecx], 0
mov dword [ecx + 4], edx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], esi
lea eax, [ebp - 0x38]
push 1
push eax
push dword [ebx + 0x1c]
call dword [sym.imp.USER32.dll_InvalidateRect]
and dword [ebx + 0x334], 0
push dword [ebp + 8]
mov ecx, ebx
call fcn.113558af
jmp 0x1135549d
push esi
push esi
push 7
mov ecx, ebx
call fcn.11354a85
jmp 0x1135549d