Function at 0x1011b550
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101875db
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x1c0
mov eax, dword [0x101ae0c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x164], 0
push 0
mov eax, dword [ebx + 0xc]
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov dword [ebp - 0x18c], eax
mov ecx, dword [ebx + 0xc]
mov dword [ebp - 0x184], ecx
mov edx, dword [ebp - 0x184]
sub edx, 0x21
mov dword [ebp - 0x184], edx
cmp dword [ebp - 0x184], 0x84
ja case.0x1011b5dc.8
mov eax, dword [ebp - 0x184]
movzx ecx, byte [eax + 0x1011bb20]
jmp dword [ecx*4 + 0x1011bb18]
mov edx, dword [ebp - 0x18c]
or edx, 0x100
mov dword [ebp - 0x18c], edx
push 0x80
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp - 0x18c]
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextA]
mov dword [ebp - 0x198], eax
cmp dword [ebp - 0x198], 0
je 0x1011b62a
cmp dword [ebx + 0xc], 0x14
jne 0x1011b92d
mov edx, dword [ebx + 0xc]
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
sub eax, 1
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0x13
ja case.0x1011b65c.2
mov ecx, dword [ebp - 0x188]
movzx edx, byte [ecx + 0x1011bbc4]
jmp dword [edx*4 + 0x1011bba8]
xor eax, eax
mov byte [ebp - 0x176], al
xor ecx, ecx
mov byte [ebp - 0x177], cl
xor edx, edx
mov byte [ebp - 0x178], dl
movzx eax, byte [ebp - 0x176]
push eax
movzx ecx, byte [ebp - 0x177]
push ecx
movzx edx, byte [ebp - 0x178]
push edx
lea eax, [ebp - 0xf0]
push eax
call fcn.1003a8e0
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
mov ecx, dword [ebx + 8]
call fcn.10003f00
mov ecx, dword [ebp - 0x164]
or ecx, 1
mov dword [ebp - 0x164], ecx
mov eax, dword [ebx + 8]
jmp 0x1011bafa
xor edx, edx
mov byte [ebp - 0x179], dl
xor eax, eax
mov byte [ebp - 0x17a], al
xor ecx, ecx
mov byte [ebp - 0x17b], cl
movzx edx, byte [ebp - 0x179]
push edx
movzx eax, byte [ebp - 0x17a]
push eax
movzx ecx, byte [ebp - 0x17b]
push ecx
lea edx, [ebp - 0x100]
push edx
call fcn.1003a8f0
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
mov ecx, dword [ebx + 8]
call fcn.10003f00
mov eax, dword [ebp - 0x164]
or eax, 1
mov dword [ebp - 0x164], eax
mov eax, dword [ebx + 8]
jmp 0x1011bafa
xor ecx, ecx
mov byte [ebp - 0x17c], cl
xor edx, edx
mov byte [ebp - 0x175], dl
xor eax, eax
mov byte [ebp - 0x17d], al
movzx ecx, byte [ebp - 0x17c]
push ecx
movzx edx, byte [ebp - 0x175]
push edx
movzx eax, byte [ebp - 0x17d]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.1003a900
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
mov ecx, dword [ebx + 8]
call fcn.10003f00
mov edx, dword [ebp - 0x164]
or edx, 1
mov dword [ebp - 0x164], edx
mov eax, dword [ebx + 8]
jmp 0x1011bafa
xor eax, eax
mov byte [ebp - 0x17e], al
xor ecx, ecx
mov byte [ebp - 0x17f], cl
xor edx, edx
mov byte [ebp - 0x165], dl
movzx eax, byte [ebp - 0x17e]
push eax
movzx ecx, byte [ebp - 0x17f]
push ecx
movzx edx, byte [ebp - 0x165]
push edx
lea eax, [ebp - 0x120]
push eax
call fcn.1003a910
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
mov ecx, dword [ebx + 8]
call fcn.10003f00
mov ecx, dword [ebp - 0x164]
or ecx, 1
mov dword [ebp - 0x164], ecx
mov eax, dword [ebx + 8]
jmp 0x1011bafa
xor edx, edx
mov byte [ebp - 0x166], dl
xor eax, eax
mov byte [ebp - 0x167], al
xor ecx, ecx
mov byte [ebp - 0x168], cl
movzx edx, byte [ebp - 0x166]
push edx
movzx eax, byte [ebp - 0x167]
push eax
movzx ecx, byte [ebp - 0x168]
push ecx
lea edx, [ebp - 0xe0]
push edx
call fcn.1003a920
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
mov ecx, dword [ebx + 8]
call fcn.10003f00
mov eax, dword [ebp - 0x164]
or eax, 1
mov dword [ebp - 0x164], eax
mov eax, dword [ebx + 8]
jmp 0x1011bafa
xor ecx, ecx
mov byte [ebp - 0x169], cl
xor edx, edx
mov byte [ebp - 0x16a], dl
xor eax, eax
mov byte [ebp - 0x16b], al
movzx ecx, byte [ebp - 0x169]
push ecx
movzx edx, byte [ebp - 0x16a]
push edx
movzx eax, byte [ebp - 0x16b]
push eax
lea ecx, [ebp - 0x130]
push ecx
call fcn.1003a930
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
mov ecx, dword [ebx + 8]
call fcn.10003f00
mov edx, dword [ebp - 0x164]
or edx, 1
mov dword [ebp - 0x164], edx
mov eax, dword [ebx + 8]
jmp 0x1011bafa
xor eax, eax
mov byte [ebp - 0x16c], al
xor ecx, ecx
mov byte [ebp - 0x16d], cl
xor edx, edx
mov byte [ebp - 0x16e], dl
movzx eax, byte [ebp - 0x16c]
push eax
movzx ecx, byte [ebp - 0x16d]
push ecx
movzx edx, byte [ebp - 0x16e]
push edx
lea eax, [ebp - 0x140]
push eax
call fcn.1003a940
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
mov ecx, dword [ebx + 8]
call fcn.10003f00
mov ecx, dword [ebp - 0x164]
or ecx, 1
mov dword [ebp - 0x164], ecx
mov eax, dword [ebx + 8]
jmp 0x1011bafa
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0xb0]
call fcn.10003f00
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0xb0]
call fcn.1003aed0
mov ecx, dword [eax]
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x19c]
mov dword [ebp - 0x1a8], edx
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0xb0]
call fcn.1003ae80
mov ecx, dword [eax]
mov dword [ebp - 0x1a0], ecx
mov edx, dword [ebp - 0x1a0]
mov dword [ebp - 0x1ac], edx
lea eax, [ebp - 0x1c0]
push eax
lea ecx, [ebp - 0xb0]
call fcn.1003aed0
mov ecx, dword [eax]
mov dword [ebp - 0x1a4], ecx
mov edx, dword [ebp - 0x1a4]
mov dword [ebp - 0x1b0], edx
push fcn.100cc236
mov eax, dword [ebp - 0x1a8]
push eax
mov ecx, dword [ebp - 0x1ac]
push ecx
mov edx, dword [ebp - 0x1b0]
push edx
lea eax, [ebp - 0x1c4]
push eax
call fcn.1003b020
add esp, 0x14
xor ecx, ecx
mov byte [ebp - 0x16f], cl
xor edx, edx
mov byte [ebp - 0x170], dl
xor eax, eax
mov byte [ebp - 0x171], al
movzx ecx, byte [ebp - 0x16f]
push ecx
movzx edx, byte [ebp - 0x170]
push edx
movzx eax, byte [ebp - 0x171]
push eax
lea ecx, [ebp - 0x150]
push ecx
call fcn.1003a960
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
mov dword [ebp - 0x190], eax
xor edx, edx
mov byte [ebp - 0x172], dl
xor eax, eax
mov byte [ebp - 0x173], al
xor ecx, ecx
mov byte [ebp - 0x174], cl
lea edx, [ebp - 0xb0]
push edx
movzx eax, byte [ebp - 0x172]
push eax
movzx ecx, byte [ebp - 0x173]
push ecx
movzx edx, byte [ebp - 0x174]
push edx
lea eax, [ebp - 0x160]
push eax
call fcn.1003a950
add esp, 0x10
mov ecx, eax
call fcn.1003a9c0
push eax
lea ecx, [ebp - 0xc8]
push ecx
call fcn.100398f0
add esp, 0xc
mov dword [ebp - 0x1b4], eax
mov edx, dword [ebp - 0x1b4]
mov dword [ebp - 0x1b8], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x194], eax
mov ecx, dword [ebp - 0x190]
push ecx
mov edx, dword [ebp - 0x194]
push edx
mov eax, dword [ebx + 8]
push eax
call fcn.100330c0
add esp, 0xc
mov ecx, dword [ebp - 0x164]
or ecx, 1
mov dword [ebp - 0x164], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc8]
call fcn.10003e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.10003e70
nop
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100bdc32
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret