Function at 0xa35130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 4]
xor ebx, ebx
cmp dword [edi + 0x28], ebx
jne 0xa35158
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x38]
push edx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne case.default.0xa3520f
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
push 4
and edi, 8
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 0x10
push 0x10
or esi, edi
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
and edi, 4
push 2
or edi, esi
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 2
push 1
or esi, edi
call ebx
test al, 0xfe
mov eax, dword [ebp + 0xc]
mov ecx, 0
setne cl
shr eax, 0x10
add eax, 0xfffffe00
or ecx, esi
cmp eax, 9
ja case.default.0xa3520f
jmp dword [eax*4 + 0xa3538c]
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00a33af0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00a34fe0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.00a34fb0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00a332d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00a35050
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push 0
call fcn.00a35070
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00a337a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00a35030
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.00a35000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.00a339f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8