Function at 0x1011f1d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
test esi, esi
je 0x1011f2db
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1011f2db
mov eax, dword [esi]
mov ecx, esi
mov eax, dword [eax + 0x40]
call eax
test eax, eax
je 0x1011f2db
mov ecx, esi
call fcn.10119150
test al, al
je 0x1011f2db
mov eax, dword [ebp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
and eax, 1
push eax
call esi
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
shr eax, 0xf
and eax, 0xffffff01
shr ecx, 1
mov dword [esp + 8], eax
and cl, 1
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x18], eax
mov dword [edx + 0x30], edi
mov byte [edi + 0x1c], cl
mov ecx, dword [ebp + 0x18]
mov al, cl
and al, 1
mov dword [edi + 0xc], edx
mov byte [edi + 0x1e], al
mov eax, ecx
shr eax, 2
and al, 1
mov byte [edi + 0x23], al
mov eax, ecx
shr eax, 3
and al, 1
mov byte [edi + 0x24], al
mov eax, ecx
shr eax, 4
and al, 1
mov byte [edi + 0x25], al
mov eax, ecx
shr eax, 5
and al, 1
mov byte [edi + 0x26], al
mov eax, ecx
shr eax, 8
and al, 1
push 1
mov byte [edi + 0x27], al
call esi
mov esi, dword [ebp + 8]
shr eax, 0xf
and al, 1
mov byte [edi + 0x1d], al
mov byte [esi + 0x79], 0
mov eax, dword [edi + 0xc]
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1011f2c8
cmp byte [edi + 0x23], 0
jne 0x1011f2c8
mov eax, dword [edi + 0xc]
push 0
push 0
push 0x211
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
push ecx
mov ecx, edi
call fcn.101213d0
test al, al
jne 0x1011f2e5
mov ecx, esi
call fcn.10119340
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp byte [edi + 0x23], 0
mov eax, dword [esp + 8]
mov byte [edi + 0x1f], al
mov byte [edi + 0x1d], al
jne 0x1011f31f
mov eax, dword [edi + 0xc]
push 0
push dword [esi + 0x20]
push 0x117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0xc]
push eax
push 0
push 0x2117
push dword [eax + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push 0x10
push dword [ebp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], eax
movlpd qword [esp + 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x1011f34d
mov eax, dword [ebp + 0x1c]
movups xmm0, xmmword [eax]
jmp 0x1011f350
xorps xmm0, xmm0
movups xmmword [esi + 0xc4], xmm0
movzx eax, byte [edi + 0x26]
mov ecx, esi
push eax
lea eax, [esp + 0xc]
push eax
call fcn.10118fe0
mov ecx, dword [ebp + 0x18]
mov eax, ecx
shr eax, 7
and al, 1
shr ecx, 6
movzx eax, al
and cl, 1
push eax
movzx eax, cl
push eax
push dword [ebp + 0x1c]
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x20]
push eax
push ecx
call fcn.10120330
push 0x250
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x20]
push dword [esp + 0x20]
push 0xffffffffffffffff
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, esi
call fcn.10118f90
push ecx
mov ecx, edi
call fcn.10121450
cmp byte [edi + 0x2b], 0
jne 0x1011f2db
mov ecx, esi
call fcn.10118fc0
push esi
mov ecx, edi
call fcn.10120080
mov ecx, esi
call fcn.10119340
cmp byte [edi + 0x1e], 0
je 0x1011f2db
mov eax, dword [edi + 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18