Function at 0x5ef7d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x28
push esi
mov esi, ecx
mov al, byte [esi + 0x66]
test al, al
jne 0x5ef7e6
xor al, al
pop esi
add esp, 0x28
ret 0x10
mov al, byte [esi + 0x25]
test al, al
push ebx
push ebp
push edi
mov edi, dword [esp + 0x40]
mov byte [esp + 0x13], 0
je 0x5ef8df
cmp edi, 0x200
jne 0x5ef8df
call fcn.005ffb10
cmp dword [eax + 0x30], esi
jne 0x5ef8df
mov ecx, dword [esi + 0x1d8]
mov eax, dword [esi + 0x1d4]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0x1e8]
push ecx
mov ecx, esi
mov byte [esi + 0x25], 0
mov dword [esp + 0x34], 0x3ecccccd
mov dword [esp + 0x30], eax
mov dword [esp + 0x38], 4
call fcn.005e7590
mov edi, dword [eax]
mov ebp, dword [eax + 4]
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov ecx, dword [esi + 0x1d4]
mov dword [esp + 0x20], eax
mov eax, 6
sub eax, edx
cmp ecx, eax
jne 0x5ef87d
neg edi
mov dword [esp + 0x24], edi
jmp 0x5ef8cf
mov eax, dword [0x74e914]
mov eax, dword [eax + 0x14]
mov ebx, eax
sub ebx, edi
sub ebx, 6
cmp ecx, ebx
jne 0x5ef898
sub eax, edx
mov dword [esp + 0x24], eax
jmp 0x5ef8cf
mov edx, dword [esp + 0x20]
mov eax, dword [esi + 0x1d8]
mov ecx, 6
sub ecx, edx
cmp eax, ecx
jne 0x5ef8b5
neg ebp
mov dword [esp + 0x28], ebp
jmp 0x5ef8cf
mov ecx, dword [0x74e914]
mov ecx, dword [ecx + 0x18]
mov edi, ecx
sub edi, ebp
sub edi, 6
cmp eax, edi
jne 0x5ef8cf
sub ecx, edx
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.005e9010
mov edi, dword [esp + 0x40]
mov al, byte [esi + 0x90]
test al, al
je 0x5efa92
cmp edi, 0x202
jne 0x5ef908
mov byte [esi + 0x90], 0
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
cmp edi, 0x200
jne 0x5efa86
mov eax, dword [esp + 0x48]
mov edi, dword [esi + 0x1d4]
mov ebx, dword [esi + 0x1d8]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov eax, dword [0x751e10]
add eax, ecx
mov ecx, dword [0x751e14]
add ecx, edx
cmp edi, eax
mov dword [esp + 0x40], ebx
mov dword [esi + 0x1d4], eax
mov dword [esi + 0x1d8], ecx
jne 0x5ef958
cmp ebx, ecx
je 0x5efa86
mov al, byte [esi + 0x300]
test al, al
mov dword [esi + 0x5c], 0xffffffff
mov byte [esi + 0x25], 0
jns 0x5efa56
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.005e7590
mov ecx, dword [eax + 4]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax]
mov ebp, dword [eax + 8]
mov eax, dword [esi + 0x1d4]
cmp eax, edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], edx
je 0x5ef9ee
add eax, ebx
push eax
call fcn.00631bfa
add esp, 4
cmp eax, 0x14
jge 0x5ef9b4
neg ebx
mov dword [esi + 0x1d4], ebx
jmp 0x5ef9e6
mov eax, dword [esi + 0x1d4]
mov ecx, dword [0x74e914]
mov ebx, dword [ecx + 0x14]
add eax, ebp
sub eax, ebx
push eax
call fcn.00631bfa
add esp, 4
cmp eax, 0x14
jge 0x5ef9ee
mov edx, dword [0x74e914]
mov eax, dword [edx + 0x14]
sub eax, ebp
mov dword [esi + 0x1d4], eax
call sub.WINMM.dll_timeGetTime
mov dword [esi + 0x5c], eax
mov eax, dword [esi + 0x1d8]
cmp eax, dword [esp + 0x40]
je 0x5efa56
mov edi, dword [esp + 0x18]
add eax, edi
push eax
call fcn.00631bfa
add esp, 4
cmp eax, 0x14
jge 0x5efa18
neg edi
mov dword [esi + 0x1d8], edi
jmp 0x5efa4e
mov eax, dword [esi + 0x1d8]
mov ecx, dword [0x74e914]
mov edi, dword [esp + 0x20]
mov ebp, dword [ecx + 0x18]
add eax, edi
sub eax, ebp
push eax
call fcn.00631bfa
add esp, 4
cmp eax, 0x14
jge 0x5efa56
mov edx, dword [0x74e914]
mov eax, dword [edx + 0x18]
sub eax, edi
mov dword [esi + 0x1d8], eax
call sub.WINMM.dll_timeGetTime
mov dword [esi + 0x5c], eax
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x5efa76
push 0
push 0xffffffffffffffff
push 0x3ec
push 0
push str.OnGuiEvent
call fcn.005ef330
test al, al
jne 0x5efa86
mov edx, dword [esi]
push 0
push 0xffffffffffffffff
push 0x3ec
mov ecx, esi
call dword [edx + 0x2c]
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
mov al, byte [esi + 0x91]
test al, al
je 0x5efc21
cmp edi, 0x202
jne 0x5efabb
pop edi
pop ebp
pop ebx
mov byte [esi + 0x91], 0
mov al, 1
pop esi
add esp, 0x28
ret 0x10
cmp edi, 0x200
jne 0x5efc15
mov eax, dword [esp + 0x48]
mov bl, byte [0x751e0c]
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov eax, dword [0x751e04]
lea edi, [ecx + eax]
mov ecx, dword [0x751e08]
add edx, ecx
test bl, 1
je 0x5efb3b
mov ecx, dword [esi + 0x1d8]
mov eax, dword [esi + 0x1e0]
add eax, ecx
mov ecx, eax
sub ecx, edx
mov dword [esi + 0x1d8], edx
mov edx, dword [esi + 0x6c]
cmp ecx, edx
mov dword [esi + 0x1e0], ecx
jge 0x5efb24
sub eax, edx
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1e0], edx
jmp 0x5efb64
mov edx, dword [esi + 0x74]
cmp ecx, edx
jle 0x5efb64
sub eax, edx
mov dword [esi + 0x1d8], eax
mov dword [esi + 0x1e0], edx
jmp 0x5efb64
test bl, 2
je 0x5efb64
mov ebp, dword [esi + 0x1d8]
mov ecx, dword [esi + 0x6c]
mov eax, edx
sub eax, ebp
cmp eax, ecx
mov dword [esi + 0x1e0], eax
jl 0x5efb5e
mov ecx, dword [esi + 0x74]
cmp eax, ecx
jle 0x5efb64
mov dword [esi + 0x1e0], ecx
test bl, 4
je 0x5efbb5
mov eax, dword [esi + 0x1dc]
mov ebp, dword [esi + 0x1d4]
mov edx, dword [esi + 0x68]
add eax, ebp
mov ecx, eax
sub ecx, edi
cmp ecx, edx
mov dword [esi + 0x1d4], edi
mov dword [esi + 0x1dc], ecx
jge 0x5efb9e
sub eax, edx
mov dword [esi + 0x1d4], eax
mov dword [esi + 0x1dc], edx
jmp 0x5efbdc
mov edx, dword [esi + 0x70]
cmp ecx, edx
jle 0x5efbdc
sub eax, edx
mov dword [esi + 0x1d4], eax
mov dword [esi + 0x1dc], edx
jmp 0x5efbdc
test bl, 8
je 0x5efbdc
mov ecx, dword [esi + 0x68]
mov eax, edi
sub eax, dword [esi + 0x1d4]
cmp eax, ecx
mov dword [esi + 0x1dc], eax
jl 0x5efbd6
mov ecx, dword [esi + 0x70]
cmp eax, ecx
jle 0x5efbdc
mov dword [esi + 0x1dc], ecx
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x5efbfc
push 0
push 0xffffffffffffffff
push 0x3e8
push 0
push str.OnGuiEvent
call fcn.005ef330
test al, al
jne 0x5efc0c
mov edx, dword [esi]
push 0
push 0xffffffffffffffff
push 0x3e8
mov ecx, esi
call dword [edx + 0x2c]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x4c]
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
mov edi, dword [esp + 0x40]
cmp edi, 0x201
mov ebx, dword [esp + 0x48]
jne 0x5efc6d
mov edx, dword [esi]
mov ecx, ebx
shr ecx, 0x10
movsx ecx, cx
movsx eax, bx
push ecx
push eax
mov ecx, esi
call dword [edx + 0x1c]
cmp eax, 0xfffffffe
je 0x5efc6d
cmp eax, 0xffffffff
je 0x5efc6d
push esi
call fcn.005ffb10
mov ecx, eax
call fcn.0046c7b0
test al, al
je 0x5efc6d
push esi
call fcn.005ffb10
mov ecx, eax
call fcn.005fe520
mov al, byte [esi + 0x93]
test al, al
jne 0x5f011c
mov ecx, dword [0x751dc0]
test ecx, ecx
mov ebp, dword [esp + 0x44]
je 0x5efcb3
cmp dword [ecx + 0x6c], esi
jne 0x5efcb3
mov eax, dword [ecx]
call dword [eax + 0x50]
test al, al
je 0x5efcad
mov ecx, dword [0x751dc0]
mov edx, dword [ecx]
push ebx
push ebp
push edi
call dword [edx + 0x18]
test al, al
jne 0x5ef8fc
mov ecx, dword [0x751dc0]
cmp edi, 0x102
ja 0x5efdbd
je 0x5efda8
cmp edi, 0x1c
je 0x5efd66
cmp edi, 0xff
jbe 0x5efce6
mov edi, dword [esp + 0x40]
cmp edi, 0x101
jbe 0x5efdf6
cmp dword [esp + 0x40], 0x201
jne case.0x5efeb4.10
mov edx, dword [esi]
movsx ebp, bx
shr ebx, 0x10
movsx ebx, bx
push ebx
push ebp
mov ecx, esi
mov dword [esp + 0x20], ebx
call dword [edx + 0x1c]
mov edi, eax
cmp edi, 2
jne 0x5f0128
push esi
call fcn.005ffb10
mov ecx, eax
call fcn.0046c7b0
test al, al
je 0x5f0128
mov eax, dword [esi + 0x300]
test al, 4
jne 0x5f011c
mov eax, dword [esi + 0x1d4]
mov ecx, dword [esi + 0x1d8]
sub eax, ebp
pop edi
pop ebp
sub ecx, ebx
pop ebx
mov byte [esi + 0x90], 1
mov dword [0x751e10], eax
mov dword [0x751e14], ecx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
test ecx, ecx
je case.0x5efeb4.10
cmp dword [ecx + 0x6c], esi
jne case.0x5efeb4.10
mov eax, dword [ecx]
call dword [eax + 0x50]
test al, al
je case.0x5efeb4.10
test ebp, ebp
mov ecx, dword [0x751dc0]
je 0x5efd95
mov edx, dword [ecx]
call dword [edx + 0x2c]
mov al, byte [esp + 0x13]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret 0x10
mov eax, dword [ecx]
call dword [eax + 0x30]
mov al, byte [esp + 0x13]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret 0x10
mov al, byte [0x751e02]
test al, al
je case.0x5efeb4.10
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
cmp edi, 0x20d
ja 0x5efce6
mov eax, dword [esp + 0x40]
cmp eax, 0x200
jae 0x5eff63
cmp eax, 0x104
jb 0x5efce6
cmp eax, 0x105
ja 0x5efce6
mov edi, eax
cmp edi, 0x101
jne 0x5efe0b
pop edi
pop ebp
pop ebx
mov byte [0x751e02], 0
mov al, 1
pop esi
add esp, 0x28
ret 0x10
mov ecx, dword [0x751dc0]
test ecx, ecx
je 0x5efe3d
cmp dword [ecx + 0x6c], esi
jne 0x5efe3d
mov edx, dword [ecx]
call dword [edx + 0x50]
test al, al
je 0x5efe3d
mov edx, dword [esp + 0x44]
mov ecx, dword [0x751dc0]
mov eax, dword [ecx]
push ebx
push edx
push edi
call dword [eax + 0x1c]
test al, al
jne 0x5ef8fc
lea ecx, [esi + 0x204]
xor ebp, ebp
call fcn.0061e3d0
test eax, eax
jbe 0x5efe86
mov edi, edi
mov eax, dword [esi + 0x208]
mov edi, dword [eax + ebp*4]
lea eax, [eax + ebp*4]
mov al, byte [edi + 4]
test al, al
jne 0x5efe72
lea ecx, [edi + 0x84]
call fcn.00609a40
test al, al
jne 0x5efebb
lea ecx, [esi + 0x204]
inc ebp
call fcn.0061e3d0
cmp ebp, eax
jb 0x5efe50
mov edi, dword [esp + 0x40]
cmp edi, 0x100
jne 0x5efce6
mov al, byte [esi + 0x61]
test al, al
je 0x5f011c
mov eax, dword [esp + 0x44]
add eax, 0xfffffff7
cmp eax, 0x1f
ja case.0x5efeb4.10
movzx eax, byte [eax + 0x5f01cc]
jmp dword [eax*4 + 0x5f01bc]
cmp dword [esp + 0x40], 0x100
jne 0x5efed3
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x3c]
mov byte [0x751e02], 1
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
mov eax, dword [0x751dc0]
test eax, eax
je case.0x5efeb4.10
push 1
mov ecx, esi
call fcn.005edac0
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
mov eax, dword [0x751dc0]
test eax, eax
je case.0x5efeb4.10
push 0
mov ecx, esi
call fcn.005edac0
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
mov eax, dword [0x751dc0]
test eax, eax
jne 0x5eff3d
mov ecx, esi
call fcn.005ecf40
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret 0x10
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
sete cl
mov byte [esp + 0x40], al
push ecx
mov ecx, esi
call fcn.005edac0
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x28
ret 0x10
mov al, byte [esi + 0x62]
test al, al
je 0x5f011c
call fcn.00609f10
mov ecx, dword [eax + 0x14c]
test ecx, ecx
je 0x5eff8f
call fcn.00609f10
cmp dword [eax + 0x14c], 3
jne 0x5efce6
mov eax, dword [esi + 0x25c]
mov ecx, dword [esi + 0x260]
mov edx, ebx
shr edx, 0x10
movsx edi, dx
add eax, dword [esi + 0x1d4]
movsx ebp, bx
sub ebp, eax
add ecx, dword [esi + 0x1d8]
mov al, byte [esi + 0x92]
sub edi, ecx
test al, al
je 0x5effc6
sub edi, dword [esi + 0x1e4]
mov eax, dword [esp + 0x40]
cmp eax, 0x201
je 0x5effd8
cmp eax, 0x203
jne 0x5f002e
mov ecx, dword [0x751dc0]
test ecx, ecx
je 0x5efff0
cmp dword [ecx + 0x6c], esi
jne 0x5efff0
cmp dword [ecx + 0x9c], 4
je 0x5f0034
mov edx, dword [esi]
push edi
push ebp
mov ecx, esi
call dword [edx + 0x30]
mov ebx, eax
test ebx, ebx
je 0x5f002a
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x50]
test al, al
je 0x5f002a
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
mov edx, dword [ebx]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edi
push ebp
push eax
mov ecx, ebx
call dword [edx + 0x20]
test al, al
jne 0x5ef8fc
mov ebx, dword [esp + 0x48]
mov ecx, dword [0x751dc0]
test ecx, ecx
je 0x5f0066
cmp dword [ecx + 0x6c], esi
jne 0x5f0066
mov edx, dword [ecx]
call dword [edx + 0x50]
test al, al
je 0x5f0066
mov edx, dword [esp + 0x44]
mov ecx, dword [0x751dc0]
mov eax, dword [ecx]
push ebx
push edx
mov edx, dword [esp + 0x48]
push edi
push ebp
push edx
call dword [eax + 0x20]
test al, al
jne 0x5ef8fc
mov eax, dword [esi]
push edi
push ebp
mov ecx, esi
call dword [eax + 0x30]
test eax, eax
je 0x5f0097
mov ecx, dword [esp + 0x44]
mov edx, dword [eax]
push ebx
push ecx
mov ecx, dword [esp + 0x48]
push edi
push ebp
push ecx
mov ecx, eax
call dword [edx + 0x20]
test al, al
je 0x5f00cf
pop edi
pop ebp
pop ebx
mov al, 1
pop esi
add esp, 0x28
ret 0x10
cmp dword [esp + 0x40], 0x201
jne 0x5f00cf
mov ecx, dword [0x751dc0]
test ecx, ecx
je 0x5f00cf
mov eax, dword [ecx + 0x9c]
cmp eax, 6
je 0x5f00cf
cmp eax, 7
je 0x5f00cf
cmp dword [ecx + 0x6c], esi
jne 0x5f00cf
mov edx, dword [ecx]
call dword [edx + 0x30]
mov dword [0x751dc0], 0
mov eax, dword [esp + 0x40]
sub eax, 0x200
je 0x5f0113
sub eax, 5
jne 0x5efce6
call fcn.005ffb10
cmp dword [eax + 0x30], esi
jne case.0x5efeb4.10
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x70]
test al, al
je case.0x5efeb4.10
pop edi
pop ebp
mov byte [esp + 0xb], 1
mov al, byte [esp + 0xb]
pop ebx
pop esi
add esp, 0x28
ret 0x10
push edi
push ebp
mov ecx, esi
call fcn.005e7640
pop edi
pop ebp
pop ebx
xor al, al
pop esi
add esp, 0x28
ret 0x10
push edi
mov ecx, esi
call fcn.005e7400
mov ebx, eax
test ebx, ebx
je case.0x5efeb4.10
push esi
mov dword [0x751e0c], ebx
call fcn.005ffb10
mov ecx, eax
call fcn.0046c7b0
test al, al
je case.0x5efeb4.10
xor ecx, ecx
xor eax, eax
test bl, 4
mov byte [esi + 0x91], 1
je 0x5f016d
mov ecx, dword [esi + 0x1d4]
jmp 0x5f017e
test bl, 8
je 0x5f017e
mov ecx, dword [esi + 0x1dc]
add ecx, dword [esi + 0x1d4]
test bl, 1
je 0x5f018b
mov eax, dword [esi + 0x1d8]
jmp 0x5f019c
test bl, 2
je 0x5f019c
mov eax, dword [esi + 0x1e0]
add eax, dword [esi + 0x1d8]
sub ecx, ebp
pop edi
mov dword [0x751e04], ecx
mov ecx, dword [esp + 0x14]
pop ebp
sub eax, ecx
pop ebx
mov dword [0x751e08], eax
mov al, 1
pop esi
add esp, 0x28
ret 0x10