Function at 0x1005e255
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
call fcn.100336b8
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
test ax, ax
setl al
push 0x11
mov byte [esi + 9], al
call edi
test ax, ax
setl al
and byte [esi + 8], 0
and byte [esi + 0xb], 0
and byte [esi + 0xc], 0
push 0x90
mov byte [esi + 0xa], al
mov byte [esi + 0xd], 1
call edi
and eax, 1
cmp byte [ebp + 0xc], 0
mov dword [ebp - 4], eax
je 0x1005e4d5
mov ebx, dword [ebp + 8]
push ebx
call edi
push 0x10
test ax, ax
pop ecx
setl al
cmp ebx, ecx
mov byte [esi + 0xc], al
je 0x1005e4c9
push 0x11
pop edx
cmp ebx, edx
je 0x1005e4c9
cmp dword [ebp - 4], 0
je 0x1005e2e8
cmp ebx, 0x5f
jle 0x1005e2e8
cmp ebx, 0x6a
jge 0x1005e2e8
mov byte [esi + 0xb], 1
add ebx, 0xffffffd0
jmp 0x1005e30c
cmp ebx, 0x69
jle 0x1005e2fb
cmp ebx, 0x70
jge 0x1005e2fb
mov byte [esi + 0xb], 1
add ebx, 0xffffffc0
jmp 0x1005e30c
cmp ebx, 0x6f
jle 0x1005e313
cmp ebx, 0x7f
jge 0x1005e313
mov byte [esi + 8], 1
add ebx, 0xffffffb9
mov dword [esi], ebx
jmp 0x1005e4da
cmp ebx, 0x24
jg 0x1005e3f5
je 0x1005e3e6
cmp ebx, 0x14
jg 0x1005e395
je 0x1005e386
push 8
mov eax, ebx
pop ecx
sub eax, ecx
je 0x1005e413
dec eax
je 0x1005e377
sub eax, 3
je 0x1005e368
dec eax
je 0x1005e359
sub eax, 6
jne 0x1005e47b
mov byte [esi + 8], 1
mov dword [esi], 0x16
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0xd
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 7
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x12
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x17
jmp 0x1005e4da
mov eax, ebx
sub eax, 0x1b
je 0x1005e3d7
sub eax, 5
je 0x1005e3c8
dec eax
je 0x1005e413
dec eax
je 0x1005e3bd
dec eax
jne 0x1005e47b
mov byte [esi + 8], 1
mov dword [esi], 4
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], edx
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x20
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x13
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 3
jmp 0x1005e4da
cmp ebx, 0x2e
jg 0x1005e466
je 0x1005e45a
mov eax, ebx
sub eax, 0x25
je 0x1005e44b
dec eax
je 0x1005e43c
dec eax
je 0x1005e42d
dec eax
je 0x1005e41e
push 5
pop ecx
sub eax, ecx
jne 0x1005e47b
mov byte [esi + 8], 1
mov dword [esi], ecx
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0xf
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 2
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0xe
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 1
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 6
jmp 0x1005e4da
mov eax, ebx
sub eax, 0x5b
je 0x1005e4bd
dec eax
je 0x1005e4b1
dec eax
je 0x1005e4a5
sub eax, 0x33
je 0x1005e499
dec eax
je 0x1005e48d
push ebx
mov ecx, esi
call fcn.1005e5a1
movzx eax, al
mov dword [esi], eax
mov dword [esi + 4], ebx
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x19
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x18
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x3a
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x39
jmp 0x1005e4da
mov byte [esi + 8], 1
mov dword [esi], 0x38
jmp 0x1005e4da
mov byte [esi + 8], 1
add ebx, 0x55
jmp 0x1005e30c
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 8