Function at 0x1035130
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 4]
xor ebx, ebx
cmp dword [edi + 0x28], ebx
jne 0x1035158
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [edi + 0x28], eax
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [esi + 4]
mov edx, dword [eax + 0x38]
push edx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne case.default.0x103520f
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x38]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
push 4
and edi, 8
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 0x10
push 0x10
or esi, edi
call ebx
and al, 0xfe
movsx edi, al
neg edi
sbb edi, edi
and edi, 4
push 2
or edi, esi
call ebx
and al, 0xfe
movsx esi, al
neg esi
sbb esi, esi
and esi, 2
push 1
or esi, edi
call ebx
test al, 0xfe
mov eax, dword [ebp + 0xc]
mov ecx, 0
setne cl
shr eax, 0x10
add eax, 0xfffffe00
or ecx, esi
cmp eax, 9
ja case.default.0x103520f
jmp dword [eax*4 + 0x103538c]
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.01033af0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.01034fe0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.01034fb0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.010332d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.01035050
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push 0
call fcn.01035070
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.010337a0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
push edx
push ecx
mov ecx, dword [ebp + 8]
push ecx
call fcn.01035030
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx edx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl edx, 0x10
or edx, eax
mov eax, dword [ebp + 8]
push edx
push ecx
call fcn.01035000
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movzx eax, word [esp + 0x14]
movzx edx, word [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ecx + 4]
shl eax, 0x10
or eax, edx
call fcn.010339f0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8