Function at 0x6ec71c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x6ecb84
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.006c8b70
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.006c88a0
push eax
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
call fcn.005f3dc4
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 4]
mov dl, byte [edx + 0xf08]
call fcn.005cb554
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 1
jne 0x6ec7dd
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 4]
call fcn.006c88a0
push eax
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
call fcn.005f3dc4
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.00420554
mov edx, dword [ebp - 0x30]
mov eax, 0x6ecba0
call fcn.0040950c
test eax, eax
jle 0x6ec7dd
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 1
jmp 0x6ecb69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x834]
cmp byte [eax + 0x2a], 0
je 0x6ec82c
lea eax, [ebp - 0x13]
push eax
mov eax, dword [ebp - 4]
call fcn.006c88a0
push eax
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x248]
cmp byte [ebp - 0x13], 0
je 0x6ec82c
mov edx, dword [0x6ecbb4]
mov eax, dword [ebp - 4]
or edx, dword [eax + 0x2bc]
mov eax, dword [ebp - 4]
call fcn.005b56c0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x820]
cmp byte [eax + 0xb], 0
je 0x6ec878
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
jne 0x6ec878
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
sub ax, 3
je 0x6ec86a
sub ax, 0x13
je 0x6ec86a
sub ax, 2
jne 0x6ec878
mov eax, dword [ebp - 8]
mov word [eax + 4], 0
jmp 0x6ecb69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x834]
cmp byte [eax + 0x19], 0
je 0x6eca2e
mov eax, dword [ebp - 4]
call fcn.006c88a0
push eax
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
call fcn.006c2f84
test al, al
jne 0x6eca2e
mov eax, dword [ebp - 4]
call fcn.006c88a0
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.006cc070
test al, al
je 0x6eca2e
mov eax, dword [ebp - 8]
cmp word [eax + 4], 9
je 0x6eca2e
mov eax, dword [ebp - 8]
cmp word [eax + 4], 0x1b
je 0x6eca2e
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
je 0x6eca2e
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
cmp word [eax + 0x22a], 0
je 0x6ec92f
lea ecx, [ebp - 0x12]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x22c]
call dword [ebx + 0x228]
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 0xf3c], ax
mov edx, dword [0x6ecbb4]
mov eax, dword [ebp - 4]
or edx, dword [eax + 0x2bc]
mov eax, dword [ebp - 4]
call fcn.005b56c0
mov eax, dword [ebp - 4]
call fcn.006d7224
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.005b5290
mov edx, dword [ebp - 4]
add eax, dword [edx + 0x2d0]
cmp ebx, eax
jg 0x6ec9bf
mov eax, dword [ebp - 4]
call fcn.006c884c
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.005b52b0
add ebx, eax
mov eax, dword [ebp - 4]
call fcn.006c88a0
cmp ebx, eax
jl 0x6ec9bf
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x2d0]
jl 0x6ec9bf
mov eax, dword [ebp - 4]
call fcn.006c88a0
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.006c884c
cmp ebx, eax
jge 0x6ec9db
mov eax, dword [ebp - 4]
call fcn.006c88a0
push eax
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
call fcn.006c4db4
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 4]
call fcn.006c88a0
push eax
mov eax, dword [ebp - 4]
call fcn.006d7224
mov edx, eax
mov eax, dword [ebp - 4]
pop ecx
call fcn.005f333c
mov eax, dword [ebp - 0x28]
add eax, 2
push eax
mov eax, dword [ebp - 0x24]
add eax, 2
push eax
mov cx, word [0x6ecbb8]
xor edx, edx
mov eax, dword [ebp - 4]
mov si, 0xffd5
call fcn.004069f0
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005b5b70
jmp 0x6ecb69
mov eax, dword [ebp - 8]
cmp word [eax + 4], 0x2e
jne 0x6eca62
mov eax, dword [ebp - 4]
cmp byte [eax + 0xf1d], 0
je 0x6eca62
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
and eax, 0x400000
cmp eax, 0x400000
jne 0x6eca62
call fcn.006a608c
mov edx, dword [ebp - 8]
mov word [edx + 4], ax
mov eax, dword [ebp - 4]
call fcn.006c8824
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x14], 0
mov eax, dword [ebp - 4]
call fcn.006c88a0
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.006c2f84
test al, al
je 0x6ecab5
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
sub ax, 0xd
jne 0x6ecab5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x820]
cmp byte [eax + 6], 0
je 0x6ecab5
mov byte [ebp - 0x14], 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005b5b70
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
test byte [eax + 0x2bd], 4
je 0x6ecb58
mov eax, dword [ebp - 8]
cmp word [eax + 4], 9
je 0x6ecb58
cmp word [ebp - 0x12], 8
je 0x6ecaf0
cmp word [ebp - 0x12], 0x20
jb 0x6ecb58
cmp word [ebp - 0x12], 0xf8f7
ja 0x6ecb58
mov eax, dword [ebp - 4]
cmp word [eax + 0x22a], 0
je 0x6ecb1d
lea ecx, [ebp - 0x12]
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x22c]
call dword [ebx + 0x228]
mov ax, word [ebp - 0x12]
mov edx, dword [ebp - 8]
mov word [edx + 4], ax
mov eax, dword [ebp - 8]
mov ax, word [eax + 4]
mov edx, dword [ebp - 4]
mov word [edx + 0xf3c], ax
mov eax, dword [ebp - 4]
call fcn.006c88a0
mov ecx, eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.006c2f84
test al, al
jne 0x6ecb69
mov edx, dword [ebp - 8]
mov dx, word [edx + 4]
mov eax, dword [ebp - 4]
call fcn.005af344
jmp 0x6ecb69
cmp byte [ebp - 0x14], 0
jne 0x6ecb69
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.005b5b70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ecb8b
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0040836c
ret