Function at 0x10b95f80
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x11
xor ebp, ebp
xor edi, edi
call dword [sym.imp.USER32.dll_GetKeyState]
and eax, 0xffff8000
test ax, ax
je 0x10b96072
mov eax, dword [esp + 0x28]
add eax, 0xffffffdf
cmp eax, 7
ja case.0x10b9608e.18
jmp dword [eax*4 + 0x10b96204]
push 0
push 0
push 0
mov ecx, esi
call fcn.10b96860
mov ebp, 1
jmp case.0x10b9608e.18
push 0
push 1
push 0
mov ecx, esi
call fcn.10b96860
mov ebp, 1
jmp case.0x10b9608e.18
push 0
push 2
push 0
mov ecx, esi
call fcn.10b96860
mov ebp, 1
jmp case.0x10b9608e.18
push 0
push 3
push 0
mov ecx, esi
call fcn.10b96860
mov ebp, 1
jmp case.0x10b9608e.18
push 0
push 0
push 0
mov ecx, esi
call fcn.10b95dc0
mov ebp, 1
jmp case.0x10b9608e.18
push 0
push 1
push 0
mov ecx, esi
call fcn.10b95dc0
mov ebp, 1
jmp case.0x10b9608e.18
push 0
push 6
push 0
mov ecx, esi
call fcn.10b96860
mov ebp, 1
jmp case.0x10b9608e.18
push 0
push 7
push 0
mov ecx, esi
call fcn.10b96860
mov ebp, 1
jmp case.0x10b9608e.18
mov ecx, dword [esp + 0x28]
lea eax, [ecx - 8]
mov ecx, 0x20
cmp eax, ecx
ja case.0x10b9608e.18
xor edx, edx
mov dl, byte [eax + 0x10b96250]
jmp dword [edx*4 + 0x10b96224]
push 0xfffffffffffffffc
mov ecx, esi
call fcn.10b93af0
jmp case.0x10b9608e.18
mov eax, dword [esi + 0x74]
push 7
push eax
mov ecx, esi
call fcn.10b94b90
mov edi, eax
jmp case.0x10b9608e.18
mov ecx, dword [esi + 0x74]
push 6
push ecx
mov ecx, esi
call fcn.10b94b90
mov edi, eax
jmp case.0x10b9608e.18
mov eax, dword [esi + 0x74]
test eax, eax
je case.0x10b9608e.18
test byte [eax + 8], cl
je 0x10b960ed
push 1
push eax
mov ecx, esi
call fcn.10b946e0
test eax, eax
jne case.0x10b9608e.18
mov eax, dword [esi + 0x74]
mov edi, dword [eax + 0x28]
test edi, edi
jne 0x10b961bd
push 7
push eax
mov ecx, esi
call fcn.10b94b90
mov edi, eax
jmp case.0x10b9608e.18
mov eax, dword [esi + 0x74]
test eax, eax
je case.0x10b9608e.18
test byte [eax + 8], cl
jne 0x10b9612e
push 2
push eax
mov ecx, esi
call fcn.10b946e0
test eax, eax
jne case.0x10b9608e.18
mov edx, dword [esi + 0x74]
push 6
push edx
mov ecx, esi
call fcn.10b94b90
mov edi, eax
jmp case.0x10b9608e.18
mov edi, dword [esi + 0x68]
jmp case.0x10b9608e.18
mov eax, dword [esi + 0x74]
push 0x69
push eax
mov ecx, esi
call fcn.10b94b90
mov edi, eax
jmp case.0x10b9608e.18
mov ecx, dword [esi + 0x74]
mov edi, dword [ecx + 0x28]
jmp case.0x10b9608e.18
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0x84]
sub eax, ecx
mov edi, dword [esi + 0x74]
cdq
idiv dword [esi + 0x64]
mov ebx, eax
dec ebx
je case.0x10b9608e.18
push 7
push edi
mov ecx, esi
call fcn.10b94b90
test eax, eax
je case.0x10b9608e.18
dec ebx
mov edi, eax
jne 0x10b96177
jmp case.0x10b9608e.18
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0x84]
sub eax, ecx
mov edi, dword [esi + 0x74]
cdq
idiv dword [esi + 0x64]
mov ebx, eax
dec ebx
je case.0x10b9608e.18
push 6
push edi
mov ecx, esi
call fcn.10b94b90
test eax, eax
je case.0x10b9608e.18
dec ebx
mov edi, eax
jne 0x10b961a6
test edi, edi
je 0x10b961d5
cmp edi, dword [esi + 0x74]
je 0x10b961d5
push 1
push 2
push 9
push edi
mov ecx, esi
call fcn.10b952a0
mov ebp, 1
mov dx, word [esp + 0x28]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push 0xfffffe64
push ecx
mov ecx, esi
mov word [esp + 0x24], dx
mov dword [esp + 0x26], eax
call fcn.10b93ab0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 8