Function at 0x520b3c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x520b44
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x5210c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 1
lea eax, [ebp - 0x18]
mov edx, 0x5210e4
call fcn.00404820
cmp dword [0x536474], 3
jne 0x520b86
lea eax, [ebp - 0x18]
mov edx, 0x521100
call fcn.00404820
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], 1
mov ebx, 0xa
mov eax, dword [ebp - 0x18]
call fcn.00404c58
push eax
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x1c], eax
cmp dword [0x536474], 2
jne 0x520bdd
cmp dword [ebp - 0x1c], 0
jne 0x520bdd
push 0x521110
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x520bdd
lea eax, [ebp - 0x18]
mov edx, 0x521124
call fcn.00404820
cmp dword [ebp - 0x1c], 0
jne 0x520bf0
mov eax, 0x3e8
call fcn.005151d0
dec ebx
jne 0x520b99
cmp dword [ebp - 0x1c], 0
jne 0x520c82
cmp dword [ebp - 8], 3
jge 0x520c75
mov eax, 0x521138
call fcn.0051b014
push 0
push 0
push 0x7e8
mov eax, dword [0x536524]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x64
call fcn.005151d0
mov eax, dword [0x5364b0]
push eax
mov eax, dword [0x5364ac]
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0
push 0
push 2
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 4
call sub.user32.dll_mouse_event
push 0
push 0
push 0x7e9
mov eax, dword [0x536524]
push eax
call sub.user32.dll_SendMessageA
mov eax, 0x64
call fcn.005151d0
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jne 0x520b94
mov eax, dword [ebp - 0x18]
mov edx, 0x521124
call fcn.00404ba4
jne 0x520ca0
mov eax, 0x521164
call fcn.0051b014
jmp 0x521084
mov eax, dword [ebp - 0x18]
call fcn.00404c58
push eax
push 0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x24]
call fcn.004654e0
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x521194
call fcn.00404aa4
mov eax, dword [ebp - 0x20]
call fcn.0051b014
cmp dword [ebp - 0x1c], 0
je 0x521084
cmp dword [ebp - 0xc], 1
jne 0x520e92
mov eax, 0x3e8
call fcn.005151d0
push 0
push 0
push 0
push 0x20
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x20
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x20
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x20
call sub.user32.dll_keybd_event
mov eax, 0xa
call fcn.005151d0
lea eax, [ebp - 0x10]
mov edx, dword [0x53653c]
call fcn.00404820
mov eax, dword [ebp - 0x18]
call fcn.0051b014
mov eax, dword [ebp - 0x10]
call fcn.0051b014
mov dword [ebp - 8], 0x14
xor eax, eax
push ebp
push 0x520d9c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x10]
call fcn.004050e8
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
call fcn.004050e8
mov eax, dword [ebp - 0x2c]
mov ecx, 0x5211ac
xor edx, edx
call fcn.00516f28
mov eax, 0xa
call fcn.005151d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x520da6
lea eax, [ebp - 0x14]
call fcn.00404788
xor eax, eax
push ebp
push 0x520de4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x18]
call fcn.004050e8
mov eax, dword [ebp - 0x30]
mov ecx, 0x5211ac
xor edx, edx
call fcn.00516f94
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x520dee
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00404ba4
jne 0x520e1c
mov dword [ebp - 4], 1
lea eax, [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov edx, 0x5211c0
call fcn.00404aa4
mov eax, dword [ebp - 0x34]
call fcn.0051b014
jmp 0x520e2f
mov eax, 0x3e8
call fcn.005151d0
dec dword [ebp - 8]
jne 0x520d51
push 0
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [0x536520]
call fcn.0051cbf0
mov edx, dword [0x53651c]
mov eax, dword [ebp - 0x10]
call fcn.00404da0
test eax, eax
jle 0x520e92
push 0x5211d4
push 2
push 0
push 0
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x18]
call fcn.004050e8
mov eax, dword [ebp - 0x38]
mov ecx, 0x5211e4
xor edx, edx
call fcn.00517000
mov eax, 0x7d0
call fcn.005151d0
mov dword [ebp - 4], 1
jmp 0x521084
cmp dword [ebp - 0xc], 1
je 0x521077
push 0
push 0xf030
push 0x112
mov eax, dword [ebp - 0x1c]
push eax
call sub.user32.dll_PostMessageA
mov eax, 0x3e8
call fcn.005151d0
push 0
push 0
push 0
push 0x20
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x20
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x20
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x20
call sub.user32.dll_keybd_event
mov eax, 0xa
call fcn.005151d0
lea eax, [ebp - 0x10]
mov edx, dword [0x53653c]
call fcn.00404820
mov eax, dword [ebp - 0x10]
call fcn.0051b014
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.0051b618
test al, al
jne 0x520ff2
mov eax, 0x5211fc
call fcn.0051b014
mov eax, 0x521208
call fcn.0051b014
mov eax, dword [0x53364c]
mov eax, dword [eax]
call fcn.004bb3fc
sub eax, 0x3f
push eax
mov eax, dword [0x53364c]
mov eax, dword [eax]
call fcn.004bb428
sub eax, 0x1f4
push eax
call sub.user32.dll_SetCursorPos
push 0
push 0
push 0
push 0
push 2
call sub.user32.dll_mouse_event
push 0
push 0
push 0
push 0
push 4
call sub.user32.dll_mouse_event
mov eax, 0xa
call fcn.005151d0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
call fcn.0051b618
test al, al
jne 0x520ff2
mov eax, 0x521224
call fcn.0051b014
push 0
push 0
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
push 0
push 0
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x56
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x56
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push 0x11
call sub.user32.dll_MapVirtualKeyA
push eax
push 0x11
call sub.user32.dll_keybd_event
mov eax, 0x32
call fcn.005151d0
mov eax, 0x521230
call fcn.0051b014
mov bl, 9
push 0
push 0
push 0
mov esi, ebx
and esi, 0xff
push esi
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push esi
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
mov eax, 0x64
call fcn.005151d0
mov bl, 0xd
push 0
push 0
push 0
mov esi, ebx
and esi, 0xff
push esi
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
push 0
push 2
push 0
push esi
call sub.user32.dll_MapVirtualKeyA
push eax
push ebx
call sub.user32.dll_keybd_event
mov eax, 0x7d0
call fcn.005151d0
mov dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jne 0x520b63
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5210d0
lea eax, [ebp - 0x38]
call fcn.00404f44
lea eax, [ebp - 0x34]
call fcn.00404788
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404f5c
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004047ac
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004047ac
ret