Function at 0x4666b1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, 0x571c4c
call sub.USER32.dll_GetFocus
mov edi, eax
mov dword [0x571c50], edi
test edi, edi
jne 0x4666de
push 0
call fcn.0041c2be
xor eax, eax
jmp 0x466b5a
push 0x14
push 0x571c64
push dword [0x571c50]
call sub.USER32.dll_GetClassNameA
push 0x571c64
call fcn.0041de6c
test eax, eax
jne 0x46670c
push 0
call fcn.0041c2be
xor eax, eax
jmp 0x466b5a
push 0xfffffffffffffff0
push dword [0x571c50]
call sub.USER32.dll_GetWindowLongA
mov edi, eax
mov dword [0x571c78], edi
test edi, 0x800
je 0x466730
xor eax, eax
jmp 0x466b5a
push dword [0x571c50]
call sub.USER32.dll_GetParent
mov edi, eax
mov dword [0x571c54], edi
push edi
call fcn.00516145
test eax, eax
je 0x46675c
mov dword [0x571c60], 1
jmp 0x46682f
mov eax, dword [0x571c54]
cmp eax, dword [0x5595ec]
je 0x4667ae
mov edi, dword [0x571c54]
cmp edi, dword [0x54c370]
je 0x4667ae
push edi
call sub.USER32.dll_GetParent
cmp eax, dword [0x54c370]
je 0x4667ae
mov eax, dword [0x571c54]
cmp eax, dword [0x54fbe8]
je 0x4667ae
mov edx, dword [0x571c54]
cmp edx, dword [0x551344]
je 0x4667ae
mov ecx, dword [0x571c54]
cmp ecx, dword [0x55135c]
jne 0x4667ba
mov dword [0x571c60], 2
jmp 0x46682f
cmp dword [0x551344], 0
je 0x4667e2
push dword [0x571c54]
call sub.USER32.dll_GetParent
cmp eax, dword [0x551344]
jne 0x4667e2
mov dword [0x571c60], 2
jmp 0x46682f
mov eax, dword [0x54eaf4]
mov dword [esi], eax
jmp 0x466814
mov edx, dword [esi]
mov edi, dword [edx + 0xc8]
cmp edi, dword [0x571c54]
je 0x466819
push dword [0x571c54]
call sub.USER32.dll_GetParent
cmp edi, eax
je 0x466819
mov eax, dword [esi]
mov edx, dword [eax + 0x1004]
mov dword [esi], edx
cmp dword [esi], 0
jne 0x4667eb
cmp dword [esi], 0
jne 0x466825
xor eax, eax
jmp 0x466b5a
mov dword [0x571c60], 2
cmp bl, 3
jne 0x46684e
cmp dword [0x54d28c], 0
je 0x46684e
push dword [0x571c60]
push dword [0x571c50]
call fcn.004311e1
push 0
push 0
push 0xb0
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
mov esi, eax
mov dword [0x571c78], esi
movzx edx, word [0x571c78]
mov dword [0x571c58], edx
mov eax, esi
shr eax, 0x10
and ax, 0xffff
movzx eax, ax
mov dword [0x571c5c], eax
cmp edx, eax
jne 0x46698e
cmp bl, 3
jne 0x4668d4
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4668bb
xor eax, eax
mov al, bl
push eax
push eax
push 0x55019c
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x466911
xor edx, edx
mov dl, bl
push edx
push 0x5501a2
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0xc
jmp 0x466911
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x4668fa
xor eax, eax
mov al, bl
push eax
push eax
push str._c_c
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x466911
xor edx, edx
mov dl, bl
push edx
push 0x5501ac
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x571c58]
push eax
push eax
push 0xb1
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0x571c64
push 0
push 0xc2
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
inc dword [0x571c58]
mov eax, dword [0x571c58]
push eax
push eax
push 0xb1
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x466b5a
cmp bl, 3
jne 0x466a8d
mov esi, ebx
and esi, 0xff
push esi
push 0x5501b0
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x571c5c]
push eax
push eax
push 0xb1
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0x571c64
push 0
push 0xc2
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push esi
push 0x5501b4
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x571c58]
push eax
push eax
push 0xb1
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0x571c64
push 0
push 0xc2
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0x571c64
call fcn.005395b8
pop ecx
mov ebx, eax
add ebx, dword [0x571c58]
mov dword [0x571c58], ebx
push ebx
push ebx
push 0xb1
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
jmp 0x466b55
mov esi, ebx
and esi, 0xff
push esi
push 0x5501b8
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x571c58]
push eax
push eax
push 0xb1
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0x571c64
push 0
push 0xc2
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0x571c64
call fcn.005395b8
pop ecx
add eax, dword [0x571c5c]
mov dword [0x571c5c], eax
push esi
push 0x5501bc
push 0x571c64
call sub.USER32.dll_wsprintfA
add esp, 0xc
mov eax, dword [0x571c5c]
push eax
push eax
push 0xb1
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0
push 0
push 0xb7
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
push 0x571c64
push 0
push 0xc2
push dword [0x571c50]
call sub.USER32.dll_SendMessageA
mov eax, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4