Function at 0x5cd8c31a
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
push edi
mov edi, ecx
mov dword [0x5cd9476c], esi
mov dword [0x5cd94768], esi
mov edx, esi
mov dword [0x5cd9475c], esi
mov dword [0x5cd94758], esi
mov dword [ebp - 4], edx
test edi, edi
je 0x5cd8c359
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5cd8c34c
sub ecx, edx
mov edx, esi
jmp 0x5cd8c35b
mov ecx, esi
lea eax, [ecx + edi]
mov dword [ebp - 0x18], eax
cmp edi, eax
jae 0x5cd8c704
push ebx
mov bl, byte [edi]
xor eax, eax
inc eax
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xc], eax
inc edi
movsx eax, bl
mov dword [ebp - 8], edi
cmp eax, 0x5e
jg 0x5cd8c48c
je 0x5cd8c464
sub eax, 0x25
je 0x5cd8c42f
sub eax, 3
je 0x5cd8c3ec
sub eax, 1
je 0x5cd8c3d0
dec eax
sub eax, 1
jne 0x5cd8c574
cmp dword [0x5cd94758], esi
jne 0x5cd8c6fe
push 0x10
pop edx
mov ecx, pe_nt_image_headers32
call fcn.5cd8bb14
mov dword [0x5cd94758], 0xa
jmp 0x5cd8c6ee
test edx, edx
jle 0x5cd8c6fe
push edx
push ecx
push ecx
call fcn.5cd8c151
mov edx, dword [ebp - 4]
dec edx
mov dword [ebp - 4], edx
jmp 0x5cd8c6f1
inc edx
mov dword [ebp - 4], edx
cmp edx, 3
jg 0x5cd8c6fe
cmp dword [0x5cd94758], 0xa
jne 0x5cd8c408
mov dword [0x5cd94758], edx
cmp dword [0x5cd9475c], 0xa
jne 0x5cd8c417
mov dword [0x5cd9475c], edx
cmp dword [0x5cd94768], 0xa
jne 0x5cd8c6f1
mov dword [0x5cd94768], edx
jmp 0x5cd8c6f1
cmp dword [0x5cd94768], esi
jne 0x5cd8c6fe
xor ecx, ecx
cmp dword [0x5cd9475c], ecx
push 0x12
sete cl
pop edx
lea ecx, [ecx*4 + 0x100]
call fcn.5cd8bb14
mov dword [0x5cd94768], 0xa
jmp 0x5cd8c6ee
cmp dword [0x5cd9475c], esi
jne 0x5cd8c6fe
push 0x11
pop edx
mov ecx, pe_nt_image_headers32
call fcn.5cd8bb14
mov dword [0x5cd9475c], 0xa
jmp 0x5cd8c6ee
sub eax, 0x7b
je 0x5cd8c4ac
dec eax
sub eax, 1
je 0x5cd8c6fe
sub eax, 1
jne 0x5cd8c574
push 0xd
pop edi
jmp 0x5cd8c682
push dword [ebp - 0x18]
mov dl, 0x7d
mov ecx, edi
call fcn.5cd8c713
mov dword [ebp - 0x14], eax
test eax, eax
je 0x5cd8c6fe
lea ecx, [edi + 1]
add dl, 0xa3
push eax
mov dword [ebp - 0x20], ecx
call fcn.5cd8c713
mov edi, eax
test edi, edi
jne 0x5cd8c4df
mov ebx, dword [ebp - 0x14]
mov eax, ebx
jmp 0x5cd8c55d
mov al, byte [edi]
mov dword [ebp - 0x1c], edi
test al, al
je 0x5cd8c51a
mov bl, al
movsx eax, al
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.msvcrt.dll__ismbcspace]
pop ecx
test eax, eax
je 0x5cd8c503
inc edi
mov al, byte [edi]
test al, al
jne 0x5cd8c4e8
cmp byte [edi], 0
je 0x5cd8c51a
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll__ismbcdigit]
pop ecx
test eax, eax
je 0x5cd8c6fe
cmp byte [edi], 0
mov dword [ebp - 0xc], esi
je 0x5cd8c54f
movsx ebx, bl
push ebx
call dword [sym.imp.msvcrt.dll__ismbcdigit]
pop ecx
test eax, eax
je 0x5cd8c54f
imul eax, dword [ebp - 0xc], 0xa
add eax, 0xffffffd0
add eax, ebx
inc edi
mov dword [ebp - 0xc], eax
mov bl, byte [edi]
cmp eax, 0x1ff0
jge 0x5cd8c6fe
test bl, bl
jne 0x5cd8c522
mov ebx, dword [ebp - 0x14]
cmp edi, ebx
jne 0x5cd8c6fe
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x5cd8c666
mov al, byte [ecx]
lea ecx, [ebx + 1]
mov byte [ebp - 0x10], al
mov dword [ebp - 8], ecx
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_VkKeyScanA]
movsx ebx, ax
cmp ebx, 0xffffffff
je 0x5cd8c63f
movzx edi, bl
cmp dword [0x5cd94758], esi
jne 0x5cd8c5b3
test ebx, 0x100
je 0x5cd8c5b3
push 0x10
pop edx
mov ecx, pe_nt_image_headers32
call fcn.5cd8bb14
mov dword [0x5cd94758], 0xa
cmp dword [0x5cd9475c], esi
jne 0x5cd8c5da
test ebx, 0x200
je 0x5cd8c5da
push 0x11
pop edx
mov ecx, pe_nt_image_headers32
call fcn.5cd8bb14
mov dword [0x5cd9475c], 0xa
cmp dword [0x5cd94768], esi
jne 0x5cd8c601
test ebx, 0x400
je 0x5cd8c601
push 0x12
pop edx
mov ecx, pe_nt_image_headers32
call fcn.5cd8bb14
mov dword [0x5cd94768], 0xa
cmp dword [0x5cd94764], esi
je 0x5cd8c682
cmp dword [0x5cd9476c], esi
jne 0x5cd8c682
test ebx, 0x800
je 0x5cd8c682
push 0x15
pop edx
mov ecx, pe_nt_image_headers32
call fcn.5cd8bb14
push 0x15
pop edx
mov ecx, 0x101
call fcn.5cd8bb14
mov dword [0x5cd9476c], 0xa
jmp 0x5cd8c682
mov ebx, dword [ebp - 0xc]
sub ebx, 1
js 0x5cd8c6e2
mov al, byte [ebp - 0x10]
cbw
movzx edi, ax
mov edx, edi
mov ecx, 0x102
call fcn.5cd8bb14
sub ebx, 1
jns 0x5cd8c653
jmp 0x5cd8c6e2
mov edx, eax
call fcn.5cd8c81a
mov edi, eax
cmp edi, 0xffffffff
je 0x5cd8c6fe
lea ecx, [ebx + 1]
mov dword [ebp - 8], ecx
test edi, edi
je 0x5cd8c6eb
mov ebx, dword [ebp - 0xc]
sub ebx, 1
js 0x5cd8c6e2
movzx edi, di
cmp dword [0x5cd94768], esi
je 0x5cd8c6a9
xor ecx, ecx
cmp dword [0x5cd9475c], ecx
sete cl
lea ecx, [ecx*4 + 0x100]
jmp 0x5cd8c6ae
mov ecx, pe_nt_image_headers32
mov edx, edi
call fcn.5cd8bb14
cmp dword [0x5cd94768], esi
je 0x5cd8c6d1
xor ecx, ecx
cmp dword [0x5cd9475c], ecx
sete cl
lea ecx, [ecx*4 + 0x101]
jmp 0x5cd8c6d6
mov ecx, 0x101
mov edx, edi
call fcn.5cd8bb14
sub ebx, 1
jns 0x5cd8c68d
push 0xa
push ecx
push ecx
call fcn.5cd8c151
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edi, dword [ebp - 0x18]
jb 0x5cd8c36a
test edx, edx
je 0x5cd8c703
mov esi, 0x80070057
pop ebx
push 0xffffffffffffffff
push ecx
push ecx
call fcn.5cd8c151
pop edi
mov eax, esi
pop esi
leave
ret