Function at 0x5b59ed
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x626361
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push ebp
push esi
mov esi, ecx
test esi, esi
push edi
je 0x5b6616
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x5b6616
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push eax
call ebp
test eax, eax
je 0x5b6616
mov ebx, dword [esp + 0x160]
cmp dword [ebx + 4], 0x13
jne 0x5b5a3c
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x5b6616
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x26c]
jmp 0x5b6616
mov ecx, esi
call fcn.005b7650
mov edi, eax
test edi, edi
mov dword [esp + 0x1c], edi
je 0x5b6616
push edi
call ebp
test eax, eax
je 0x5b6616
push edi
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x5b6616
mov eax, dword [ebx + 4]
cmp eax, 6
je 0x5b660f
cmp eax, 0x1c
je 0x5b660f
cmp eax, 7
je 0x5b660f
cmp eax, 8
je 0x5b660f
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x194]
mov bl, al
mov eax, dword [esi]
mov ecx, esi
mov byte [esp + 0x11], bl
call dword [eax + 0x248]
test al, al
je 0x5b5b49
mov eax, dword [esp + 0x160]
mov ecx, dword [eax + 4]
cmp ecx, 0x111
jne 0x5b5afa
mov ax, word [eax + 8]
cmp ax, 0xe150
je 0x5b5b32
cmp ax, 0xe151
je 0x5b5b32
cmp ax, 0xe130
je 0x5b5b32
cmp ax, 0xe131
je 0x5b5b32
cmp ax, 0xe132
je 0x5b5b32
cmp ax, 0xe133
je 0x5b5b32
cmp ax, 0xe134
je 0x5b5b32
cmp ax, 0xe135
je 0x5b5b32
cmp ecx, 0x222
je 0x5b5b32
cmp ecx, 0x224
je 0x5b5b32
cmp ecx, 0x223
je 0x5b5b32
cmp ecx, 0x225
je 0x5b5b32
cmp ecx, 0x226
je 0x5b5b32
cmp ecx, 0x227
je 0x5b5b32
cmp ecx, 0x228
jne 0x5b5b49
test bl, bl
jne 0x5b65d8
mov ecx, esi
call fcn.00578130
test al, al
jne 0x5b65d8
mov al, byte [esi + 0x7c]
mov byte [esp + 0x13], 0
test al, 4
jne 0x5b5b79
test bl, bl
jne 0x5b5b79
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x5b5b79
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x5b5b79
push eax
call fcn.005813d0
add esp, 4
test al, al
je 0x5b5b79
mov byte [esp + 0x13], 1
mov byte [esp + 0x12], 0
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call fcn.005d9ca3
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
test edi, edi
je 0x5b5c0f
push 0x636060
mov ecx, edi
call fcn.005dda74
test eax, eax
je 0x5b5bc6
mov ecx, edi
call fcn.005dcc64
test al, 3
je 0x5b5c0f
mov ecx, dword [edi + 0x1c]
push 0
push 0
push 0x157
push ecx
call ebp
test eax, eax
je 0x5b5c0f
jmp 0x5b5c0a
mov edx, dword [edi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.005d9ca3
mov edi, eax
test edi, edi
je 0x5b5c0f
push 0x636060
mov ecx, edi
call fcn.005dda74
test eax, eax
je 0x5b5c0f
mov ecx, edi
call fcn.005dcc64
test al, 3
je 0x5b5c0f
mov eax, dword [edi + 0x1c]
push 0
push 0
push 0x157
push eax
call ebp
test eax, eax
je 0x5b5c0f
mov byte [esp + 0x12], 1
mov ecx, dword [esp + 0x160]
mov eax, dword [ecx + 4]
cmp eax, 0x111
mov dword [esp + 0x18], eax
jne 0x5b5c99
mov ecx, dword [ecx + 8]
shr ecx, 0x10
jne 0x5b5c3e
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [0x6c6ec1], al
mov al, byte [esi + 0x1a0]
test al, 1
je 0x5b6616
mov cl, byte [esp + 0x11]
test cl, cl
jne 0x5b6616
mov ecx, dword [esp + 0x18]
cmp ecx, 0x200
jb 0x5b6616
cmp ecx, 0x209
ja 0x5b6616
cmp ecx, 0x200
je 0x5b6616
and al, 0xfe
push 1
mov byte [esi + 0x1a0], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x244]
jmp 0x5b6616
cmp eax, 0x104
je 0x5b5cbb
cmp eax, 0x105
je 0x5b5cbb
cmp eax, 0x100
je 0x5b5cbb
cmp eax, 0x101
jne 0x5b65df
jmp 0x5b5cd1
cmp eax, 0x101
je 0x5b5cd1
cmp eax, 0x105
mov dword [esp + 0x14], 0
jne 0x5b5cd9
mov dword [esp + 0x14], 1
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
movsx ebp, ax
push 0x10
and ebp, 0x80000000
call edi
mov ecx, dword [esp + 0x160]
movsx eax, ax
mov edi, dword [ecx + 0xc]
mov bl, byte [ecx + 8]
shr edi, 0x10
and eax, 0x80000000
and edi, 0x2000
cmp bl, 0x12
jne 0x5b5e6e
test ebp, ebp
jne 0x5b5e6e
test eax, eax
jne 0x5b5e6e
mov al, byte [esp + 0x11]
test al, al
jne 0x5b65d8
mov al, byte [esp + 0x13]
test al, al
jne 0x5b6616
mov al, byte [esp + 0x12]
test al, al
jne 0x5b6616
mov al, byte [esi + 0x1a0]
test al, 1
je 0x5b5d6e
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x5b65d8
and al, 0xfe
mov byte [esi + 0x1a0], al
jmp case.0x5b648e.17
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x5b5d82
mov byte [0x6c6ec1], 0
jmp 0x5b6616
mov al, byte [0x6c6ec1]
test al, al
jne 0x5b6616
mov al, byte [0x6c6ea8]
test al, al
jne 0x5b5e64
mov ecx, esi
call fcn.005ab9c0
test eax, eax
je 0x5b5e57
call fcn.00559b10
test eax, eax
jne 0x5b5dcb
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x5b5dcb
push 0
push 0
push 0x1f
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esp + 0x1c]
mov byte [0x6c6ea9], 0
push ebx
call fcn.005d9ca3
push eax
call fcn.00582e10
add esp, 4
mov ebp, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
cmp ebx, edi
je 0x5b5e3b
cmp ebx, dword [ebp + 0x1c]
je 0x5b5e3b
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x5b5e14
push ebx
push edi
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x5b5e3b
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
call edi
test eax, eax
je 0x5b5e31
cmp eax, ebx
je 0x5b5e3b
cmp eax, dword [ebp + 0x1c]
je 0x5b5e3b
push eax
call edi
test eax, eax
jne 0x5b5e21
mov eax, 1
jmp 0x5b6618
mov eax, dword [esi]
push 0
push 0
push 0
push 0
mov ecx, esi
call dword [eax + 0x208]
mov eax, 1
jmp 0x5b6618
mov al, byte [0x6c6ec1]
test al, al
jne 0x5b6616
mov eax, 1
jmp 0x5b6618
test byte [esi + 0x7c], 4
jne 0x5b602f
test edi, edi
je 0x5b602f
cmp bl, 0x20
je 0x5b5ea5
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x248]
test al, al
je 0x5b602f
cmp bl, 0x6d
je 0x5b5ea5
cmp bl, 0xbd
jne 0x5b602f
mov al, byte [esp + 0x11]
test al, al
je 0x5b5eb7
mov eax, 1
jmp 0x5b6618
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5b5ec9
mov eax, 1
jmp 0x5b6618
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.005d9ca3
mov edi, eax
test edi, edi
je 0x5b5e64
mov eax, dword [edi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x5b5e64
mov ebp, dword [edi + 0x1c]
mov ecx, esi
call fcn.00599c70
test eax, eax
je 0x5b5efe
mov eax, dword [eax + 0x1c]
cmp ebp, eax
je 0x5b5f1a
mov ecx, edi
call fcn.005dcc64
test eax, 0x80000000
je 0x5b5f1a
mov eax, 1
jmp 0x5b6618
mov byte [0x6c6ea9], 0
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x194]
test al, al
jne 0x5b5e64
mov al, byte [esi + 0x1a0]
test al, 1
je 0x5b5f51
and al, 0xfe
push 1
mov byte [esi + 0x1a0], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x244]
cmp bl, 0x20
jne 0x5b5f71
mov edx, dword [esi]
push 1
push 0
mov ecx, esi
call dword [edx + 0x27c]
test eax, eax
jne 0x5b5e64
jmp 0x5b6616
mov eax, dword [esp + 0x18]
cmp eax, 0x100
je 0x5b5e64
cmp eax, 0x101
je 0x5b5e64
mov eax, dword [esi]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
mov dword [esp + 0x20], 0
call dword [eax + 0x254]
test eax, eax
jne 0x5b5fb7
mov byte [0x6c6ec1], 1
mov eax, 1
jmp 0x5b6618
mov ecx, esi
call fcn.005ab9c0
test eax, eax
jle 0x5b6014
push 0
mov ecx, esi
call fcn.005ab8f0
push 0x65ac20
mov ecx, eax
call fcn.005dda74
test eax, eax
je 0x5b6014
call fcn.00559b10
test eax, eax
jne 0x5b5ffb
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x5b5ffb
push 0
push 0
push 0x1f
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0
push 0
mov ecx, esi
call fcn.005aca00
mov eax, 1
jmp 0x5b6618
mov edx, dword [esi]
push 1
push 0
mov ecx, esi
call dword [edx + 0x280]
test eax, eax
jne 0x5b5e64
jmp 0x5b6616
mov al, byte [esp + 0x13]
test al, al
jne 0x5b603f
mov al, byte [esp + 0x12]
test al, al
je 0x5b604c
mov cl, byte [esp + 0x11]
test cl, cl
jne 0x5b6050
jmp 0x5b6616
mov cl, byte [esp + 0x11]
test edi, edi
jne 0x5b6097
test byte [esi + 0x1a0], 1
je 0x5b644f
cmp bl, 0x25
je 0x5b644f
cmp bl, 0x27
je 0x5b644f
cmp bl, 0x26
je 0x5b644f
cmp bl, 0x28
je 0x5b644f
cmp bl, 0xd
je 0x5b644f
cmp bl, 0x1b
je 0x5b644f
test cl, cl
jne 0x5b644f
mov eax, dword [esp + 0x14]
test eax, eax
je 0x5b60b1
mov eax, 1
jmp 0x5b6618
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
movsx edi, bl
push 0
push edi
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebp, eax
call fcn.005ddc59
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
lea edx, [esp + 0x1c]
push 1
lea eax, [esp + 0x58]
push edx
push eax
push ebp
push edi
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov cl, byte [esp + 0x18]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x18], cl
mov byte [esp + 0x19], 0
call dword [sym.imp.USER32.dll_CharUpperA]
mov al, byte [esp + 0x14]
test al, al
je 0x5b6438
mov eax, dword [esp + 0x14]
mov ecx, esi
push eax
call fcn.005ac650
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
jge 0x5b638d
push 0xa
lea ecx, [esp + 0x38]
call fcn.005d7b1d
mov eax, dword [esi + 0x6c]
mov dword [esp + 0x158], ebx
cmp eax, ebx
jne 0x5b6173
mov ecx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push ecx
call edi
push eax
call fcn.005d9ca3
push eax
push 0x638f30
call fcn.005dda86
add esp, 8
cmp eax, ebx
je 0x5b6215
mov ebp, vtable.CArray_class_CExtControlBar___class_CExtControlBar__.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebp
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov eax, 0xfffffc18
lea edx, [esp + 0x20]
mov ecx, eax
mov byte [esp + 0x158], 1
push ecx
push eax
push 0x5ff
push edx
push ebx
mov ecx, esi
call fcn.00571c30
mov eax, dword [esp + 0x28]
xor edi, edi
cmp eax, ebx
jle 0x5b61ee
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + edi*4]
push ecx
push 0x659ee0
call fcn.005dda86
add esp, 8
cmp eax, ebx
je 0x5b61e5
cmp dword [eax + 0x1c], ebx
je 0x5b61e5
cmp eax, esi
je 0x5b61e5
push eax
lea ecx, [esp + 0x38]
call fcn.005d825f
mov eax, dword [esp + 0x28]
inc edi
cmp edi, eax
jl 0x5b61b9
mov dword [esp + 0x20], ebp
mov eax, dword [esp + 0x24]
mov byte [esp + 0x158], 2
cmp eax, ebx
je 0x5b620b
push eax
call fcn.005dd7a4
add esp, 4
mov byte [esp + 0x158], 0
jmp 0x5b6289
mov edx, dword [esi + 0x1c]
push edx
call edi
push eax
call fcn.005d9ca3
mov eax, dword [eax + 0x1c]
mov ebx, dword [sym.imp.USER32.dll_GetWindow]
push 5
push eax
call ebx
push eax
call fcn.005d9ca3
mov edi, eax
test edi, edi
je 0x5b6287
push edi
push 0x659ee0
call fcn.005dda86
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x5b6273
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x5b6273
cmp ebp, esi
je 0x5b6273
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0xc8]
test eax, eax
je 0x5b6273
push ebp
lea ecx, [esp + 0x38]
call fcn.005d825f
mov eax, dword [edi + 0x1c]
push 2
push eax
call ebx
push eax
call fcn.005d9ca3
mov edi, eax
test edi, edi
jne 0x5b623b
xor ebx, ebx
mov edi, dword [esp + 0x38]
cmp edi, ebx
je 0x5b62ae
mov ecx, dword [esp + 0x14]
mov eax, edi
mov edi, dword [edi]
push ecx
mov ebp, dword [eax + 8]
mov ecx, ebp
call fcn.005ac650
mov ebx, eax
test ebx, ebx
jge 0x5b62ce
test edi, edi
jne 0x5b6291
lea ecx, [esp + 0x34]
mov byte [0x6c6ec1], 1
mov dword [esp + 0x158], 0xffffffff
call fcn.005d7b7c
jmp 0x5b6616
push ebx
mov ecx, ebp
call fcn.005b1e70
mov edi, eax
call fcn.00559b10
test eax, eax
jne 0x5b62f8
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x5b62f8
push 0
push 0
push 0x1f
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, byte [esi + 0x1a0]
test al, 1
je 0x5b6316
mov edx, dword [esi]
and al, 0xfe
push 1
mov ecx, esi
mov byte [esi + 0x1a0], al
call dword [edx + 0x244]
mov eax, dword [edi]
push 0
mov ecx, edi
call dword [eax + 0xb8]
test al, al
je 0x5b634c
mov byte [0x6c6ea9], 0
mov al, byte [esi + 0x1bc]
mov edx, dword [ebp]
mov ecx, ebp
shr eax, 4
and eax, 1
push eax
push 0
push 1
push ebx
call dword [edx + 0x208]
jmp 0x5b636f
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
test eax, eax
setne cl
mov byte [0x6c6ec1], cl
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xe4]
lea ecx, [esp + 0x34]
mov dword [esp + 0x158], 0xffffffff
call fcn.005d7b7c
mov eax, 1
jmp 0x5b6618
push ebp
mov ecx, esi
call fcn.005b1e70
mov edi, eax
call fcn.00559b10
test eax, eax
jne 0x5b63b5
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, ebx
je 0x5b63b5
push ebx
push ebx
push 0x1f
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, byte [esi + 0x1a0]
test al, 1
je 0x5b63d3
and al, 0xfe
push 1
mov byte [esi + 0x1a0], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x244]
mov edx, dword [edi]
push ebx
mov ecx, edi
call dword [edx + 0xb8]
test al, al
je 0x5b640b
mov byte [0x6c6ea9], 0
mov al, byte [esi + 0x1bc]
shr eax, 4
and eax, 1
mov ecx, esi
push eax
push ebx
push 1
push ebp
call fcn.005aca00
mov eax, 1
jmp 0x5b6618
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and eax, 1
cmp eax, ebx
setne cl
mov byte [0x6c6ec1], cl
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0xe4]
mov eax, 1
jmp 0x5b6618
xor eax, eax
mov byte [0x6c6ec1], 1
mov al, byte [esi + 0x1a0]
and eax, 1
jmp 0x5b6618
mov al, byte [esi + 0x1a0]
test al, 1
je 0x5b65df
test cl, cl
jne 0x5b65df
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x5b6477
mov eax, 1
jmp 0x5b6618
movsx ecx, bl
add ecx, 0xfffffff3
cmp ecx, 0x1b
ja case.0x5b648e.17
xor edx, edx
mov dl, byte [ecx + 0x5b6648]
jmp dword [edx*4 + 0x5b6634]
mov eax, dword [esi + 0x1a4]
push 1
push 0
push eax
mov ecx, esi
call fcn.005ac8a0
mov ecx, esi
mov dword [esi + 0x1a4], eax
call fcn.005ab9c0
mov ecx, dword [esi + 0x1a4]
test ecx, ecx
jge 0x5b65be
dec eax
mov dword [esi + 0x1a4], eax
jmp case.0x5b648e.17
mov ecx, dword [esi + 0x1a4]
push 1
push 1
push ecx
jmp 0x5b64a0
call fcn.00559b10
test eax, eax
jne 0x5b5e64
mov eax, dword [esi + 0x1a4]
test eax, eax
jl 0x5b5e64
push eax
mov ecx, esi
call fcn.005ab8f0
mov edi, eax
push 0
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0xb8]
test al, al
je 0x5b6574
call fcn.00559b10
test eax, eax
jne 0x5b6530
call dword [sym.imp.USER32.dll_GetFocus]
test eax, eax
je 0x5b6530
push 0
push 0
push 0x1f
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dl, byte [esi + 0x1a0]
mov eax, dword [esi]
mov edi, dword [esi + 0x1a4]
and dl, 0xfe
push 0
mov ecx, esi
mov byte [esi + 0x1a0], dl
call dword [eax + 0x244]
mov cl, byte [esi + 0x1bc]
shr ecx, 4
and ecx, 1
push ecx
push 0
push 1
push edi
mov ecx, esi
call fcn.005aca00
mov eax, 1
jmp 0x5b6618
cmp bl, 0xd
jne 0x5b659c
mov edx, dword [edi]
push 1
mov ecx, edi
call dword [edx + 0x1c]
test eax, eax
je 0x5b659c
cmp eax, 0xffffffff
jle 0x5b659c
mov edx, dword [edi]
xor ecx, ecx
xor eax, eax
push ecx
push ecx
push eax
mov ecx, edi
call dword [edx + 0xdc]
mov eax, 1
jmp 0x5b6618
and al, 0xfe
push 1
mov byte [esi + 0x1a0], al
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x244]
mov eax, 1
jmp 0x5b6618
cmp ecx, eax
jl case.0x5b648e.17
mov dword [esi + 0x1a4], 0
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x244]
mov eax, 1
jmp 0x5b6618
cmp dword [esp + 0x18], 0x7b
jne 0x5b5c3e
mov al, byte [0x6c6ea8]
test al, al
jne 0x5b6608
test byte [esi + 0x1a0], 1
jne 0x5b6608
mov al, byte [esp + 0x11]
test al, al
je 0x5b5c3e
mov eax, 1
jmp 0x5b6618
mov byte [0x6c6ec1], 1
xor eax, eax
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14c
ret 4