Function at 0x529630
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x59bd48]
sub esp, 0x34
test eax, eax
push ebp
push edi
mov edi, edx
mov ebp, ecx
je 0x5297ce
push ebx
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
push esi
mov esi, dword [0x5b430c]
movzx eax, bp
mov edx, ebp
shr edx, 0x10
test esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
je 0x5296d3
jmp 0x529670
lea ecx, [esi + 0xa2c]
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 0xc]
inc eax
add ecx, 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esi + 0xa3c]
test eax, eax
je 0x5296c5
mov ecx, dword [esp + 0x10]
push edx
push ecx
lea edx, [esp + 0x20]
push edx
call ebx
test eax, eax
je 0x5296c5
test edi, edi
je 0x529771
cmp edi, 1
je 0x529880
mov esi, dword [esi + 0xd9c]
test esi, esi
mov edx, dword [esp + 0x14]
jne 0x529670
test edi, edi
jne 0x529a05
mov edx, dword [0x59bd60]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x5b1880]
push 4
push edx
xor edx, edx
call fcn.00527600
test eax, eax
je 0x5297cc
mov eax, dword [0x5b4318]
mov ebp, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call ebp
mov ecx, dword [0x5b4314]
push ecx
call ebp
call fcn.00528e60
mov eax, dword [0x5b4314]
mov ecx, dword [0x5b1880]
push 1
lea edx, [esp + 0x14]
push edx
push eax
xor esi, esi
push ecx
mov dword [0x5b1890], esi
mov dword [0x5b1888], 1
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0x7f86
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp dword [0x5b26b8], esi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x5b26b4], eax
push eax
je 0x5298ec
call ebx
jmp 0x5298f3
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ah, ah
jns 0x529788
mov ecx, esi
call fcn.005294d0
jmp 0x5297b2
mov eax, dword [0x5b4320]
test eax, eax
push 0x10
je 0x529837
call edi
test ah, ah
jns 0x5297d4
mov eax, dword [esi]
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x5b26b8]
test eax, eax
je 0x5297cc
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x5b26b8], 0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
ret
push 0x11
call edi
test ah, ah
jns 0x529804
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x5297b2
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x5297b2
mov ecx, dword [esi]
mov edx, 1
call fcn.00497650
jmp 0x5297b2
mov eax, dword [esi]
cmp eax, dword [0x5b4320]
jne 0x529872
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x529872
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x529872
mov ecx, dword [esi]
mov edx, 1
call fcn.00497650
jmp 0x5297b2
call edi
test ah, ah
jns 0x529851
mov ecx, dword [esi]
push 0
push 0xf060
push 0x112
push ecx
jmp 0x5297ac
push 0x11
call edi
test ah, ah
jns 0x529872
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x5297b2
mov eax, dword [esi]
push eax
jmp 0x5297ec
mov ecx, dword [esi]
xor edx, edx
call fcn.004973e0
jmp 0x5297b2
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov edi, eax
test edi, edi
jne 0x52989d
xor ecx, ecx
call fcn.0041d520
jmp 0x5297b2
mov eax, dword [0x5b1880]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
mov dword [0x5b188c], 1
mov ecx, dword [esi]
push ecx
push 0
push edx
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
test eax, eax
jne 0x5298dd
xor ecx, ecx
call fcn.0041d520
mov dword [0x5b188c], 0
jmp 0x5297b2
call ebx
mov dword [0x5b26b8], eax
cmp dword [0x5b1888], esi
je 0x5299d9
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [0x5b4314]
cmp eax, ecx
jne 0x52999e
push 0x209
push 0x100
push ecx
lea ecx, [esp + 0x34]
push ecx
call edi
cmp eax, 1
jne 0x5299c4
mov eax, dword [esp + 0x2c]
cmp eax, 0x200
jne 0x529974
mov eax, dword [0x5b1890]
inc eax
cmp eax, 1
mov dword [0x5b1890], eax
jne 0x529967
movzx ecx, word [esp + 0x14]
movzx edx, word [esp + 0x10]
shl ecx, 0x10
or ecx, edx
xor edx, edx
call fcn.00527a80
jmp 0x5299c4
mov ecx, dword [esp + 0x34]
xor edx, edx
call fcn.00527a80
jmp 0x5299c4
cmp eax, 0x202
jne 0x529990
mov edx, dword [0x5b1890]
cmp edx, esi
jle 0x5299be
mov ecx, dword [esp + 0x34]
call fcn.00527a80
jmp 0x5299c4
cmp eax, 0x100
jb 0x5299c4
cmp eax, 0x108
ja 0x5299c4
mov edx, dword [0x5b1890]
cmp edx, esi
jle 0x5299be
movzx ecx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl ecx, 0x10
or ecx, eax
call fcn.00527a80
jmp 0x5299c4
mov dword [0x5b1888], esi
mov ecx, dword [0x5b26b4]
push ecx
call ebx
cmp dword [0x5b1888], esi
jne 0x529905
mov edx, dword [0x5b26b8]
push edx
call ebx
mov eax, dword [0x5b4318]
push eax
mov dword [0x5b26b8], esi
call ebp
mov ecx, dword [0x5b4314]
push ecx
call ebp
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
jmp fcn.00528e60
cmp edi, 1
jne 0x529a99
mov esi, dword [0x5b430c]
test esi, esi
je 0x529a85
mov edi, 0x270f
jmp 0x529a23
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0xa3c]
test eax, eax
je 0x529a7b
lea eax, [esi + 0xa2c]
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
push edx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
je 0x529a7b
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0xa34]
jl 0x5297cc
mov esi, dword [esi + 0xd9c]
test esi, esi
jne 0x529a1f
mov edx, 1
mov ecx, ebp
call fcn.004da5d0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
ret
cmp edi, 2
jne 0x5297b2
mov edx, dword [0x59bd60]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x5b1880]
push 4
push edx
xor edx, edx
call fcn.00527600
test eax, eax
je 0x5297cc
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [0x5b26b8]
test ecx, ecx
mov dword [0x5b26b4], eax
push eax
je 0x529af0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
ret
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
pop ebx
pop edi
mov dword [0x5b26b8], eax
pop ebp
add esp, 0x34
ret