Function at 0x503834
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
xor eax, eax
push ebp
push 0x503ab7
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x503a7c
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x50386f
call sub.user32.dll_WaitMessage
jmp 0x503a7c
mov eax, dword [edi + 4]
cmp eax, 0x105
jg 0x5038c8
je 0x503981
cmp eax, 0xa6
jge 0x5038a9
sub eax, 0xa0
je case.0x5038d6.512
dec eax
je case.0x5038d6.513
add eax, 0xfffffffe
sub eax, 2
jb case.0x5038d6.513
jmp case.0x5038d6.514
add eax, 0xffffff5a
sub eax, 2
jb case.0x5038d6.513
dec eax
je case.0x5038d6.513
sub eax, 0x5b
je 0x503905
jmp case.0x5038d6.514
add eax, 0xfffffe00
cmp eax, 9
ja case.0x5038d6.514
jmp dword [eax*4 + 0x5038dd]
cmp dword [edi + 8], 0x12
je case.0x5038d6.514
cmp dword [edi + 8], 0x10
je case.0x5038d6.514
cmp dword [edi + 8], 0x19
je case.0x5038d6.514
mov byte [ebp - 1], 0
test byte [edi + 0xe], 0xff
je 0x50395e
mov dword [ebp - 8], 0x60
push 0
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_MapVirtualKeyA
mov dx, word [edi + 0xe]
and dx, 0xff
movzx edx, dx
cmp eax, edx
jne 0x503955
mov byte [ebp - 1], 1
jmp 0x50395e
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x6a
jne 0x503934
cmp byte [ebp - 1], 0
jne case.0x5038d6.514
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x503ac8]
mov byte [eax + 0x34], dl
call fcn.0040439c
jmp 0x503abe
cmp dword [edi + 8], 0x12
jne case.0x5038d6.514
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dl, byte [0x503ac8]
mov byte [eax + 0x34], dl
call fcn.0040439c
jmp 0x503abe
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00479390
cmp eax, dword [edi]
je case.0x5038d6.514
call fcn.0040439c
jmp 0x503abe
call sub.user32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne 0x5039f2
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00479390
lea edx, [edi + 0x14]
call fcn.005037a0
test al, al
je 0x503a21
call sub.user32.dll_ReleaseCapture
jmp 0x503a21
call sub.user32.dll_GetCapture
test eax, eax
jne 0x503a21
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x30]
call fcn.00479390
lea edx, [edi + 0x14]
call fcn.005037a0
test al, al
jne 0x503a21
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.user32.dll_SetCapture
call sub.user32.dll_GetCapture
mov edx, dword [ebp + 8]
cmp eax, dword [edx - 8]
jne case.0x5038d6.514
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
push eax
call sub.user32.dll_SetCursor
push 3
mov ebx, dword [edi + 4]
push ebx
push ebx
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x503a7c
mov esi, dword [edi + 4]
cmp esi, 0x200
jb 0x503a70
cmp esi, 0x20a
ja 0x503a70
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
cmp eax, dword [edi]
je 0x503a7c
push edi
call sub.user32.dll_TranslateMessage
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.005037d4
pop ecx
test al, al
jne 0x503853
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x503abe
mov edx, 0x103
mov eax, 0x102
call fcn.004ddb78
mov edx, 0x107
mov eax, 0x106
call fcn.004ddb78
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret