Function at 0x562b00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea eax, [ebp - 0x2c]
mov esi, ecx
mov ecx, dword [0x645468]
push eax
push ecx
call dword [sym.imp.user32.dll_GetClientRect]
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.user32.dll_GetCursorPos]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
push eax
push ecx
call dword [sym.imp.user32.dll_WindowFromPoint]
lea edx, [ebp - 0x10]
mov edi, eax
mov eax, dword [0x645468]
push edx
push eax
call dword [sym.imp.user32.dll_ScreenToClient]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ecx
push edx
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.user32.dll_PtInRect]
xor ebx, ebx
test eax, eax
jne 0x562b6c
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562b71
cmp edi, dword [esi + 0x30]
je 0x562b8c
cmp dword [esi + 0xab4], ebx
je 0x562b84
mov ecx, dword [0x645858]
mov edx, dword [ecx]
call dword [edx + 0x4c]
mov dword [esi + 0xab4], ebx
jmp 0x562b96
mov dword [esi + 0xab4], 1
mov eax, dword [esi + 0xa68]
mov ecx, dword [esi + 0xa6c]
mov edx, dword [esi + 0xab8]
mov dword [esi + 0xa70], eax
mov eax, dword [esi + 0xabc]
mov dword [esi + 0xa74], ecx
mov ecx, dword [esi + 0xa78]
mov dword [esi + 0xa6c], eax
mov dword [esi + 0xa7c], ecx
mov ecx, dword [esi + 0xa70]
mov dword [esi + 0xa68], edx
mov dword [esi + 0xa78], ebx
mov edx, dword [0x64585c]
mov eax, dword [edx + 0x30]
mov dword [ebp - 4], eax
cmp ecx, dword [esi + 0xab8]
mov dword [ebp - 8], ebx
jne 0x562c03
mov edx, dword [esi + 0xa74]
cmp edx, dword [esi + 0xabc]
je 0x562c3c
cmp dword [esi + 0xab4], ebx
mov dword [ebp - 8], 1
jne 0x562c20
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562c3c
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
push 0x17
call dword [sym.imp.user32.dll_GetSystemMetrics]
mov ebx, dword [sym.imp.user32.dll_GetAsyncKeyState]
mov edi, eax
neg edi
sbb edi, edi
neg edi
mov ecx, 0
setne cl
inc ecx
push ecx
call ebx
test ah, 0xff
je 0x562c6a
or dword [esi + 0xa78], 4
push 4
call ebx
test ah, 0xff
je 0x562c7a
or dword [esi + 0xa78], 0x20
xor edx, edx
test edi, edi
sete dl
inc edx
push edx
call ebx
test ah, 0xff
je 0x562c94
or dword [esi + 0xa78], 0x100
test byte [esi + 0xa7c], 4
jne 0x562d14
test byte [esi + 0xa78], 4
je 0x562d14
mov eax, dword [esi + 0xab4]
xor ebx, ebx
cmp eax, ebx
jne 0x562cc0
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562cdc
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov eax, dword [esi + 0xa78]
mov ecx, dword [esi + 0xab8]
mov edx, dword [esi + 0xabc]
mov edi, dword [ebp - 4]
or eax, 1
mov dword [esi + 0xa78], eax
mov dword [esi + 0xac0], ecx
mov dword [esi + 0xac4], edx
mov dword [0x646530], edi
mov dword [0x64652c], ebx
jmp 0x562d19
mov edi, dword [ebp - 4]
xor ebx, ebx
test byte [esi + 0xa7c], 0x20
jne 0x562d8a
test byte [esi + 0xa78], 0x20
je 0x562d8a
cmp dword [esi + 0xab4], ebx
jne 0x562d41
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562d5d
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov eax, dword [esi + 0xa78]
mov ecx, dword [esi + 0xab8]
mov edx, dword [esi + 0xabc]
or eax, 8
mov dword [esi + 0xa78], eax
mov dword [esi + 0xac8], ecx
mov dword [esi + 0xacc], edx
mov dword [0x646528], edi
mov ecx, dword [esi + 0xa7c]
mov eax, 0x100
test eax, ecx
jne 0x562e00
test dword [esi + 0xa78], eax
je 0x562e00
cmp dword [esi + 0xab4], ebx
jne 0x562db7
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562dd3
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov eax, dword [esi + 0xa78]
mov ecx, dword [esi + 0xab8]
mov edx, dword [esi + 0xabc]
or eax, 0x40
mov dword [esi + 0xa78], eax
mov dword [esi + 0xad0], ecx
mov dword [esi + 0xad4], edx
mov dword [0x646524], edi
test byte [esi + 0xa7c], 4
je 0x562edf
test byte [esi + 0xa78], 4
jne 0x562edf
mov eax, dword [0x646530]
mov ecx, dword [0x64585c]
push edi
push eax
call dword [sym.imp.tengine.dll_public:_unsigned_int___thiscall_tTimeSystem::CalSubTime_unsigned_int__unsigned_int_]
cmp eax, 0x1f4
jae 0x562ea7
mov edx, dword [esi + 0xab8]
mov eax, dword [esi + 0xac0]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jg 0x562ea7
mov edx, dword [esi + 0xabc]
mov eax, dword [esi + 0xac4]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jg 0x562ea7
mov ecx, dword [esi + 0xa78]
mov eax, dword [esi + 0xab4]
or ecx, 2
cmp eax, ebx
mov dword [esi + 0xa78], ecx
jne 0x562e8b
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562ea7
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
cmp dword [esi + 0xab4], ebx
jne 0x562ebd
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562ed9
lea edx, [ebp - 0x1c]
push edx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov dword [0x64652c], ebx
test byte [esi + 0xa7c], 0x20
je 0x562f88
test byte [esi + 0xa78], 0x20
jne 0x562f88
mov eax, dword [0x646528]
mov ecx, dword [0x64585c]
push edi
push eax
call dword [sym.imp.tengine.dll_public:_unsigned_int___thiscall_tTimeSystem::CalSubTime_unsigned_int__unsigned_int_]
cmp eax, 0x1f4
jae 0x562f56
mov ecx, dword [esi + 0xa78]
mov eax, dword [esi + 0xab4]
or ecx, 0x10
cmp eax, ebx
mov dword [esi + 0xa78], ecx
jne 0x562f3a
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562f56
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0xe
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
cmp dword [esi + 0xab4], ebx
jne 0x562f6c
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x562f88
lea edx, [ebp - 0x1c]
push edx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0xd
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov eax, dword [esi + 0xa7c]
test ah, 1
je 0x56308b
mov eax, dword [esi + 0xa78]
test ah, 1
jne 0x56308b
mov eax, dword [0x64581c]
cmp dword [0x645800], eax
jne 0x562fbf
cmp dword [eax + 0x1c], ebx
je 0x562fbf
mov edi, 1
jmp 0x562fc1
xor edi, edi
mov eax, dword [ebp - 4]
mov ecx, dword [0x646524]
push eax
push ecx
mov ecx, dword [0x64585c]
call dword [sym.imp.tengine.dll_public:_unsigned_int___thiscall_tTimeSystem::CalSubTime_unsigned_int__unsigned_int_]
cmp eax, 0x1f4
jae 0x563059
cmp edi, ebx
jne 0x563059
mov edx, dword [esi + 0xab8]
mov eax, dword [esi + 0xad0]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jg 0x563059
mov edx, dword [esi + 0xabc]
mov eax, dword [esi + 0xad4]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 4
jg 0x563059
mov ecx, dword [esi + 0xa78]
mov eax, dword [esi + 0xab4]
or ecx, 0x80
cmp eax, ebx
mov dword [esi + 0xa78], ecx
jne 0x56303d
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x563059
lea edx, [ebp - 0x1c]
push edx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0xb
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
cmp dword [esi + 0xab4], ebx
jne 0x56306f
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x56308b
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0xa
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
test byte [esi + 0xa78], 4
mov dword [esi + 0xab0], ebx
je 0x563163
test byte [esi + 0xa7c], 4
je 0x5630c4
mov ecx, dword [ebp - 4]
mov edx, dword [0x646530]
push ecx
mov ecx, dword [0x64585c]
push edx
call dword [sym.imp.tengine.dll_public:_unsigned_int___thiscall_tTimeSystem::CalSubTime_unsigned_int__unsigned_int_]
mov dword [esi + 0xab0], eax
test byte [esi + 0xa78], 4
je 0x563163
test byte [esi + 0xa7c], 4
je 0x563163
mov edi, dword [ebp - 8]
cmp edi, ebx
je 0x563117
cmp dword [esi + 0xab4], ebx
jne 0x5630fb
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x563117
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov ecx, dword [esi + 0xab0]
cmp ecx, dword [0x6432c8]
jbe 0x563166
cmp dword [esi + 0xab4], ebx
jne 0x56313b
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x563157
lea edx, [ebp - 0x1c]
push edx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0x14
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov dword [0x64652c], 1
jmp 0x563166
mov edi, dword [ebp - 8]
test byte [esi + 0xa78], 0x20
je 0x5631ae
test byte [esi + 0xa7c], 0x20
je 0x5631ae
cmp edi, ebx
je 0x5631ae
cmp dword [esi + 0xab4], ebx
jne 0x563192
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x5631ae
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov ecx, dword [esi + 0xa78]
mov eax, 0x100
test eax, ecx
je 0x5631fb
test dword [esi + 0xa7c], eax
je 0x5631fb
cmp edi, ebx
je 0x5631fb
cmp dword [esi + 0xab4], ebx
jne 0x5631df
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x5631fb
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
test byte [0x646520], 1
jne 0x563216
or dword [0x646520], 1
call dword [sym.imp.user32.dll_GetDoubleClickTime]
mov dword [0x64651c], eax
test byte [esi + 0xa78], 2
je 0x56327f
mov eax, dword [0x64651c]
mov edx, dword [0x646518]
add edx, eax
mov eax, dword [ebp - 4]
cmp eax, edx
jae 0x563272
cmp dword [esi + 0xab4], ebx
jne 0x563249
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x563265
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
or dword [esi + 0xa78], 0x200
mov eax, dword [ebp - 4]
mov dword [0x646518], eax
mov dword [esi + 0xab0], ebx
jmp 0x563282
mov eax, dword [ebp - 4]
test byte [esi + 0xa78], 0x10
je 0x5632e1
mov edx, dword [0x646514]
mov ecx, dword [0x64651c]
add edx, ecx
cmp eax, edx
jae 0x5632dc
cmp dword [esi + 0xab4], ebx
jne 0x5632b3
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x5632cf
lea edx, [ebp - 0x1c]
push edx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0x10
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
or dword [esi + 0xa78], 0x400
mov eax, dword [ebp - 4]
mov dword [0x646514], eax
mov cl, byte [esi + 0xa78]
test cl, cl
jns 0x563341
mov ecx, dword [0x646510]
mov edx, dword [0x64651c]
add ecx, edx
cmp eax, ecx
jae 0x56333c
cmp dword [esi + 0xab4], ebx
jne 0x563313
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x56332f
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0x11
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
or dword [esi + 0xa78], 0x800
mov eax, dword [ebp - 4]
mov dword [0x646510], eax
test byte [esi + 0xa78], 0x40
je 0x563362
mov ecx, dword [esi + 0xa68]
mov edx, dword [esi + 0xa6c]
mov dword [esi + 0xaa0], ecx
mov dword [esi + 0xaa4], edx
mov eax, dword [esi + 0xa7c]
test al, al
jns 0x563384
mov ecx, dword [esi + 0xa68]
mov edx, dword [esi + 0xa6c]
mov dword [esi + 0xaa8], ecx
mov dword [esi + 0xaac], edx
test ah, 0x10
je 0x5633bb
cmp dword [esi + 0xab4], ebx
jne 0x56339f
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x5633bb
lea eax, [ebp - 0x1c]
push eax
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0x12
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
mov eax, dword [esi + 0xa7c]
test ah, 0x20
je 0x5633f8
cmp dword [esi + 0xab4], ebx
jne 0x5633dc
call dword [sym.imp.user32.dll_GetCapture]
cmp eax, dword [0x645468]
jne 0x5633f8
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [esi + 0xa58]
mov dword [ebp - 0x1c], 0x13
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00562460
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret