Function at 0x45dea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fe8f8
push 0x4ba3f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebx + 0xc], edi
mov eax, dword [ebp + 0x10]
cmp eax, 0x202
ja 0x45e0ba
je case.0x45e0c8.520
cmp eax, 0x104
ja 0x45df2f
je 0x45df18
cmp eax, 0x20
je 0x45defc
cmp eax, 0x100
je 0x45df18
jmp case.0x45e0c8.518
xor eax, eax
cmp dword [ebx + 8], 0xffffffff
setne al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x45e0c8.518
mov ecx, ebx
call fcn.0045ea20
jmp case.0x45e0c8.518
sub eax, 0x200
je 0x45dfba
dec eax
jne case.0x45e0c8.518
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x45e0c8.518
push 1
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
shr eax, 8
test al, al
je case.0x45e0c8.518
push 2
call esi
shr eax, 8
test al, al
je case.0x45e0c8.518
lea edx, [ebx + 0x2d]
mov edi, 0x5236f8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
push edx
mov ecx, ebx
call fcn.0045e670
mov eax, 1
mov dword [ebx + 0x54], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor esi, esi
cmp dword [ebx + 0x54], esi
je 0x45dfd2
push esi
lea ecx, [ebx + 0x2d]
push ecx
mov ecx, ebx
call fcn.0045e670
jmp case.0x45e0c8.518
cmp dword [ebx + 0x44], esi
je case.0x45e0c8.518
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
jne 0x45dff8
mov dword [ebx + 0x44], esi
mov dword [0x6f1758], esi
jmp case.0x45e0c8.518
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [ebp - 0x20], ecx
shr eax, 0x10
movsx eax, ax
mov dword [ebp - 0x1c], eax
test byte [0x6d1540], 2
je 0x45e030
cmp dword [ebx + 0x40], esi
jne 0x45e030
push eax
push ecx
mov edx, dword [ebx + 0x24]
push edx
mov eax, dword [ebx + 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, ebx
call fcn.0045dde0
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x20]
push eax
mov ecx, ebx
call fcn.0045e5c0
test eax, eax
je 0x45e52f
mov ecx, dword [ebp - 0x24]
push ecx
mov ecx, ebx
call fcn.0045e570
cmp dword [ebx + 0x40], esi
jne 0x45e08b
lea edi, [ebx + 0x2d]
mov byte [edi], 0
mov edx, dword [ebx + 0x38]
cmp dword [ebx + 0x3c], edx
je 0x45e07d
mov al, byte [ebx + edx + 0x28]
mov byte [edi + esi], al
inc esi
mov byte [edi + esi], 0
lea eax, [edx + 1]
cdq
idiv dword [ebx + 0x34]
cmp dword [ebx + 0x3c], edx
jne 0x45e065
test esi, esi
jle 0x45e08b
push 0
push edi
mov ecx, ebx
call fcn.0045e670
mov ecx, dword [ebp - 0x20]
mov dword [ebx + 0x20], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebx + 0x24], edx
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x45e52f
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
add eax, 0xfffffdfc
cmp eax, 6
ja case.0x45e0c8.518
jmp dword [eax*4 + 0x45e548]
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x45e0c8.518
push 2
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
movsx eax, ax
shr eax, 0x10
je case.0x45e0c8.518
push 4
call esi
movsx ecx, ax
shr ecx, 0x10
jne case.0x45e0c8.518
mov dword [ebx + 0x48], 1
mov eax, dword [ebp + 0x14]
shr eax, 0x10
test ax, ax
lea edx, [ebx + 0x2d]
mov edi, 0x5236f4
jg 0x45e11f
mov edi, 0x5236f0
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0
lea eax, [ebx + 0x2d]
push eax
mov ecx, ebx
call fcn.0045e670
test eax, eax
je 0x45e153
call dword [sym.imp.USER32.dll_ReleaseCapture]
push 1
lea eax, [ebx + 0x2d]
push eax
mov ecx, ebx
call fcn.0045e670
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor esi, esi
cmp dword [ebx + 0x50], esi
je 0x45e1bc
mov dword [ebx + 0x50], esi
mov dword [ebx + 0x44], esi
mov dword [0x6f1758], esi
mov dword [ebx + 0x54], esi
call dword [sym.imp.USER32.dll_ReleaseCapture]
test byte [0x6d1540], 2
je 0x45e1a4
mov ecx, ebx
call fcn.0045ed80
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebx + 0x44], esi
je case.0x45e0c8.518
mov dword [ebp - 4], esi
mov dword [ebx + 0x44], esi
mov dword [0x6f1758], esi
mov dword [ebx + 8], 0xffffffff
mov ecx, ebx
call fcn.0045eac0
call dword [sym.imp.USER32.dll_ReleaseCapture]
test byte [0x6d1540], 2
mov edi, dword [ebp + 0x18]
je 0x45e213
movsx eax, di
mov dword [ebp - 0x48], eax
mov ecx, edi
shr ecx, 0x10
movsx ecx, cx
mov dword [ebp - 0x44], ecx
cmp dword [ebx + 0x58], eax
jne 0x45e20c
cmp dword [ebx + 0x5c], ecx
je 0x45e213
mov ecx, ebx
call fcn.0045ed80
cmp dword [ebx + 0x48], esi
je 0x45e23a
mov dword [ebx + 0x48], esi
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebx + 0x40], esi
je 0x45e299
mov dword [ebx + 0x40], esi
cmp dword [ebx + 0x4c], esi
je 0x45e269
mov dword [ebx + 0x4c], esi
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push edi
mov edx, dword [ebp + 0x14]
push edx
push 0x204
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor ecx, ecx
mov dword [ebp - 0x40], ecx
lea esi, [ebx + 0x2d]
mov byte [esi], cl
mov edi, dword [ebx + 0x38]
cmp dword [ebx + 0x3c], edi
je 0x45e2c7
mov dl, byte [edi + ebx + 0x28]
mov byte [esi + ecx], dl
inc ecx
mov dword [ebp - 0x40], ecx
mov byte [esi + ecx], 0
mov eax, dword [ebx + 0x38]
inc eax
cdq
idiv dword [ebx + 0x34]
mov dword [ebx + 0x38], edx
jmp 0x45e2a3
test ecx, ecx
jle 0x45e2f4
push 1
push esi
mov ecx, ebx
call fcn.0045e670
mov dword [ebp - 4], 0xffffffff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edi, dword [ebp + 8]
mov ecx, edi
call fcn.0044f0b0
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x45e27d
call dword [sym.imp.USER32.dll_GetMessagePos]
mov dword [ebp - 0x54], eax
movsx ecx, ax
mov dword [ebp - 0x50], ecx
shr eax, 0x10
movsx edx, ax
mov dword [ebp - 0x4c], edx
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0044f0c0
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
lea ecx, [ebp - 0x50]
push ecx
push esi
call fcn.00455570
add esp, 0xc
test eax, eax
je 0x45e27d
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0x204
mov ecx, dword [ebp + 0xc]
push ecx
jmp 0x45e277
mov eax, dword [ebx + 0x44]
test eax, eax
je case.0x45e0c8.518
push 4
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
call esi
shr eax, 8
test al, al
je case.0x45e0c8.518
push 2
call esi
shr eax, 8
test al, al
je case.0x45e0c8.518
lea edx, [ebx + 0x2d]
mov edi, 0x5236ec
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx + 0x54], 1
push 0
push edx
mov ecx, ebx
call fcn.0045e670
test eax, eax
je case.0x45e0c8.518
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx + 0x54]
test eax, eax
je case.0x45e0c8.518
lea eax, [ebx + 0x2d]
push 1
push eax
mov ecx, ebx
call fcn.0045e670
mov dword [ebx + 0x54], 0
mov ecx, ebx
call fcn.0045eac0
mov edi, 0x595430
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
lea edi, [ebx + 0x2d]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, 1
mov dword [ebx + 0x50], eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebx + 0x44]
test eax, eax
jne case.0x45e0c8.518
test edi, edi
je case.0x45e0c8.518
mov eax, dword [ebp + 0x18]
movsx ecx, ax
mov dword [ebx + 0x58], ecx
shr eax, 0x10
movsx edx, ax
mov dword [ebx + 0x5c], edx
mov esi, dword [ebp + 0xc]
push esi
mov eax, dword [edi + 4]
push eax
call fcn.004b8ca0
add esp, 8
test eax, eax
jne 0x45e4a9
mov ecx, edi
call fcn.0044f0c0
cmp eax, esi
je 0x45e4a9
mov dword [ebx + 4], 0
jmp case.0x45e0c8.518
mov dword [ebx + 4], esi
push esi
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, 1
mov dword [ebx + 0x44], eax
mov dword [0x6f1758], eax
xor esi, esi
mov dword [ebx + 0x40], esi
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [ebx + 0x20], ecx
shr eax, 0x10
movsx edx, ax
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x38], esi
mov dword [ebx + 0x3c], esi
mov ecx, edi
call fcn.0044f0b0
mov esi, eax
test esi, esi
je case.0x45e0c8.518
call dword [sym.imp.USER32.dll_GetMessagePos]
movsx ecx, ax
mov dword [ebp - 0x64], ecx
shr eax, 0x10
movsx edx, ax
mov dword [ebp - 0x60], edx
lea eax, [ebp - 0x64]
push eax
mov ecx, edi
call fcn.0044f0c0
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
lea ecx, [ebp - 0x64]
push ecx
push esi
call fcn.00455570
add esp, 0xc
test eax, eax
je case.0x45e0c8.518
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14