Function at 0x5b7830
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x6c6060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, ecx
mov dword [ebp - 0x30], eax
mov eax, dword [esi - 0x620]
push edi
lea edi, [esi - 0x620]
mov dword [ebp - 0x38], esi
mov ecx, edi
mov eax, dword [eax + 0xf4]
call eax
test al, al
je 0x5b7d79
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x100]
call eax
test al, al
je 0x5b7d79
mov eax, dword [edi]
mov ecx, edi
push ebx
mov eax, dword [eax + 0x108]
call eax
mov ebx, dword [ebp + 8]
test al, al
jne 0x5b789e
lea eax, [ebx - 0x200]
cmp eax, 0xd
jbe 0x5b78b0
cmp ebx, 0x20a
jne 0x5b78c5
test byte [ebp + 0xc], 8
jne 0x5b795c
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b08a
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x100
jne 0x5b78f9
push 0xa2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x5b795c
cmp dword [ebp + 0xc], 0x43
jne 0x5b795c
cmp dword [esi + 0x2dc], 0
je 0x5b795c
mov ecx, dword [ebp - 0x30]
mov byte [ecx], 1
jmp 0x5b78b0
cmp ebx, 0x10f
jne 0x5b795c
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005979a0
push eax
call sub.IMM32.dll_ImmGetContext
mov esi, eax
test esi, esi
je 0x5b78b0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
push esi
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], ecx
call sub.IMM32.dll_ImmSetCompositionWindow
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005979a0
push eax
call sub.IMM32.dll_ImmReleaseContext
jmp 0x5b78b0
mov byte [ebp - 0x21], 1
cmp ebx, 0x200
jb 0x5b7970
cmp ebx, 0x20d
jbe 0x5b7979
cmp ebx, 0x20
jne 0x5b7aad
mov ecx, dword [esi + 4]
call fcn.005b7680
test eax, eax
jne 0x5b79b8
lea eax, [ebx - 0x200]
cmp eax, 5
ja 0x5b79b8
mov eax, dword [ebp + 0x10]
movsx ecx, ax
shr eax, 0x10
cwde
push eax
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00596e80
lea ecx, [esi - 0x620]
cmp eax, ecx
jne 0x5b78b0
mov ecx, dword [esi + 4]
call fcn.005b7680
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 3
mov dword [ebp - 0x34], ecx
test eax, eax
jne 0x5b7a49
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x14]
push eax
call fcn.005b7150
mov ecx, dword [ebp + 0x10]
movsx eax, cx
mov dword [ebp - 0x2c], eax
mov eax, ecx
shr eax, 0x10
cwde
mov dword [ebp - 0x28], eax
cmp ebx, 0x20
jne 0x5b79ff
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
jmp 0x5b7a07
cmp ebx, 0x20a
jne 0x5b7a20
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
mov eax, dword [edi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005979a0
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x28]
lea eax, [ebp - 0x14]
push dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x5b7a46
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00597da0
test al, al
je 0x5b7a52
mov ecx, dword [ebp - 0x34]
cmp ecx, 3
jne 0x5b78b0
cmp ebx, 0x20
je 0x5b7d00
cmp ebx, 0x201
je 0x5b7a77
cmp ebx, 0x203
je 0x5b7a77
cmp ebx, 0x204
jne case.default.0x5b7cb1
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00597dc0
test al, al
jne 0x5b7a9e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005979a0
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x11c]
jmp case.default.0x5b7cb1
lea eax, [ebx - 0x100]
cmp eax, 9
ja 0x5b7ad1
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x118]
call eax
test al, al
jne case.default.0x5b7cb1
jmp 0x5b78b0
cmp ebx, 0x7b
jne 0x5b7c84
cmp dword [esi + 0x2d8], 0
jne 0x5b78b0
mov ecx, dword [ebp + 0x10]
movsx eax, cx
mov dword [ebp - 0x2c], eax
mov eax, ecx
shr eax, 0x10
mov ecx, edi
cwde
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [edi]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005979a0
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 0x28]
mov eax, dword [edi]
mov ecx, edi
push dword [ebp - 0x2c]
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00596e80
lea ecx, [esi - 0x620]
cmp eax, ecx
jne 0x5b78b0
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
mov ebx, eax
push 0x69a958
push 0x65
push 0
push ebx
mov dword [ebp - 0x34], ebx
call esi
push 0x69a968
push 0x6b
push 0
push ebx
call esi
push 0x6b365c
push 0
push 0x800
push ebx
call esi
push str.jR_aR_
push 0x66
push 0
push ebx
call esi
push str._rY6R_
push 0x67
push 0
push ebx
call esi
push 0x69a998
push 0x68
push 0
push ebx
call esi
push 0x69a9a8
push 0x69
push 0
push ebx
call esi
push 0x6b365c
push 0
push 0x800
push ebx
call esi
push 0x69a9b8
push 0x6a
push 0
push ebx
call esi
mov ecx, edi
call fcn.005b6300
mov edi, dword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
test al, al
sete cl
push ecx
push 0x65
push ebx
call edi
mov esi, dword [ebp - 0x38]
add esi, 0xfffff9e0
mov ecx, esi
call fcn.005b62c0
xor ecx, ecx
test al, al
sete cl
push ecx
push 0x6b
push ebx
call edi
mov ecx, esi
call fcn.005b7200
xor ebx, ebx
mov ecx, esi
test ax, ax
sete bl
call fcn.005b76a0
xor ecx, ecx
test al, al
setne cl
mov dword [ebp - 0x40], ecx
mov esi, ecx
or esi, ebx
push esi
push 0x66
push dword [ebp - 0x34]
call edi
push ebx
mov ebx, dword [ebp - 0x34]
push 0x67
push ebx
call edi
push esi
push 0x69
push ebx
call edi
push dword [ebp - 0x40]
push 0x68
push ebx
call edi
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
lea edi, [esi - 0x620]
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005979a0
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x1c]
mov ecx, eax
call fcn.005979a0
push eax
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 2
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ebx, dword [ebp + 8]
jmp case.default.0x5b7cb1
cmp ebx, 0x111
jne 0x5b7cf7
mov eax, dword [ebp - 0x30]
mov ecx, edi
mov byte [eax], 0
mov eax, dword [edi]
mov eax, dword [eax + 0x118]
call eax
test al, al
je 0x5b78b0
mov eax, dword [ebp + 0xc]
add eax, 0xffffff9b
cmp eax, 6
ja case.default.0x5b7cb1
jmp dword [eax*4 + 0x5b7d90]
mov ecx, edi
call fcn.005ba080
jmp case.default.0x5b7cb1
mov ecx, edi
call fcn.005b8190
jmp case.default.0x5b7cb1
mov ecx, edi
call fcn.005b6450
jmp case.default.0x5b7cb1
mov ecx, edi
call fcn.005b6360
jmp case.default.0x5b7cb1
mov ecx, edi
call fcn.005b80e0
jmp case.default.0x5b7cb1
mov ecx, edi
call fcn.005b6340
jmp case.default.0x5b7cb1
mov ecx, edi
call fcn.005b9590
jmp case.default.0x5b7cb1
cmp ebx, 0x53
jne 0x5b78b0
mov byte [ebp - 0x21], 0
mov eax, dword [edi]
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp + 0x10]
mov ecx, edi
mov dword [ebp - 0x3c], 0
push dword [ebp + 0xc]
push ebx
call dword [eax + 0x200]
test eax, eax
je 0x5b7d5b
cmp ebx, 0x100
jb 0x5b7d34
cmp ebx, 0x109
jbe 0x5b7d5b
cmp ebx, 0x102
je 0x5b7d5b
cmp ebx, 0x286
je 0x5b7d5b
lea eax, [ebx - 0x200]
cmp eax, 0xd
ja 0x5b7d63
mov ecx, dword [esi + 4]
call fcn.005b7680
test eax, eax
je 0x5b7d63
mov ecx, dword [ebp - 0x30]
mov al, byte [ebp - 0x21]
mov byte [ecx], al
mov eax, dword [ebp - 0x3c]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045b08a
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0045b08a
mov esp, ebp
pop ebp
ret 0x10