Function at 0x531290
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x551a18
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push esi
push edi
mov edi, dword [esp + 0x70]
mov esi, ecx
mov eax, dword [esi]
push edi
push ebp
call dword [eax + 0x308]
mov ecx, dword [0x5a7ee8]
cmp ecx, esi
mov ebx, eax
je 0x5312f5
mov eax, dword [0x5a7ec4]
test eax, eax
je 0x5312f5
test ecx, ecx
mov dword [0x5a7ee8], esi
je 0x5312f5
mov eax, dword [ecx + 0x844]
push eax
mov dword [ecx + 0x844], 0xffffffff
call fcn.00530d50
test ebx, ebx
jge 0x531384
or ebx, 0xffffffff
mov dword [esi + 0x83c], ebx
mov eax, dword [0x5a7ec4]
test eax, eax
je 0x531346
mov eax, dword [esi + 0x7f8]
test eax, eax
jne 0x531346
mov eax, dword [esi + 0x844]
cmp eax, ebx
mov dword [esi + 0x844], ebx
je 0x53133b
push eax
mov ecx, esi
call fcn.00530d50
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.user32.dll_UpdateWindow]
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x324]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x190]
test eax, eax
je 0x531361
mov ecx, dword [0x5a7a1c]
push ecx
call dword [sym.imp.user32.dll_SetCursor]
mov edx, dword [esp + 0x68]
push edi
push ebp
push edx
mov ecx, esi
call fcn.004a06e0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc
lea ecx, [esi + 0x84c]
push ebx
call fcn.0051ec55
test eax, eax
je 0x5318ba
mov edi, dword [eax + 8]
test edi, edi
je 0x5318ba
mov eax, dword [0x5a7ee4]
test eax, eax
mov dword [0x5a7ec8], 0
je 0x5313e3
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x388]
test eax, eax
je 0x5313e3
mov eax, dword [0x5a7ec4]
test eax, eax
jne 0x5313f9
push 0x12
call dword [sym.imp.user32.dll_GetAsyncKeyState]
test ah, ah
jns 0x5313e3
mov dword [0x5a7ec8], 1
mov eax, dword [0x5a7ec4]
test eax, eax
jne 0x5313f9
mov eax, dword [0x5a7ec8]
test eax, eax
je 0x5317b0
mov eax, dword [esi + 0x7f8]
test eax, eax
jne 0x5317b0
mov eax, dword [esi + 0x9b8]
test eax, eax
jne 0x5317b0
mov ebp, dword [esi + 0x844]
mov edx, dword [esi]
lea eax, [esp + 0x18]
push eax
push ebx
mov ecx, esi
mov dword [esi + 0x844], ebx
call dword [edx + 0x2e4]
cmp ebp, 0xffffffff
je 0x53143e
push ebp
mov ecx, esi
call fcn.00530d50
mov ecx, dword [esi + 0x844]
push ecx
mov ecx, esi
call fcn.005302a0
mov edx, dword [esp + 0x68]
and edx, 8
mov dword [esi + 0x96c], eax
mov dword [esi + 0x978], edx
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x5c]
test eax, eax
jne 0x5314a0
cmp ebp, 0xffffffff
mov dword [esi + 0x844], 0xffffffff
mov dword [esi + 0x96c], eax
je 0x5318ba
push ebp
mov ecx, esi
call fcn.00530d50
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc
push ebx
mov ecx, esi
call fcn.00530d50
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.user32.dll_UpdateWindow]
mov ecx, dword [esi + 0x96c]
mov edx, dword [ecx]
call dword [edx + 0x38]
test eax, eax
je 0x531545
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x6c]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
cmp eax, 6
jg 0x531545
mov eax, dword [0x5a7ec8]
test eax, eax
jne 0x531545
mov ecx, dword [esi + 0x96c]
mov dword [esi + 0x97c], 1
lea eax, [ecx + 0x30]
mov ebx, dword [eax]
lea edi, [esi + 0x980]
mov edx, edi
mov dword [edx], ebx
mov ebx, dword [eax + 4]
mov dword [edx + 4], ebx
mov ebx, dword [eax + 8]
mov dword [edx + 8], ebx
mov eax, dword [eax + 0xc]
mov dword [edx + 0xc], eax
mov edx, dword [ecx]
call dword [edx + 0x34]
test eax, eax
je 0x531527
push 2
push 2
push edi
call dword [sym.imp.user32.dll_InflateRect]
mov ecx, esi
call fcn.004044e0
mov dword [esi + 0x9a8], eax
mov eax, dword [0x5a7a10]
push eax
call dword [sym.imp.user32.dll_SetCursor]
jmp 0x53188a
mov ecx, dword [esi + 0x96c]
mov edx, dword [ecx]
call dword [edx + 0x4c]
test eax, eax
je 0x5317a1
mov ecx, dword [esi + 0x96c]
mov eax, dword [ecx]
call dword [eax + 0x70]
test eax, eax
je 0x5317a1
lea ecx, [esp + 0x28]
call fcn.005482aa
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esi + 0x96c]
xor ebp, ebp
mov dword [esp + 0x64], ebp
call fcn.004b1f10
mov eax, dword [edi + 8]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x37c]
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov dword [0x5a7f84], ebp
mov edi, dword [esi + 0x1c]
mov dword [esi + 0x970], ecx
mov dword [esi + 0x974], edx
cmp dword [0x5a7ec8], ebp
je 0x5315c7
mov dword [0x5a7ec4], 1
push 0x5a7f40
lea eax, [esp + 0x1c]
push eax
push 3
lea ecx, [esp + 0x34]
call fcn.00549641
push edi
mov ebp, eax
call dword [sym.imp.user32.dll_IsWindow]
test eax, eax
jne 0x531621
cmp dword [0x5a7ec8], eax
je 0x5315fb
mov dword [0x5a7ec4], eax
mov dword [0x5a7ec8], eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x60], 0xffffffff
call fcn.005482d5
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.user32.dll_GetCursorPos]
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.user32.dll_ScreenToClient]
mov eax, dword [0x5a7f84]
test eax, eax
je 0x531763
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.user32.dll_PtInRect]
test eax, eax
jne 0x531763
cmp ebp, 1
je 0x531747
mov eax, dword [esi + 0x96c]
test eax, eax
je 0x531747
mov ecx, dword [0x5a7f80]
test ecx, ecx
jne 0x531747
mov edx, dword [esi]
push ebp
push eax
mov ecx, esi
call dword [edx + 0x2f4]
test eax, eax
je 0x531747
mov eax, dword [esi + 0x96c]
mov edi, dword [esi]
push eax
mov ecx, esi
call fcn.00530110
push eax
mov ecx, esi
call dword [edi + 0x2c4]
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x350]
mov eax, dword [esi + 0x1c]
mov edi, dword [sym.imp.user32.dll_RedrawWindow]
push 0x505
push 0
push 0
push eax
call edi
mov edx, dword [esi]
push 1
mov ecx, esi
call dword [edx + 0x270]
mov eax, dword [0x5a7ec8]
test eax, eax
jne 0x531704
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c8]
mov ecx, dword [esi + 0x1c]
push 0x505
push 0
push 0
push ecx
call edi
push 0x5742f8
mov ecx, esi
call fcn.00401fc0
mov ecx, eax
call fcn.005269f6
test eax, eax
je 0x531774
mov ecx, esi
call fcn.00401fc0
mov ecx, eax
call fcn.00401fc0
push eax
push 0x5a43e4
call fcn.00526a01
add esp, 8
test eax, eax
je 0x531774
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x1cc]
jmp 0x531774
mov eax, dword [esi + 0x96c]
test eax, eax
je 0x531774
add eax, 0x30
push 1
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.user32.dll_InvalidateRect]
jmp 0x531774
mov edx, dword [esi]
push ebx
mov ecx, esi
mov dword [esi + 0x840], ebx
call dword [edx + 0x324]
or ecx, 0xffffffff
mov eax, ecx
mov dword [esi + 0x974], ecx
mov dword [esp + 0x60], ecx
lea ecx, [esp + 0x28]
mov dword [esi + 0x96c], 0
mov dword [esi + 0x970], eax
call fcn.005482d5
jmp 0x53188a
mov dword [esi + 0x96c], 0
jmp 0x53188a
push ebx
mov ecx, esi
mov dword [esi + 0x83c], ebx
call fcn.005303a0
test dword [edi + 0xc], 0x40000
je 0x5317f6
push 0x5a46fc
mov ecx, edi
call fcn.005269f6
test eax, eax
jne 0x5317f6
pop edi
mov dword [esi + 0x83c], 0xffffffff
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc
mov eax, dword [edi + 0xc]
or eax, 0x20000
push ebx
mov ecx, esi
mov dword [edi + 0xc], eax
call fcn.00530d50
mov eax, dword [esi + 0x1c]
mov ebp, dword [sym.imp.user32.dll_UpdateWindow]
push eax
call ebp
mov eax, dword [edi + 8]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x37c]
mov edx, dword [edi]
push 0
push esi
mov ecx, edi
call dword [edx + 0x1c]
test eax, eax
je 0x531874
push 0
push edi
lea ecx, [esi + 0x84c]
call fcn.0051e81e
test eax, eax
je 0x53184a
and dword [edi + 0xc], 0xfffdffff
mov edx, dword [esi]
or eax, 0xffffffff
push eax
mov ecx, esi
mov dword [esi + 0x83c], eax
mov dword [esi + 0x840], eax
call dword [edx + 0x324]
push ebx
mov ecx, esi
call fcn.00530d50
mov eax, dword [esi + 0x1c]
push eax
call ebp
jmp 0x53188a
mov ecx, dword [esi + 0x1c]
push ecx
call dword [sym.imp.user32.dll_SetCapture]
push eax
call fcn.0052220f
mov dword [esi + 0x9a8], eax
mov eax, dword [0x5a7ec8]
test eax, eax
je 0x5318ba
push 0
mov dword [0x5a7ec8], 0
call fcn.005402f0
mov edx, dword [esi + 0x1c]
add esp, 4
push 0x505
push 0
push 0
push edx
call dword [sym.imp.user32.dll_RedrawWindow]
mov ecx, dword [esp + 0x58]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret 0xc