Function at 0x65de64
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x3c], 1
jae 0x65de79
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret 4
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call ebx
mov di, ax
push 2
and edi, 0x8000
call ebx
and eax, 0x8000
test edi, edi
jne 0x65deb0
test eax, eax
jne 0x65deb0
push eax
mov ecx, esi
call fcn.0065e2d0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x14
ret 4
mov eax, dword [esi + 0x40]
push ebp
push eax
call sub.MFC42u.DLL_CWnd::FromHandle
mov ecx, dword [esp + 0x28]
mov edx, dword [esi + 0x3c]
mov ebp, eax
mov eax, dword [ecx + 0xc]
movsx ecx, ax
shr eax, 0x10
movsx eax, ax
cmp edx, 2
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jb 0x65e00b
mov eax, dword [ebp + 0x20]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x18]
lea edi, [esi + 0x34]
test eax, eax
mov dword [edi], ecx
mov dword [edi + 4], edx
jne 0x65df0a
xor ebx, ebx
jmp 0x65df5c
mov ebx, dword [eax + 0x20]
test ebx, ebx
je 0x65df5c
mov ebp, dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push edi
mov dword [edi], eax
push ebx
mov dword [edi + 4], ecx
call ebp
mov edx, dword [edi + 4]
mov eax, dword [edi]
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
test eax, eax
je 0x65df42
cmp eax, ebx
je 0x65df42
mov ebx, eax
jmp 0x65df17
test ebx, ebx
je 0x65df5c
mov eax, dword [esi + 4]
test eax, eax
je 0x65df50
mov eax, dword [eax + 0x20]
push ebx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x65df67
mov eax, 0xffffd8f0
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x28], ebx
mov ecx, dword [0x76335c]
push ecx
mov ecx, esi
call fcn.0065e160
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
call dword [sym.imp.COMCTL32.dll_ImageList_DragMove]
mov ecx, dword [0x763350]
push ecx
mov ecx, esi
call fcn.0065e160
mov edi, eax
mov eax, dword [esi + 0x28]
test eax, eax
je 0x65dfab
push eax
mov ecx, esi
call fcn.0065db80
test al, 2
jne 0x65dfad
xor edi, edi
mov eax, dword [esi + 0x54]
test eax, eax
jne 0x65dfc2
push str.Ole32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x54], eax
mov eax, edi
dec eax
je 0x65dfe1
dec eax
je 0x65dfd9
dec eax
je 0x65dfd1
push 1
jmp 0x65dfe3
mov eax, dword [esi + 0x54]
push 4
push eax
jmp 0x65dfe7
mov ecx, dword [esi + 0x54]
push 3
push ecx
jmp 0x65dfe7
push 2
mov edx, dword [esi + 0x54]
push edx
call dword [sym.imp.USER32.dll_LoadCursorW]
test eax, eax
je 0x65e136
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret 4
mov ebx, dword [esi + 0x48]
mov edx, dword [esi + 0x44]
sub eax, ebx
sub ecx, edx
mov dword [esp + 0x20], eax
mov al, byte [0x763354]
test al, 1
mov dword [esp + 0x1c], ecx
jne 0x65e05a
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
or al, 1
push 0x45
mov byte [0x763354], al
call ebx
push 0x44
mov dword [esp + 0x14], eax
call ebx
mov dword [0x763348], eax
mov eax, dword [esp + 0x10]
push 0x65e150
mov dword [0x76334c], eax
call fcn.00609785
add esp, 4
mov eax, dword [esp + 0x1c]
mov ecx, dword [0x763348]
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jg 0x65e084
mov eax, dword [esp + 0x20]
mov ecx, dword [0x76334c]
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x65e136
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x48]
mov dword [esi + 0x34], ecx
mov dword [esi + 0x24], eax
mov dword [esi + 0x38], edx
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], edi
mov eax, dword [0x763360]
push eax
mov ecx, esi
call fcn.0065e160
test eax, eax
je 0x65e12d
mov eax, dword [esi + 0x30]
test eax, eax
je 0x65e12d
neg edi
sbb edi, edi
mov ecx, esi
add edi, 3
push edi
call fcn.0065e2d0
mov eax, dword [esp + 0x28]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0xc]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esi + 0x30]
push ebp
call fcn.0065e3b0
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [esi + 0x4c], eax
push edx
mov edx, dword [eax + 4]
push ecx
push 0
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_BeginDrag]
mov ecx, dword [ebp + 0x20]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_DragEnter]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret 4
push 0
mov ecx, esi
call fcn.0065e2d0
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x14
ret 4