Function at 0x532d90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x731620
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8e0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x50], esi
cmp dword [esi + 0x2c], ebx
je 0x533535
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x81424c]
mov dword [ebp - 0x6c], 0x7712e0
cmp eax, ebx
mov dword [ebp - 0x68], 0x7712d8
mov dword [ebp - 0x64], 0x7712d0
mov dword [ebp - 0x60], 0x7712c4
mov dword [ebp - 0x5c], 0x7712b8
mov dword [ebp - 0x58], 0x7712b0
mov dword [ebp - 0x54], 0x7712a4
je 0x532e66
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x42]
mov eax, dword [ebp - 0x44]
and ecx, 0xffff
push ecx
mov ecx, dword [ebp - 0x48]
and edx, 0xffff
and ecx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [ebp + ecx*4 - 0x6c]
mov ecx, dword [ebp - 0x4a]
push eax
mov eax, dword [ebp - 0x46]
push edx
mov edx, dword [ebp - 0x4c]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [ebp - 0xec]
push 0x771280
push eax
call fcn.00711e28
add esp, 0x24
jmp 0x532f9c
mov eax, dword [0x83c488]
cmp eax, ebx
jbe 0x532f9c
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x38], ecx
mov edx, 0x5f5e100
mov dword [ebp - 0x34], ecx
xor esi, esi
mov dword [ebp - 0x30], ecx
mov bl, 0x57
xor ecx, ecx
cmp edi, edx
jl 0x532e96
sub edi, edx
inc ecx
cmp edi, edx
jge 0x532e8f
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
test esi, esi
jle 0x532eae
inc esi
jmp 0x532eb7
test ecx, ecx
jle 0x532eb9
mov esi, 1
test ecx, ecx
jne 0x532ec6
test esi, esi
jle 0x532f2f
mov byte [ebp + esi - 0x39], 0x52
jmp 0x532f2f
cmp ecx, 1
jne 0x532ed2
mov byte [ebp + esi - 0x39], 0x4f
jmp 0x532f2f
cmp ecx, 2
jne 0x532ede
mov byte [ebp + esi - 0x39], 0x48
jmp 0x532f2f
cmp ecx, 3
jne 0x532eea
mov byte [ebp + esi - 0x39], 0x55
jmp 0x532f2f
cmp ecx, 4
jne 0x532ef6
mov byte [ebp + esi - 0x39], 0x54
jmp 0x532f2f
cmp ecx, 5
jne 0x532f02
mov byte [ebp + esi - 0x39], 0x4e
jmp 0x532f2f
cmp ecx, 6
jne 0x532f0e
mov byte [ebp + esi - 0x39], 0x41
jmp 0x532f2f
cmp ecx, 7
jne 0x532f1a
mov byte [ebp + esi - 0x39], 0x53
jmp 0x532f2f
cmp ecx, 8
jne 0x532f26
mov byte [ebp + esi - 0x39], 0x45
jmp 0x532f2f
cmp ecx, 9
jne 0x532f2f
mov byte [ebp + esi - 0x39], bl
test edx, edx
jg 0x532e89
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x42]
lea ecx, [ebp - 0x38]
and edx, 0xffff
push ecx
mov ecx, dword [ebp - 0x44]
push edx
mov edx, dword [ebp - 0x48]
and eax, 0xffff
and edx, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [ebp + edx*4 - 0x6c]
mov edx, dword [ebp - 0x4a]
push ecx
mov ecx, dword [ebp - 0x46]
push eax
mov eax, dword [ebp - 0x4c]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [ebp - 0xec]
push 0x771254
push ecx
call fcn.00711e28
mov esi, dword [ebp - 0x50]
add esp, 0x28
xor ebx, ebx
mov ecx, dword [0x7a0f18]
lea edx, [ebp - 0xec]
push ebx
push edx
mov eax, dword [ecx + 0x28]
sub eax, 0x10
push eax
push 5
call fcn.0040f860
lea ecx, [ebp - 0xec]
push ebx
push ecx
mov ecx, dword [0x7a0f18]
mov edx, dword [ecx + 0x28]
sub edx, 0x10
push edx
push 3
call fcn.0040f860
mov ecx, dword [0x7a0f18]
mov edi, 0xf
lea eax, [ebp - 0xec]
push ebx
mov edx, dword [ecx + 0x28]
push eax
sub edx, edi
push edx
push 4
call fcn.0040f860
mov ecx, dword [0x7a0f18]
lea eax, [ebp - 0xec]
push ebx
push eax
mov edx, dword [ecx + 0x28]
sub edx, 0x11
push edx
push 4
call fcn.0040f860
mov ecx, dword [0x7a0f18]
lea eax, [ebp - 0xec]
push 0xffffff
push eax
mov edx, dword [ecx + 0x28]
sub edx, 0x10
push edx
push 4
call fcn.0040f860
push 0x83e758
lea eax, [ebp - 0x8ec]
push 0x771244
push eax
mov dword [esi + 0x2c], ebx
call fcn.00711e28
lea ecx, [ebp - 0x8ec]
push ebx
push ecx
call fcn.0071e49f
add esp, 0x14
test eax, eax
je 0x533074
lea edx, [ebp - 0x8ec]
push edx
call fcn.00712f9e
add esp, 4
test eax, eax
jne 0x533535
mov ecx, dword [0x73a7f0]
mov al, byte [0x83e154]
push ecx
push ebx
push 0x83e154
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0041fed0
mov edx, dword [ebp - 0x24]
xor esi, esi
cmp edx, ebx
mov dword [ebp - 4], ebx
jbe 0x53311a
mov ecx, dword [ebp - 0x28]
cmp edx, esi
jb 0x5330c4
cmp ecx, ebx
je 0x5330c4
lea ecx, [ebp - 0x2c]
call fcn.00444c30
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
lea eax, [ecx + esi]
jmp 0x5330c9
mov eax, 0x73a7f4
mov al, byte [eax]
cmp al, 0x5c
je 0x5330ef
cmp al, 0x2f
je 0x5330ef
cmp al, 0x3a
je 0x5330ef
cmp al, 0x2a
je 0x5330ef
cmp al, 0x3f
je 0x5330ef
cmp al, 0x22
je 0x5330ef
cmp al, 0x3c
je 0x5330ef
cmp al, 0x3e
je 0x5330ef
cmp al, 0x7c
jne 0x533115
cmp edx, esi
jb 0x533107
cmp ecx, ebx
je 0x533107
lea ecx, [ebp - 0x2c]
call fcn.00444c30
mov edx, dword [ebp - 0x28]
lea eax, [edx + esi]
jmp 0x53310c
mov eax, 0x73a7f4
mov byte [eax], 0x5f
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
inc esi
cmp edx, esi
ja 0x5330ad
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
mov cl, ah
mov eax, dword [0x81424c]
test cl, cl
je 0x533270
cmp eax, edi
je 0x5331d7
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x8142c8]
cmp eax, ebx
jne 0x53314d
mov eax, 0x73a7f4
mov esi, dword [0x8142c8]
push ecx
push eax
push 0x83e758
lea edx, [ebp - 0x8ec]
inc esi
push 0x771224
push edx
mov dword [0x8142c8], esi
call fcn.00711e28
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071e49f
add esp, 0x1c
test eax, eax
jne 0x533247
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x8142c8]
cmp eax, ebx
jne 0x53319c
mov eax, 0x73a7f4
mov esi, dword [0x8142c8]
push ecx
push eax
push 0x83e758
lea ecx, [ebp - 0x8ec]
inc esi
push 0x771224
push ecx
mov dword [0x8142c8], esi
call fcn.00711e28
lea edx, [ebp - 0x8ec]
push ebx
push edx
call fcn.0071e49f
add esp, 0x1c
test eax, eax
je 0x53318a
jmp 0x533247
mov eax, dword [0x8142c8]
mov ecx, eax
inc eax
mov dword [0x8142c8], eax
push ecx
push 0x83e758
lea eax, [ebp - 0x8ec]
push 0x771204
push eax
call fcn.00711e28
lea ecx, [ebp - 0x8ec]
push ebx
push ecx
call fcn.0071e49f
add esp, 0x18
test eax, eax
jne 0x533247
mov eax, dword [0x8142c8]
lea edx, [ebp - 0x8ec]
mov ecx, eax
inc eax
push ecx
push 0x83e758
push 0x771204
push edx
mov dword [0x8142c8], eax
call fcn.00711e28
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071e49f
add esp, 0x18
test eax, eax
je 0x53320f
push 0x7711f4
call fcn.0054a300
mov ecx, eax
call fcn.0054a7a0
lea ecx, [ebp - 0x8ec]
push eax
push ecx
mov ecx, dword [0x7a0f18]
call fcn.00410740
jmp 0x5333a8
cmp eax, edi
je 0x533314
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x8142c8]
cmp eax, ebx
jne 0x53328a
mov eax, 0x73a7f4
mov esi, dword [0x8142c8]
push ecx
push eax
push 0x83e758
lea edx, [ebp - 0x8ec]
inc esi
push 0x7711d4
push edx
mov dword [0x8142c8], esi
call fcn.00711e28
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071e49f
add esp, 0x1c
test eax, eax
jne 0x533384
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x8142c8]
cmp eax, ebx
jne 0x5332d9
mov eax, 0x73a7f4
mov esi, dword [0x8142c8]
push ecx
push eax
push 0x83e758
lea ecx, [ebp - 0x8ec]
inc esi
push 0x7711d4
push ecx
mov dword [0x8142c8], esi
call fcn.00711e28
lea edx, [ebp - 0x8ec]
push ebx
push edx
call fcn.0071e49f
add esp, 0x1c
test eax, eax
je 0x5332c7
jmp 0x533384
mov eax, dword [0x8142c8]
mov ecx, eax
inc eax
mov dword [0x8142c8], eax
push ecx
push 0x83e758
lea eax, [ebp - 0x8ec]
push 0x771204
push eax
call fcn.00711e28
lea ecx, [ebp - 0x8ec]
push ebx
push ecx
call fcn.0071e49f
add esp, 0x18
test eax, eax
jne 0x533384
mov eax, dword [0x8142c8]
lea edx, [ebp - 0x8ec]
mov ecx, eax
inc eax
push ecx
push 0x83e758
push 0x771204
push edx
mov dword [0x8142c8], eax
call fcn.00711e28
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071e49f
add esp, 0x18
test eax, eax
je 0x53334c
push 0x7711f4
call fcn.0054a300
mov ecx, eax
call fcn.0054a7a0
lea ecx, [ebp - 0x8ec]
push eax
push ecx
mov ecx, dword [0x7a0f18]
call fcn.004116c0
lea edi, [ebp - 0x8ec]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
mov dl, byte [ebp - 0x39]
push 1
not ecx
dec ecx
mov byte [ebp - 0x1c], dl
mov ebx, ecx
lea ecx, [ebp - 0x1c]
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.004219e0
test al, al
je 0x5333ff
mov edi, dword [ebp - 0x18]
mov ecx, ebx
mov eax, ecx
lea esi, [ebp - 0x8ec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
xor esi, esi
mov byte [ecx + ebx], 0
mov edi, 0x76b78c
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x73a7f0]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 4], 1
mov edi, ecx
mov ecx, dword [ebp - 0x14]
sub edx, ecx
cmp edx, edi
ja 0x533428
call fcn.00704fbb
cmp edi, esi
jbe 0x5334b7
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
lea ebx, [eax + edi]
call fcn.00421d80
cmp eax, ebx
jae 0x533447
call fcn.00704fbb
mov edx, dword [ebp - 0x18]
cmp edx, esi
je 0x53346d
mov al, byte [edx - 1]
test al, al
je 0x53346d
cmp al, 0xff
je 0x53346d
cmp ebx, esi
jne 0x533485
dec al
push esi
lea ecx, [ebp - 0x1c]
mov byte [edx - 1], al
call fcn.00420200
jmp 0x5334b7
cmp ebx, esi
jne 0x533480
cmp edx, esi
je 0x5334be
push esi
lea ecx, [ebp - 0x1c]
call fcn.004219c0
jmp 0x5334b7
cmp dword [ebp - 0x10], ebx
jae 0x533491
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00421d90
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov esi, 0x76b78c
push ebx
lea edi, [edx + eax]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c]
call fcn.004219c0
xor esi, esi
mov eax, dword [ebp - 0x18]
cmp eax, esi
jne 0x5334c3
mov eax, 0x73a7f4
push esi
push esi
push 0xff00
push eax
push 1
mov ecx, 0x7dabc0
call fcn.00512f20
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x5334fa
mov al, byte [ecx - 1]
test al, al
je 0x5334f0
cmp al, 0xff
je 0x5334f0
dec al
mov byte [ecx - 1], al
jmp 0x5334fa
dec ecx
push ecx
call fcn.00703996
add esp, 4
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], esi
cmp ecx, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
je 0x533535
mov al, byte [ecx - 1]
test al, al
je 0x53352b
cmp al, 0xff
je 0x53352b
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
dec ecx
push ecx
call fcn.00703996
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret