Function at 0xb569d8
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x10
mov eax, 0xbc9c58
call fcn.00bc132b
mov esi, ecx
mov dword [ebp - 0x18], esi
test esi, esi
je 0xb569f1
lock inc dword [esi + 0x10]
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], ecx
cmp edi, 0x82
je 0xbdf675
mov eax, 0x113
cmp edi, eax
ja 0xb56aab
je 0xbdf830
cmp edi, 0x3d
jbe 0xb56a87
cmp edi, 0x4e
je 0xbdf80f
cmp edi, 0xff
ja 0xbdf755
mov eax, dword [0xd08c6c]
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0xbdf8e1
test eax, eax
je 0xbdf789
push dword [ebp + 0x14]
mov ecx, eax
push dword [ebp + 0x10]
push edi
push ebx
call dword [0xd0cffc]
call dword [ebp - 0x14]
mov ebx, eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
test esi, esi
je 0xb56a7d
and dword [ebp - 0x18], 0
lock xadd dword [esi + 0x10], eax
dec eax
je 0xbdf8fd
mov eax, ebx
call fcn.00bc12da
ret 0x14
je 0xbdf6ac
mov eax, edi
sub eax, 7
je 0xbdf697
sub eax, 1
je 0xbdf68b
sub eax, 7
jne 0xb56a35
jmp 0xbdf841
mov eax, edi
sub eax, 0x200
je 0xbdf8ce
sub eax, 1
je 0xbdf8bf
sub eax, 1
je 0xbdf88f
dec eax
sub eax, 1
je 0xbdf871
sub eax, 1
je 0xbdf862
sub eax, 0x9e
je 0xbdf850
sub eax, 0x75
jne 0xb56a35
jmp 0xbdf841
push dword [ebp + 0x18]
mov edx, 0xb54ba0
mov ecx, ebx
call fcn.00b7e6c6
xor ecx, ecx
jmp 0xb56a08
mov ecx, esi
call fcn.00c5c8ee
jmp 0xb56a35
mov ecx, esi
call fcn.00c5c8ee
push ecx
push ecx
push dword [esi + 0x30]
mov byte [esi + 0x4f], 1
jmp 0xbdf8d5
cmp dword [ebp + 0x14], 0xfffffffc
jne 0xb56a35
cmp dword [esi + 0xbc], ecx
jne 0xbdf73c
mov dword [ebp - 0x14], ecx
xor ebx, ebx
lea ecx, [ebp - 0x14]
inc ebx
mov byte [ebp - 4], bl
call fcn.00b8ba6f
lea eax, [ebp - 0x14]
push eax
push 0xb320a0
push 0xfffffffffffffffc
push 0xb2c334
push dword [ebp + 8]
call dword [sym.imp.OLEACC.dll_CreateStdAccessibleProxyW]
test eax, eax
js 0xbdf730
push 0xb28bd8
push 0x24
call fcn.00bc1282
pop ecx
pop ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 2
test eax, eax
je 0xbdf715
push ebx
push esi
push dword [ebp - 0x14]
mov ecx, eax
call fcn.00c5c795
mov edi, eax
jmp 0xbdf717
xor edi, edi
mov byte [ebp - 4], bl
mov eax, dword [esi + 0xbc]
test eax, eax
je 0xbdf72a
push eax
call fcn.00cdbe40
mov dword [esi + 0xbc], edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.00b8ba6f
push dword [esi + 0xbc]
push dword [ebp + 0x10]
push 0xb46f48
call dword [sym.imp.OLEACC.dll_LresultFromObject]
jmp 0xb56a61
cmp edi, 0x102
jbe 0xbdf76c
lea eax, [edi - 0x104]
cmp eax, 2
ja 0xb56a35
cmp edi, 0x101
jne 0xbdf790
cmp dword [ebp + 0x10], 0x20
je 0xbdf780
cmp dword [ebp + 0x10], 0xd
jne 0xbdf7b9
push 1
mov ecx, esi
call fcn.00c5c91f
xor ebx, ebx
jmp 0xb56a63
cmp edi, 0x100
je 0xbdf7a0
cmp edi, 0x104
jne 0xbdf7b9
cmp dword [ebp + 0x10], 0x5d
je 0xbdf7e8
cmp dword [ebp + 0x10], 0x79
jne 0xbdf7b9
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0xbdf7e8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push edi
push dword [esi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetParent]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
test eax, eax
je 0xbdf789
push dword [ebp + 0x14]
mov edx, edi
mov ecx, ebx
push dword [ebp + 0x10]
call fcn.00cac4ef
jmp 0xb56a61
push 3
pop eax
cmp dword [esi + 0x24], eax
je 0xbdf800
push 0
push 0
push dword [esi + 0x30]
mov dword [esi + 0x24], eax
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
push ecx
push ecx
push ebx
mov ecx, esi
call fcn.00c5dc2c
jmp 0xbdf789
mov eax, dword [ebp + 0x14]
mov ebx, ecx
cmp dword [eax + 8], 0xfffffdf7
jne 0xb56a63
push dword [ebp + 8]
mov ecx, esi
call fcn.00c5e223
jmp 0xb56a61
push ecx
push dword [ebp + 0x10]
mov ecx, esi
push ebx
call fcn.00c5e154
jmp 0xb56a61
push ecx
push ecx
push ebx
mov ecx, esi
call fcn.00c5dff1
jmp 0xb56a61
push ecx
push ecx
mov byte [esi + 0x50], cl
mov ecx, esi
push ebx
call fcn.00c5db26
jmp 0xb56a35
push ecx
push ecx
push ebx
mov ecx, esi
call fcn.00c5dc2c
jmp 0xb56a61
push 3
pop eax
cmp dword [esi + 0x24], eax
je 0xbdf887
push ecx
push ecx
push dword [esi + 0x30]
mov dword [esi + 0x24], eax
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
xor ebx, ebx
inc ebx
jmp 0xb56a63
xor ebx, ebx
inc ebx
cmp dword [esi + 0x24], ebx
je 0xbdf8a5
push ecx
push ecx
push dword [esi + 0x30]
mov dword [esi + 0x24], ebx
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [ebp + 8]
jne 0xb56a63
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0xb56a63
push ecx
push ecx
push ebx
mov ecx, esi
call fcn.00c5da64
jmp 0xb56a61
push ecx
push ecx
mov byte [esi + 0x50], 1
push ebx
mov ecx, esi
call fcn.00c5db9a
jmp 0xb56a35
mov edx, 0x19d
mov ecx, 0xd08c6c
call fcn.00b7ea9a
mov eax, dword [0xd08c6c]
mov dword [ebp - 0x14], eax
jmp 0xb56a46
mov ecx, esi
call fcn.00c5c7e7
push esi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb56a7d