Function at 0x5061f0
Capabilities:
Access peb ldr_data
Log keystrokes

Disassembly:
push 0xffffffffffffffff
push 0x5e8d79
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x65f810]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, dword [0x66dd30]
mov edx, dword [eax + 0xc]
mov ecx, 0x66dd30
mov dword [esp + 0x24], ebx
call edx
mov esi, dword [esp + 0x2c]
add eax, 0x10
mov dword [esi], eax
mov eax, dword [esp + 0x30]
movzx edx, ax
mov dword [esp + 0x24], ebx
lea ecx, [edx - 0xd]
mov ebx, 1
mov dword [esp + 0x10], ebx
cmp ecx, 0x20
ja case.0x506261.14
movzx ecx, byte [ecx + 0x5064b0]
jmp dword [ecx*4 + 0x506480]
push 0x5ff40c
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.Enter
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push 0x5ff400
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.Down
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.Left
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.Right
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.Home
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push 0x5ff3dc
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.PageUp
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.PageDown
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
push str.Insert
mov ecx, esi
call fcn.004709f0
jmp case.0x506456.40
cmp ax, 0x30
jb 0x506333
cmp word [edi + 0x12a], 0x39
jbe 0x50633c
lea ecx, [eax - 0x41]
cmp cx, 0x19
ja 0x50636b
mov byte [esp + 0x30], al
lea eax, [esp + 0x30]
mov byte [esp + 0x31], 0
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x506350
sub eax, edx
push eax
lea edx, [esp + 0x34]
push edx
mov ecx, esi
call fcn.0046aad0
jmp case.0x506456.40
lea ecx, [eax - 0x70]
cmp cx, 8
ja 0x5063fb
push ebx
push 0x46
lea ecx, [esp + 0x20]
call fcn.00505de0
mov dl, byte [edi + 0x12a]
sub dl, 0x3f
movzx ecx, dl
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x30], ebx
call fcn.00505e90
add esp, 0xc
push eax
mov ecx, esi
mov byte [esp + 0x28], 2
call fcn.004ddaa0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5063d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg case.0x506456.40
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp case.0x506456.40
cmp ax, 0x79
jne 0x50640f
push 0x5ff3bc
mov ecx, esi
call fcn.00505f80
jmp case.0x506456.40
cmp ax, 0x7a
jne 0x506423
push 0x5ff3b8
mov ecx, esi
call fcn.00505f80
jmp case.0x506456.40
cmp ax, 0x7b
jne 0x506437
push 0x5ff3b4
mov ecx, esi
call fcn.00505f80
jmp case.0x506456.40
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov byte [esp + 0x30], al
movsx eax, al
add eax, 0xffffffd9
cmp eax, 0x39
ja case.0x506456.40
movzx ecx, byte [eax + 0x5064dc]
jmp dword [ecx*4 + 0x5064d4]
mov edx, dword [esp + 0x30]
push edx
mov ecx, esi
call fcn.00505f60
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret 8