Function at 0x501d8e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, 0x5899c8
cmp dword [0x55a3c0], 0
je 0x50214c
cmp dword [0x55a3ec], 0
je 0x50214c
movzx eax, word [ebp + 8]
mov dword [0x5899d0], eax
mov edx, dword [ebp + 8]
shr edx, 0x10
and dx, 0xffff
movzx ecx, dx
mov dword [0x5899d4], ecx
mov eax, dword [0x55b3c0]
mov dword [ebx], eax
jmp 0x501fac
push esi
lea esi, [eax + 0x84c]
mov edi, 0x5899d8
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop esi
inc dword [0x5899e0]
add dword [0x5899e4], 2
mov eax, dword [ebx]
cmp dword [eax + 0x85c], 0
je 0x501fa2
push dword [0x5899d4]
push dword [0x5899d0]
push 0x5899d8
call sub.USER32.dll_PtInRect
test eax, eax
je 0x501fa2
cmp esi, 1
jne 0x501eab
push 0
mov ecx, dword [ebx]
push dword [ecx]
call sub.USER32.dll_GetSystemMenu
mov edi, eax
mov dword [0x5899cc], edi
test edi, edi
jne 0x501e58
push 0
call fcn.0041c2be
jmp 0x501fb6
push 0x5899d0
push dword [0x55a3ec]
call sub.USER32.dll_ClientToScreen
mov dword [0x55a3f8], 1
push 0
mov eax, dword [ebx]
push dword [eax]
push 0
push dword [0x5899d4]
push dword [0x5899d0]
push 0
push dword [0x5899cc]
call sub.USER32.dll_TrackPopupMenu
test eax, eax
jne 0x501e9e
push 0
call fcn.0041c2be
xor edx, edx
mov dword [0x55a3f8], edx
jmp 0x501fb6
cmp dword [0x55b3d4], 0
je 0x501f49
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x501ed8
push 0
push 0
push 0x10
mov ecx, dword [ebx]
push dword [ecx]
call sub.USER32.dll_PostMessageA
jmp 0x501fb6
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x501f16
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x501fb6
mov edx, dword [ebx]
push dword [edx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x501fb6
push 1
mov ecx, dword [ebx]
push dword [ecx]
call fcn.00501b3f
jmp 0x501fb6
mov eax, dword [ebx]
mov edx, dword [eax]
cmp edx, dword [0x55b3d4]
jne 0x501f99
mov ecx, dword [ebx]
push dword [ecx]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x501f99
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x501f99
push 1
mov edx, dword [ebx]
push dword [edx]
call fcn.00501b3f
jmp 0x501fb6
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x501f66
push 0
push 0
push 0x10
mov ecx, dword [ebx]
push dword [ecx]
call sub.USER32.dll_PostMessageA
jmp 0x501fb6
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x501f99
mov eax, dword [ebx]
push dword [eax]
call sub.USER32.dll_IsIconic
test eax, eax
jne 0x501fb6
mov edx, dword [ebx]
push dword [edx]
call sub.USER32.dll_IsWindowVisible
test eax, eax
je 0x501fb6
push 1
mov ecx, dword [ebx]
push dword [ecx]
call fcn.00501b3f
jmp 0x501fb6
push dword [ebx]
call fcn.00501cf0
jmp 0x501fb6
mov eax, dword [ebx]
mov edx, dword [eax + 0x9d8]
mov dword [ebx], edx
mov eax, dword [ebx]
test eax, eax
jne 0x501de2
cmp dword [ebx], 0
jne 0x50214c
test esi, esi
jne 0x502141
push dword [0x55b3cc]
call sub.USER32.dll_UpdateWindow
push dword [0x55b3c8]
call sub.USER32.dll_UpdateWindow
call fcn.00500c40
xor edx, edx
mov dword [0x55a3fc], edx
mov dword [0x55a3f4], 1
push 1
push 0x5899d0
push dword [0x55b3c8]
push dword [0x55a3ec]
call sub.USER32.dll_MapWindowPoints
jmp 0x502117
call sub.USER32.dll_GetActiveWindow
cmp eax, dword [0x55b3c8]
je 0x502052
mov eax, dword [0x55a3fc]
test eax, eax
jle 0x502046
push eax
movzx edx, word [0x5899d0]
movzx ecx, word [0x5899d4]
shl ecx, 0x10
or edx, ecx
push edx
call fcn.004ff114
jmp 0x502117
xor eax, eax
mov dword [0x55a3f4], eax
jmp 0x502117
push 0x209
push 0x100
push dword [0x55b3c8]
lea edx, [ebp - 0x1c]
push edx
call sub.USER32.dll_GetMessageA
dec eax
jne 0x502117
cmp dword [ebp - 0x18], 0x200
jne 0x5020b3
inc dword [0x55a3fc]
cmp dword [0x55a3fc], 1
jne 0x5020a7
push 0
movzx ecx, word [0x5899d0]
movzx eax, word [0x5899d4]
shl eax, 0x10
or ecx, eax
push ecx
call fcn.004ff114
jmp 0x502117
push 0
push dword [ebp - 0x10]
call fcn.004ff114
jmp 0x502117
cmp dword [ebp - 0x18], 0x202
jne 0x5020da
mov eax, dword [0x55a3fc]
test eax, eax
jle 0x5020d0
push eax
push dword [ebp - 0x10]
call fcn.004ff114
jmp 0x502117
xor edx, edx
mov dword [0x55a3f4], edx
jmp 0x502117
mov eax, dword [ebp - 0x18]
cmp eax, 0x100
jb 0x502117
cmp eax, 0x108
ja 0x502117
mov eax, dword [0x55a3fc]
test eax, eax
jle 0x502110
push eax
movzx edx, word [0x5899d0]
movzx ecx, word [0x5899d4]
shl ecx, 0x10
or edx, ecx
push edx
call fcn.004ff114
jmp 0x502117
xor eax, eax
mov dword [0x55a3f4], eax
cmp dword [0x55a3f4], 0
jne 0x502011
push dword [0x55b3cc]
call sub.USER32.dll_UpdateWindow
push dword [0x55b3c8]
call sub.USER32.dll_UpdateWindow
call fcn.00500c40
jmp 0x50214c
dec esi
jne 0x50214c
push dword [ebp + 8]
call fcn.004b836e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8