Function at 0x5f1ca4
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5f1f48
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dl, byte [eax + 0x2c]
je 0x5f1f32
mov ecx, dword [ebp - 4]
mov eax, edx
mov byte [ecx + 0x2c], al
test al, al
je 0x5f1df4
call sub.user32.dll_GetFocus
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], ebx
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x5f1d0e
mov eax, dword [ebp - 4]
call fcn.005f0dcc
mov eax, dword [eax + 0xe0]
call fcn.0046fb3c
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0xec]
push eax
push 0x30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SendMessageA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x17], 0
jne 0x5f1d40
mov dl, 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.005f1928
push 0x40
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
sub ecx, eax
push ecx
push edx
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_SetWindowPos
mov eax, dword [ebp - 4]
mov edx, dword [0x5c6de0]
call fcn.00403f38
test al, al
je 0x5f1d98
mov eax, dword [ebp - 4]
call fcn.005f0e24
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x30]
mov edx, dword [ebp - 4]
call dword [eax + 0x264]
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 1
xor eax, eax
push ebp
push 0x5f1ddc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 0x8c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f1de3
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 0
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x5f1e06
push 0
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
call fcn.005f0dcc
cmp byte [eax + 0x140], 0
jne 0x5f1ede
call fcn.005bab00
test eax, eax
je 0x5f1e3f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00465f68
call fcn.0048046c
mov ebx, eax
call fcn.005bab00
cmp ebx, eax
je 0x5f1e43
xor ebx, ebx
jmp 0x5f1e45
mov bl, 1
test bl, bl
je 0x5f1e50
mov al, 1
call fcn.005f1ba0
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x3c]
test esi, esi
jbe 0x5f1e72
push esi
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f1e72
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.user32.dll_SetFocus
jmp 0x5f1ecb
mov eax, dword [ebp - 4]
call fcn.005f0dcc
mov eax, dword [eax + 0xe0]
call fcn.0046fb3c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f1eaa
mov eax, dword [ebp - 4]
call fcn.005f0dcc
mov eax, dword [eax + 0xe0]
call fcn.0046fb3c
push eax
call sub.user32.dll_SetFocus
jmp 0x5f1ecb
push 2
mov eax, dword [ebp - 4]
call fcn.005f0dcc
mov eax, dword [eax + 0xe0]
call fcn.0046fb3c
push eax
call sub.user32.dll_GetWindow
push eax
call sub.user32.dll_SetFocus
test bl, bl
je 0x5f1ed6
xor eax, eax
call fcn.005f1ba0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x3c], edx
mov eax, dword [ebp - 4]
call fcn.005f0dcc
cmp byte [eax + 0x33], 0
je 0x5f1f32
push 0x1b
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5f1f10
push 0x11
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jl 0x5f1f10
push 0x12
call sub.user32.dll_GetAsyncKeyState
test ax, ax
jge 0x5f1f32
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xc4]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5f1f4f
lea eax, [ebp - 0x18]
call fcn.00404ca0
ret