Function at 0x4527a0
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push esi
mov esi, ecx
mov eax, esi
mov ecx, dword [eax + 0xf8]
test ecx, ecx
jne 0x4527ee
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jne 0x4527a6
xor ebp, ebp
push edi
mov ecx, esi
call fcn.00450e10
mov edi, eax
test edi, edi
je 0x452809
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x120]
test eax, eax
je 0x452809
mov eax, dword [edi + 0x64]
test eax, eax
je 0x452809
pop edi
pop esi
mov eax, 2
pop ebp
ret 8
mov ebp, dword [eax + 0xf8]
test ebp, ebp
je 0x4527c0
mov eax, dword [ebp + 0x58]
test eax, eax
je 0x4527c0
pop esi
mov eax, 2
pop ebp
ret 8
mov eax, dword [esi + 0x120]
test eax, eax
jg 0x4529ad
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, esi
call fcn.00450e10
mov eax, dword [eax + 0x1c]
push esi
lea edx, [esp + 0x14]
push edx
push 0x285a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
call fcn.0051af31
test eax, eax
je 0x4529ad
mov ecx, dword [esi + 0xc0]
push ecx
mov ecx, esi
call fcn.0044f650
mov edi, eax
test edi, edi
je 0x452891
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x6c]
test eax, eax
je 0x452891
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 0xcc]
cmp eax, 1
je 0x45294e
cmp eax, 2
je 0x45294e
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x4529ad
mov eax, dword [esp + 0x10]
add eax, 0xfffffff7
cmp eax, 0x17
ja case.0x4528b3.10
movzx eax, byte [eax + 0x452bec]
jmp dword [eax*4 + 0x452bd8]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
push 0x11
call edi
test ax, ax
jge 0x452906
test ebp, ebp
je 0x452906
mov ecx, esi
call fcn.0044e8e0
mov ebx, eax
push ebx
push 0x57eee8
call fcn.00503c61
add esp, 8
test eax, eax
je 0x452906
push 0x10
call edi
xor ecx, ecx
test ax, ax
setge cl
lea ecx, [ecx + ecx - 1]
push ecx
push ebx
mov ecx, ebp
call fcn.00457e10
test eax, eax
jne 0x452948
mov ebx, dword [esi]
push 0x10
call edi
xor edx, edx
test ax, ax
setl dl
mov ecx, esi
push edx
call dword [ebx + 0x1b4]
mov eax, dword [esi + 0xc0]
push eax
mov ecx, esi
call fcn.0044f650
mov esi, eax
test esi, esi
je 0x452948
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc8]
test eax, eax
je 0x452948
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x68]
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
push 5
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
push 4
mov ecx, esi
call dword [eax + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0xec]
test eax, eax
jne case.0x4528b3.10
mov ecx, esi
call fcn.0044e910
mov ecx, eax
call fcn.00457680
mov ecx, esi
call fcn.00450e10
mov ecx, dword [eax + 0x1c]
push 0x20
push 0xf100
push 0x112
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov edi, dword [sym.imp.USER32.dll_GetFocus]
call edi
test eax, eax
je 0x4529d9
call edi
mov edx, dword [esi + 0x1c]
push eax
push edx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x4527e3
mov eax, dword [esi + 0xf4]
test eax, eax
je 0x4529ff
cmp eax, 1
je 0x4529ff
cmp eax, 4
je 0x4529ff
cmp eax, 5
jne 0x4529fb
cmp dword [esi + 0xec], 1
je 0x4529ff
xor edi, edi
jmp 0x452a04
mov edi, 1
mov ecx, esi
call fcn.0044ec20
mov edx, dword [esp + 0x10]
lea ecx, [edx - 0x23]
cmp ecx, 5
ja case.default.0x452a1b
jmp dword [ecx*4 + 0x452c04]
test edi, edi
je 0x452a40
mov edx, dword [esi]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
push eax
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
xor edx, edx
test eax, eax
setne dl
mov ecx, esi
add edx, 2
mov eax, edx
mov edx, dword [esi]
push eax
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
test edi, edi
je 0x452a7b
mov edx, dword [esi]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
push eax
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
neg eax
sbb eax, eax
add eax, 3
push eax
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
xor ecx, ecx
test edi, edi
setne cl
inc ecx
push ecx
mov ecx, esi
call dword [eax + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
neg edi
sbb edi, edi
and edi, 3
push edi
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
push 6
mov ecx, esi
call dword [eax + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
push 7
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
test edx, edx
je 0x452bcd
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x452bcd
mov ecx, esi
call fcn.00456650
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x452b32
push 0x11
call edi
test ax, ax
jl 0x452b32
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.00452490
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
test ebp, ebp
je 0x452b5c
push esi
push 0x57eee8
call fcn.00503c61
add esp, 8
test eax, eax
je 0x452b5c
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.0045a020
test eax, eax
jne 0x4529ad
push 0x11
mov dword [esp + 0x18], 0
call edi
test ax, ax
jl 0x452bb7
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.00451c90
mov edi, eax
cmp edi, 0xffffffff
je 0x452bb7
mov edx, dword [esi]
push 2
push edi
mov ecx, esi
call dword [edx + 0x13c]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x452bac
push edi
mov ecx, esi
call fcn.0044f650
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xa8]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov eax, dword [esp + 0x10]
cmp eax, 0x10
je 0x452bcd
cmp eax, 0x11
je 0x452bcd
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8