Function at 0x5b0be0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x7a1264]
push esi
test eax, eax
mov eax, dword [0x7a1254]
push edi
mov esi, ecx
je 0x5b0bfd
mov eax, dword [0x7a1250]
dec eax
je 0x5b1045
dec eax
je 0x5b0caa
sub eax, 2
jne 0x5b10b7
mov eax, dword [esi + 0x298]
test eax, eax
jne 0x5b10b7
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x5b0c43
fld dword [0x78c918]
mov edx, dword [esi + 0xb8]
fstp dword [edx + 0x4c]
push 0x10
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x5b0c5c
mov edx, dword [esi + 0xb8]
mov dword [edx + 0x44], 0xc2480000
cmp dword [0x83e068], 1
je 0x5b10b7
mov eax, dword [esi + 0x294]
test eax, eax
je 0x5b10b7
push 0x10
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
jne 0x5b10b7
push 0x11
call edi
xor edx, edx
mov dl, ah
test dl, dl
jne 0x5b10b7
mov eax, dword [esi + 0xb8]
pop edi
pop esi
mov dword [eax + 0x48], 0
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
jne 0x5b0de5
push 0x10
call edi
xor edx, edx
mov dl, ah
test dl, dl
jne 0x5b0de5
push 4
mov ecx, esi
call fcn.00532d50
mov eax, dword [esi + 0x298]
test eax, eax
je 0x5b0d3e
mov ecx, dword [esi + 0xb8]
movsx eax, word [esi + 0x2a2]
fld dword [ecx + 0x48]
fiadd dword [0x7a123c]
mov dword [ebp - 4], eax
fisub dword [esi + 0xc4]
fild dword [ebp - 4]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 1
je 0x5b0d17
fstp st(0)
fld dword [ebp - 4]
movsx edx, word [esi + 0x2a4]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 0x41
jne 0x5b0d36
fstp st(0)
fld dword [ebp - 4]
fstp dword [ecx + 0x48]
jmp 0x5b0dd0
mov eax, dword [esi + 0x294]
test eax, eax
jne 0x5b0dae
push 6
mov ecx, 0x83a9e0
call fcn.006d58f0
test eax, eax
jne 0x5b0dae
mov ecx, dword [esi + 0xb8]
fld dword [ecx + 0x48]
fiadd dword [0x7a123c]
fisub dword [esi + 0xc4]
fld dword [esi + 0x2cc]
fsub dword [0x74955c]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 1
je 0x5b0d8b
fstp st(0)
fld dword [ebp - 4]
fld dword [esi + 0x2cc]
fadd dword [0x74955c]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 0x41
jne 0x5b0da9
fstp st(0)
fld dword [ebp - 4]
fstp dword [ecx + 0x48]
jmp 0x5b0dd0
mov eax, dword [0x7a123c]
mov ecx, dword [esi + 0xc4]
sub eax, ecx
push ecx
mov ecx, dword [esi + 0xb8]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp dword [esp]
call fcn.00536e60
mov ecx, dword [esi + 0xb8]
push ecx
fld dword [ecx + 0x48]
fstp dword [esp]
call fcn.0041bf60
add esp, 4
push 0x12
call edi
xor edx, edx
mov dl, ah
test dl, dl
jne 0x5b0f10
push 0x10
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x5b0f10
mov eax, dword [0x7a1240]
mov edx, dword [esi + 0xc8]
sub eax, edx
mov dword [ebp - 4], 0x41200000
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x294]
test eax, eax
je 0x5b0e32
mov dword [ebp - 4], 0x42280000
mov edx, dword [esi + 0xb8]
fld dword [edx + 0x44]
fisub dword [ebp - 8]
fstp dword [0x78c91c]
mov eax, dword [esi + 0x298]
test eax, eax
je 0x5b0e90
movsx eax, word [esi + 0x2aa]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld dword [0x78c91c]
fcomp st(1)
fnstsw ax
test ah, 1
je 0x5b0e7f
fstp dword [0x78c91c]
movsx ecx, word [esi + 0x2a8]
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
jmp 0x5b0ee8
movsx ecx, word [esi + 0x2a8]
fstp st(0)
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
jmp 0x5b0ee8
fld dword [0x74979c]
fsub dword [ebp - 4]
fld dword [0x78c91c]
fcomp st(1)
fnstsw ax
test ah, 1
je 0x5b0eb0
fstp dword [0x78c91c]
jmp 0x5b0eb2
fstp st(0)
push 0x11
call edi
xor edx, edx
mov dl, ah
test dl, dl
je 0x5b0edf
mov eax, dword [esi + 0xb8]
fld dword [eax + 0x4c]
fcomp dword [0x78c914]
fnstsw ax
test ah, 0x41
je 0x5b0edf
fld dword [ebp - 4]
fsub dword [0x749798]
jmp 0x5b0ee8
fld dword [ebp - 4]
fsub dword [0x7497f8]
fld dword [0x78c91c]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x5b0eff
fstp dword [0x78c91c]
jmp 0x5b0f01
fstp st(0)
fld dword [0x78c91c]
mov ecx, dword [esi + 0xb8]
fstp dword [ecx + 0x44]
push 0x11
call edi
xor edx, edx
mov dl, ah
test dl, dl
je 0x5b10b7
mov eax, dword [esi + 0xb8]
mov ecx, dword [esi + 0xc8]
fld dword [eax + 0x4c]
mov eax, dword [0x7a1240]
sub eax, ecx
mov ecx, dword [0x78c918]
cdq
sub eax, edx
mov dword [ebp - 4], ecx
sar eax, 1
mov dword [ebp - 8], eax
fisub dword [ebp - 8]
fstp dword [0x78c920]
mov eax, dword [esi + 0x294]
test eax, eax
je 0x5b0f63
mov edx, dword [0x78c914]
mov dword [ebp - 4], edx
mov eax, dword [esi + 0x298]
test eax, eax
je 0x5b0fd3
movsx eax, word [esi + 0x29c]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld dword [0x78c920]
fcomp st(1)
fnstsw ax
test ah, 1
je 0x5b0f91
fstp dword [0x78c920]
jmp 0x5b0f93
fstp st(0)
movsx ecx, word [esi + 0x29e]
movsx edx, word [esi + 0x29c]
add ecx, edx
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
fld dword [0x78c920]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x5b102e
fstp dword [0x78c920]
fld dword [0x78c920]
mov edx, dword [esi + 0xb8]
pop edi
fstp dword [edx + 0x4c]
pop esi
mov esp, ebp
pop ebp
ret
push 5
mov ecx, 0x83a9e0
call fcn.006d58f0
test eax, eax
jne 0x5b1030
fld dword [0x78c920]
fcomp dword [0x78c910]
fnstsw ax
test ah, 1
je 0x5b1000
mov eax, dword [0x78c910]
mov dword [0x78c920], eax
fld dword [0x78c920]
fcomp dword [ebp - 4]
fnstsw ax
test ah, 0x41
jne 0x5b1030
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x78c920], ecx
mov edx, dword [esi + 0xb8]
fld dword [0x78c920]
fstp dword [edx + 0x4c]
pop esi
mov esp, ebp
pop ebp
ret
fstp st(0)
fld dword [0x78c920]
mov edx, dword [esi + 0xb8]
pop edi
fstp dword [edx + 0x4c]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x7dadcc]
test eax, eax
je 0x5b105a
push 0x12
mov ecx, 0x7dabc0
call fcn.00509b10
mov eax, dword [esi]
push 0
push 0
push 0
push 0x12
mov ecx, esi
call dword [eax + 0x18]
mov edx, dword [esi]
push 0
push 0
push 0
push 0x47
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [0x7a123c]
mov dword [esi + 0xcc], eax
mov ecx, dword [0x7a1240]
mov dword [esi + 0xd0], ecx
mov eax, dword [0x83e068]
cmp eax, 1
jne 0x5b10b7
mov ecx, dword [0x7dada8]
test ecx, ecx
je 0x5b10b7
mov edx, dword [ecx]
push 0
push 0
push 0
push 8
push 0x29
push 0
call dword [edx + 0x90]
pop edi
pop esi
mov esp, ebp
pop ebp
ret