Function at 0x4656f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov ebx, edx
cmp edi, 0x8000
mov dword [esp + 0x10], ebx
mov ebp, ecx
je 0x465721
call dword [sym.imp.USER32.dll_GetCapture]
mov ecx, dword [0x51da28]
cmp eax, ecx
jne 0x4657ef
jmp 0x465727
mov ecx, dword [0x51da28]
cmp ebp, ecx
jne 0x4657ef
cmp ebx, 0x200
jb 0x4657ef
cmp ebx, 0x209
ja 0x4657ef
mov esi, dword [esp + 0x30]
mov ebp, ecx
mov edx, esi
shr edx, 0x10
movsx eax, si
movsx edx, dx
test eax, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
jl 0x4657f3
test edx, edx
jl 0x4657f3
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_ChildWindowFromPoint]
cmp edi, 0x8000
mov ebp, eax
jne 0x4657e3
mov edi, dword [sym.imp.USER32.dll_GetActiveWindow]
call edi
mov ecx, dword [0x51da28]
cmp eax, ecx
je 0x46579f
call edi
mov ecx, dword [0x51da28]
mov ebp, eax
mov edi, dword [esp + 0x2c]
test ebp, ebp
je 0x4657eb
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
lea ecx, [esp + 0x20]
push ecx
push ebp
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [0x51da28]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
and eax, 0xffff
and edx, 0xffff
shl eax, 0x10
or eax, edx
mov dword [esp + 0x30], eax
jmp 0x4657ef
mov ecx, dword [0x51da28]
jmp 0x4657a3
mov ebp, ecx
jmp 0x4657f3
mov esi, dword [esp + 0x30]
cmp ebx, 0xa9
ja 0x465865
cmp ebx, 0xa0
jae 0x46582a
cmp ebx, 0x20
jne 0x46598e
mov eax, dword [0x51da3c]
test eax, eax
je case.default.0x465b1c
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8
cmp ebp, ecx
jne 0x465839
xor edi, edi
xor ebx, ebx
xor esi, esi
jmp 0x465965
movsx eax, si
shr esi, 0x10
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
movsx edx, si
push eax
push ecx
mov dword [esp + 0x2c], edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor esi, esi
jmp 0x465965
cmp ebx, 0x200
jb 0x46598e
cmp ebx, 0x209
ja 0x46598e
movsx edi, si
shr esi, 0x10
movsx ebx, si
mov esi, dword [0x520ec8]
mov dword [esp + 0x1c], ebx
test esi, esi
je 0x4658f7
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x40]
mov eax, dword [esi]
mov dword [esp + 0x14], ecx
mov ecx, esi
mov dword [esp + 0x18], edx
call dword [eax + 0x24]
cmp eax, ebp
je 0x4658b3
cmp dword [esi + 4], 3
jne 0x4658d3
mov edx, dword [esp + 0x14]
lea eax, [edx + edi]
test eax, eax
jl 0x4658d3
cmp eax, dword [esi + 0x30]
jge 0x4658d3
mov ecx, dword [esp + 0x18]
lea eax, [ecx + ebx]
test eax, eax
jl 0x4658d3
cmp eax, dword [esi + 0x34]
jl 0x4658e9
mov esi, dword [esi + 8]
mov eax, dword [0x520ec8]
cmp esi, eax
je 0x4658e5
test esi, esi
je 0x4658f1
jmp 0x465894
xor esi, esi
jmp 0x4658f1
add edi, edx
add ebx, ecx
test esi, esi
jne 0x465934
mov ecx, dword [0x51da28]
cmp ebp, ecx
je 0x465934
movsx eax, word [esp + 0x30]
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x20]
push edx
push ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [0x51da28]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor esi, esi
cmp dword [esp + 0x10], 0x200
je 0x465965
mov dword [0x520618], edi
mov dword [0x52061c], ebx
mov dword [0x520608], esi
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [0x5205f8], eax
mov dword [0x5205bc], 1
mov dword [0x5205d0], edi
mov dword [0x5205d4], ebx
mov dword [0x5205c8], esi
call dword [sym.imp.USER32.dll_GetMessageTime]
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x2c]
mov dword [0x520620], eax
cmp ebx, 0x201
ja 0x465b0d
je 0x465af9
lea eax, [ebx - 0xa2]
cmp eax, 0x64
ja case.default.0x465b1c
xor edx, edx
mov dl, byte [eax + 0x465be8]
jmp dword [edx*4 + 0x465bcc]
mov eax, dword [0x5205d8]
test esi, 0x40000000
je 0x4659cf
or al, 0x10
jmp 0x4659d1
and al, 0xef
mov dword [0x5205d8], eax
mov eax, dword [0x5205c4]
mov ecx, eax
xor ecx, edi
pop edi
and ecx, 0xff
pop esi
xor eax, ecx
pop ebp
mov dword [0x5205c4], eax
pop ebx
add esp, 0x18
ret 8
cmp edi, 3
jne 0x465a08
push str.User_break_key_has_been_pressed.
call fcn.00461cf0
add esp, 4
mov eax, dword [0x5205d8]
test esi, 0x40000000
je 0x465a19
or al, 0x10
jmp 0x465a1b
and al, 0xef
shl edi, 8
mov dword [0x5205d8], eax
mov dword [0x5205c4], edi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x10
call esi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
jne 0x465a4f
push 0x10
call edi
test ah, 0x80
mov dword [esp + 0x2c], 0
je 0x465a57
mov dword [esp + 0x2c], 1
push 0x11
call esi
test ah, 0x80
jne 0x465a71
push 0x11
call edi
test ah, 0x80
mov dword [esp + 0x30], 0
je 0x465a79
mov dword [esp + 0x30], 1
push 0x12
call esi
test ah, 0x80
jne 0x465a8f
push 0x12
call edi
test ah, 0x80
jne 0x465a8f
xor ebx, ebx
jmp 0x465a94
mov ebx, 1
push 0xa5
call esi
test ah, 0x80
jne 0x465ab0
push 0xa5
call edi
test ah, 0x80
jne 0x465ab0
xor eax, eax
jmp 0x465ab5
mov eax, 1
neg al
sbb eax, eax
mov ecx, dword [esp + 0x2c]
and eax, 8
pop edi
neg bl
sbb ebx, ebx
xor edx, edx
and ebx, 2
pop esi
or eax, ebx
mov bl, byte [esp + 0x28]
test bl, bl
setne dl
or eax, edx
pop ebp
neg cl
sbb ecx, ecx
pop ebx
and ecx, 4
or eax, ecx
mov ecx, dword [0x5205d8]
and ecx, 0x10
or eax, ecx
mov dword [0x5205d8], eax
add esp, 0x18
ret 8
pop edi
pop esi
pop ebp
mov dword [0x52062c], 3
pop ebx
add esp, 0x18
ret 8
lea eax, [ebx - 0x202]
cmp eax, 7
ja case.default.0x465b1c
jmp dword [eax*4 + 0x465c50]
pop edi
pop esi
pop ebp
mov dword [0x52062c], 5
pop ebx
add esp, 0x18
ret 8
mov eax, dword [0x52062c]
pop edi
and al, 0xf6
pop esi
pop ebp
mov dword [0x52062c], eax
pop ebx
add esp, 0x18
ret 8
pop edi
pop esi
pop ebp
mov dword [0x520634], 5
pop ebx
add esp, 0x18
ret 8
pop edi
pop esi
pop ebp
mov dword [0x520634], 3
pop ebx
add esp, 0x18
ret 8
mov eax, dword [0x520634]
pop edi
and al, 0xf6
pop esi
pop ebp
mov dword [0x520634], eax
pop ebx
add esp, 0x18
ret 8
pop edi
pop esi
pop ebp
mov dword [0x520630], 5
pop ebx
add esp, 0x18
ret 8
pop edi
pop esi
pop ebp
mov dword [0x520630], 3
pop ebx
add esp, 0x18
ret 8
mov eax, dword [0x520630]
and al, 0xf6
mov dword [0x520630], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 8