Function at 0x53a1c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x70f200]
xor eax, esp
mov dword [esp + 0x1c], eax
mov dl, byte [ebp + 8]
push esi
mov esi, ecx
push edi
mov ecx, dword [esi]
call fcn.005c8820
test eax, eax
jne 0x53a1f9
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
lea ecx, [esi + 0x698]
call fcn.005b7750
cmp eax, 4
jne 0x53a278
mov eax, dword [esi]
mov ecx, dword [eax]
lea eax, [ecx + 0x1a]
cmp eax, 0x1a
ja 0x53a256
cmp ecx, 0xfffffffe
je 0x53a256
cmp ecx, 0xfffffff9
je 0x53a256
cmp ecx, 0xfffffff8
je 0x53a256
cmp ecx, 0xfffffff6
je 0x53a256
cmp ecx, 0xfffffff3
je 0x53a256
cmp ecx, 0xfffffff2
je 0x53a256
cmp ecx, 0xffffffee
je 0x53a256
cmp ecx, 0xffffffed
je 0x53a256
cmp ecx, 0xffffffec
je 0x53a256
cmp ecx, 0xffffffe7
je 0x53a256
cmp ecx, 0xfffffff5
je 0x53a256
cmp ecx, 0xffffffea
je 0x53a256
cmp ecx, 0xfffffffa
jne 0x53a278
lea ecx, [esi + 0x698]
call fcn.005b7680
cmp dword [esi + 0x1c64], 0
jne 0x53a278
mov eax, dword [esi]
cmp byte [eax + 0x39], 0
je 0x53a278
mov dword [eax], 0xfffffffa
mov edx, dword [esi]
mov edi, dword [edx + 0x30]
cmp edi, dword [esi + 4]
jne 0x53a29d
mov ecx, dword [esi + 8]
mov eax, dword [edx]
cmp eax, dword [ecx + 0xc]
jne 0x53a2c1
push ecx
mov ecx, dword [esi + 0x20]
xor edx, edx
push 5
push 0
call fcn.005e2950
jmp 0x53a2c1
lea ecx, [esi + 0x940]
call fcn.005b6be0
cmp edi, eax
jne 0x53a2c1
mov edx, dword [edx]
test edx, edx
jle 0x53a2c1
push 1
call fcn.005b6ba0
cmp edx, eax
jne 0x53a2c1
mov byte [esi + 0x40], 1
mov eax, dword [esi + 0x1c64]
test eax, eax
jne 0x53a2d9
cmp dword [esi + 0x1c60], eax
je 0x53a5ca
jmp 0x53a2e2
cmp eax, 6
jg 0x53a5e2
mov eax, dword [esi]
cmp byte [eax + 0x39], 0
jne 0x53a5e2
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call edi
test ax, ax
js 0x53a5ca
push 2
call edi
test ax, ax
js 0x53a5ca
mov eax, dword [esi + 0x1c64]
cmp dword [esi + 0x1c60], eax
jne 0x53a36b
lea ecx, [esi + 0x1c70]
xorps xmm1, xmm1
call fcn.005d05a0
comisd xmm0, xmmword [0x6edbe8]
ja 0x53a35e
lea ecx, [esi + 0x698]
call fcn.005b7750
cmp eax, 4
jne 0x53a35e
lea ecx, [esi + 0x698]
call fcn.005b79b0
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x53a5ca
mov eax, dword [esi + 0x1c60]
inc eax
mov dword [esi + 0x1c64], eax
cmp eax, 6
jg 0x53a5e2
lea ecx, [esi + 0x1c70]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
call fcn.005d05f0
mov eax, dword [esi + 0x1c64]
cmp eax, 1
jne 0x53a428
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x40
push dword [eax + 0x78]
call fcn.005bd3f0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x40
push dword [eax + 0x7c]
call fcn.005bd3f0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x40
push dword [eax + 0x80]
call fcn.005bd3f0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0x40
push dword [eax + 0x90]
call fcn.005bd3f0
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 0
push 0x1330
push dword [eax + 0x64]
call fcn.005befd0
lea eax, [esp + 0xc]
mov ecx, esi
push eax
lea eax, [esp + 0x14]
push eax
push 0
call fcn.00512590
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
push str.This_tab_shows_Potentially_Unwanted_Programs__PUPs__r_nTick_the_ones_you_want_to_delete_from_your_PC_r_n_r_nClick_anywhere_to_close_this_t
jmp 0x53a5b7
cmp eax, 2
jne 0x53a471
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 1
push 0x1330
push dword [eax + 0x64]
call fcn.005befd0
lea eax, [esp + 0xc]
mov ecx, esi
push eax
lea eax, [esp + 0x14]
push eax
push 1
call fcn.00512590
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
push str.This_tab_shows_Autostart_Entries_and_System_Hijacks_r_nTake_a_good_look_at_the_list_and_tick_the_ones_you_want_to_delete_r_n_r_nClick_anywhere_to_close_this_t
jmp 0x53a5b7
cmp eax, 3
jne 0x53a4ba
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 2
push 0x1330
push dword [eax + 0x64]
call fcn.005befd0
lea eax, [esp + 0xc]
mov ecx, esi
push eax
lea eax, [esp + 0x14]
push eax
push 2
call fcn.00512590
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
push str.This_tab_lets_you_cleanup_and_repair_your_Internet_browsers_r_nSelect_the_items_you_want_to_fix_and_the_reset_actions_you_want_to_perform_r_n_r_nClick_anywhere_to_close_this_t
jmp 0x53a5b7
cmp eax, 4
jne 0x53a503
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
push 0
push 3
push 0x1330
push dword [eax + 0x64]
call fcn.005befd0
lea eax, [esp + 0xc]
mov ecx, esi
push eax
lea eax, [esp + 0x14]
push eax
push 3
call fcn.00512590
push 0
push dword [esp + 0x10]
push dword [esp + 0x18]
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
push str.This_tab_lets_you_remove_malware_from_your_system_and_make_some_cleanup_operations_r_nSelect_the_items_you_want_to_delete_and_the_actions_you_want_to_perform_r_n_r_nClick_anywhere_to_close_this_tipTutorial_tip_4_of_6
jmp 0x53a5b7
cmp eax, 5
jne 0x53a55e
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 8]
push dword [eax + 0x50]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push 2
push eax
push 0
call fcn.005c5730
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x18]
push 0x12c0
add eax, 0xa
push eax
mov eax, dword [esp + 0x1c]
add eax, 0x28
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
push str.Select_whether_to_create_a_System_restore_point_prior_to_the_removal_r_nand_whether_to_automatically_reboot__if_needed__after_the_cleanup_r_n_r_nClick_anywhere_to_close_this_t
jmp 0x53a5b7
cmp eax, 6
jne 0x53a5be
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esi + 8]
push dword [eax + 0x40]
call fcn.005c5730
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push 2
push eax
push 0
call fcn.005c5730
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esp + 0x18]
push 0x12c0
add eax, 0x21
push eax
mov eax, dword [esp + 0x1c]
add eax, 0x1e
push eax
push 0xffffffffffffffff
push 0xffffffffffffffff
push 4
push str.Finally__press_the__Clean__button_and_confirm_r_nThe_items_you_selected_will_then_be_fixed_r_n_r_nClick_anywhere_to_close_this_t
mov ecx, esi
call fcn.0050cce0
mov eax, dword [esi + 0x1c64]
mov dword [esi + 0x1c60], eax
mov eax, 1
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.005124f0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
movzx eax, al
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4