Function at 0x595790
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5fee74
mov eax, dword fs:[0]
push eax
sub esp, 0x3b8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3b4], edx
mov dword [ebp - 0x3ac], ecx
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push 0x270
mov dword [ebp - 0x3a8], eax
lea eax, [ebp - 0x394]
push 0
push eax
mov word [ebp - 0xec], 0
call fcn.00420090
add esp, 8
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x394]
push 0
push 0x80008
push SysReAllocString
push 2
push 2
push 0
push 0
push 0
push str.WinCatcherClass
push eax
call fcn.005c6220
push 0
lea ecx, [ebp - 0x394]
mov dword [ebp - 4], 0
call fcn.005c5730
mov ebx, eax
mov dword [ebp - 0x3a4], ebx
test ebx, ebx
jne 0x59584c
xor bl, bl
jmp 0x595e64
push 0
lea ecx, [ebp - 0x394]
call fcn.005c4720
push 3
push 0xc8
push 0
push ebx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push dword [ebp - 0x3a8]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x172
push dword [ebp - 0x3b4]
call ebx
mov dword [ebp - 0x3c0], eax
call fcn.005d8ff0
mov ecx, esi
call fcn.005cae20
push 1
lea ecx, [ebp - 0xac]
call fcn.005d0610
push 0
push dword [ebp - 0x3ac]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x3a8], 0
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [ebp - 0x3b8], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x44], xmm0
push eax
push 0
push ecx
mov dword [esp], 0x40400000
push 0xffff0000
mov dword [ebp - 0x44], 0
call dword [sym.imp.gdiplus.dll_GdipCreatePen1]
mov dword [ebp - 0x40], eax
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
lea ecx, [ebp - 0x38]
movq qword [ebp - 0x38], xmm0
call fcn.005dc5e0
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x58]
movq qword [ebp - 0x58], xmm0
call fcn.005dc5e0
lea eax, [ebp - 0x1c]
xorps xmm0, xmm0
push eax
push 0
movlpd qword [ebp - 0x1c], xmm0
push 0
mov dword [ebp - 0x1c], 0
call dword [sym.imp.gdiplus.dll_GdipCreateStringFormat]
mov dword [ebp - 0x18], eax
push 1
push dword [ebp - 0x1c]
call dword [sym.imp.gdiplus.dll_GdipSetStringFormatAlign]
mov ecx, dword [ebp - 0x18]
test eax, eax
push 1
push dword [ebp - 0x1c]
cmovne ecx, eax
mov dword [ebp - 0x18], ecx
call dword [sym.imp.gdiplus.dll_GdipSetStringFormatLineAlign]
mov ecx, dword [ebp - 0x18]
test eax, eax
movss xmm2, dword [0x6edc10]
xorps xmm0, xmm0
cmovne ecx, eax
movlpd qword [ebp - 0x60], xmm0
sub esp, 8
mov dword [ebp - 0x18], ecx
push 1
push ecx
lea ecx, [ebp - 0x60]
call fcn.00401730
mov esi, dword [sym.imp.gdiplus.dll_GdipCreateSolidFill]
lea eax, [ebp - 0x3a0]
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0
push eax
movq qword [ebp - 0x6c], xmm0
push 0xffffffffffffffff
mov dword [ebp - 0x6c], vtable.Gdiplus::SolidBrush.0
mov dword [ebp - 0x3a0], 0
call esi
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x3a0]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x39c]
mov dword [ebp - 0x70], 0
xorps xmm0, xmm0
mov dword [ebp - 0x39c], 0
push eax
movq qword [ebp - 0x78], xmm0
push 0xff00007f
mov dword [ebp - 0x78], vtable.Gdiplus::SolidBrush.0
call esi
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x74], eax
mov byte [ebp - 4], 7
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x595a23
push 2
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x595de0
push 0
push 0x14
call dword [sym.imp.KERNEL32.dll_SleepEx]
xorps xmm1, xmm1
lea ecx, [ebp - 0xac]
call fcn.005d05a0
comisd xmm0, xmmword [0x6edbd8]
jbe 0x595a55
call fcn.005d8ff0
lea ecx, [ebp - 0xac]
call fcn.005d05f0
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0x3a4]
lea ecx, [ebp - 0x90]
call fcn.005caea0
mov esi, eax
cmp esi, dword [ebp - 0x3a8]
je 0x595a05
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x595a05
mov dword [ebp - 0x3a8], esi
test esi, esi
je 0x595dcc
cmp esi, dword [ebp - 0x3ac]
je 0x595dcc
cmp esi, dword [ebp - 0x3b8]
je 0x595dcc
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x595a05
push 0x1000
push 0
push 0
push 0x1000
lea ecx, [ebp - 0x38]
call fcn.005db9a0
mov ecx, dword [ebp - 0x3c]
mov edx, eax
call fcn.005ce4c0
test al, al
je 0x595a05
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x28]
sub eax, edx
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x3a4]
push 0x150
push eax
mov eax, dword [ebp - 0x24]
sub eax, ecx
push eax
push edx
push ecx
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x20]
mov eax, 0xfffffffd
sub eax, dword [ebp - 0x2c]
add dword [ebp - 0x24], eax
mov eax, 0xfffffffd
sub eax, dword [ebp - 0x28]
add ecx, eax
mov dword [ebp - 0x2c], 1
cmp ecx, 0x38
mov dword [ebp - 0x28], 1
mov eax, 0x38
cmovl ecx, eax
push esi
mov dword [ebp - 0x20], ecx
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x398]
mov dword [ebp - 0x3b0], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x398], 0
push eax
movlpd qword [ebp - 0x4c], xmm0
call dword [sym.imp.gdiplus.dll_GdipCreateFromHDC]
mov esi, eax
mov eax, dword [ebp - 0x398]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x44]
push eax
call dword [sym.imp.gdiplus.dll_GdipDrawRectangleI]
test eax, eax
push 0x32
cmovne esi, eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffffd
push eax
push 3
push 3
push dword [ebp - 0x39c]
push dword [ebp - 0x398]
call dword [sym.imp.gdiplus.dll_GdipFillRectangleI]
push dword [ebp - 0x3c]
test eax, eax
lea ecx, [ebp - 0x58]
cmovne esi, eax
mov dword [ebp - 0x48], esi
call fcn.005db290
lea ecx, [ebp - 0x38]
call fcn.005dc3a0
mov ecx, eax
mov eax, dword [ebp - 0x24]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp ecx, eax
jle 0x595bfa
push 1
lea ecx, [ebp - 0x38]
call fcn.005dbf40
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x627828
lea ecx, [ebp - 0x58]
call fcn.005dc190
push eax
push str.__Process_ID_
lea ecx, [ebp - 0x38]
call fcn.005da780
movd xmm0, dword [ebp - 0x24]
cvtdq2ps xmm0, xmm0
push 4
mov dword [ebp - 0x88], 0x40400000
mov dword [ebp - 0x84], 0x40400000
mov dword [ebp - 0x7c], 0x42480000
push dword [ebp - 0x398]
subss xmm0, dword [0x6edba8]
movss dword [ebp - 0x80], xmm0
call dword [sym.imp.gdiplus.dll_GdipSetTextRenderingHint]
test eax, eax
lea ecx, [ebp - 0x38]
cmovne esi, eax
mov dword [ebp - 0x3bc], esi
mov dword [ebp - 0x48], esi
call fcn.005dc3a0
lea ecx, [ebp - 0x38]
mov esi, eax
call fcn.005dc190
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x88]
push dword [ebp - 0x1c]
push ecx
push dword [ebp - 0x60]
push esi
push eax
push dword [ebp - 0x398]
call dword [sym.imp.gdiplus.dll_GdipDrawString]
push dword [ebp - 0x3b0]
mov ecx, dword [ebp - 0x3bc]
test eax, eax
push dword [ebp - 0x3a4]
cmovne ecx, eax
mov dword [ebp - 0x48], ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
push 0
push 0xffffffffffffffff
push 5
lea ecx, [ebp - 0x58]
call fcn.005dc190
mov edx, eax
mov ecx, edi
call fcn.005c9cf0
push 2
push 0xffffffffffffffff
push 0x100c
push edi
mov dword [ebp - 0x3b0], eax
call ebx
mov esi, eax
cmp esi, 0xffffffff
je 0x595d40
nop word [eax + eax]
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xd8], 2
push eax
push esi
push 0x102b
push edi
mov dword [ebp - 0xdc], 0
call ebx
push esi
push esi
push 0x1015
push edi
call ebx
push 2
push esi
push 0x100c
push edi
call ebx
mov esi, eax
cmp esi, 0xffffffff
jne 0x595d00
mov esi, dword [ebp - 0x3b0]
cmp esi, 0xffffffff
jne 0x595d60
mov byte [ebp - 4], 7
push dword [ebp - 0x398]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
jmp 0x595a05
lea eax, [ebp - 0xe8]
mov dword [ebp - 0xd8], 3
push eax
push esi
push 0x102b
push edi
mov dword [ebp - 0xdc], 3
call ebx
push 0
push esi
push 0x1013
push edi
call ebx
push esi
push esi
push 0x1015
push edi
call ebx
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
call fcn.005d8ff0
lea ecx, [ebp - 0xac]
call fcn.005d05f0
mov byte [ebp - 4], 7
push dword [ebp - 0x398]
call dword [sym.imp.gdiplus.dll_GdipDeleteGraphics]
jmp 0x595a05
push 1
push 0
lea ecx, [ebp - 0x394]
call fcn.005c3f80
jmp 0x595a05
call fcn.005cae00
push 1
push dword [ebp - 0x3ac]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [ebp - 0x3a4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edi, dword [ebp - 0x3c0]
push edi
push 0
push 0x172
push dword [ebp - 0x3b4]
call ebx
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
push eax
call esi
push edi
call esi
push dword [ebp - 0x39c]
mov esi, dword [sym.imp.gdiplus.dll_GdipDeleteBrush]
mov bl, 1
call esi
push dword [ebp - 0x3a0]
call esi
push dword [ebp - 0x60]
call dword [sym.imp.gdiplus.dll_GdipDeleteFont]
push dword [ebp - 0x1c]
call dword [sym.imp.gdiplus.dll_GdipDeleteStringFormat]
lea ecx, [ebp - 0x58]
call fcn.005dc430
lea ecx, [ebp - 0x38]
call fcn.005dc430
push dword [ebp - 0x44]
call dword [sym.imp.gdiplus.dll_GdipDeletePen]
lea ecx, [ebp - 0x394]
call fcn.005c1c60
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc