Function at 0x5e7dd0
Capabilities:
Hide graphical window
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5e8074
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dl, byte [eax + 0x2c]
je 0x5e805e
mov ecx, dword [ebp - 4]
mov eax, edx
mov byte [ecx + 0x2c], al
test al, al
je 0x5e7f20
call sub.USER32.DLL_GetFocus
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x3c], ebx
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x5e7e3a
mov eax, dword [ebp - 4]
call fcn.005e6e68
mov eax, dword [eax + 0xe0]
call fcn.00476d64
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov edx, dword [eax]
call dword [edx + 0xec]
push eax
push 0x30
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.USER32.DLL_SendMessageA
mov eax, dword [ebp - 4]
cmp byte [eax + 0x17], 0
jne 0x5e7e6c
mov dl, 1
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.005e7a3c
push 0x40
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
sub ecx, edx
push ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
sub ecx, eax
push ecx
push edx
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.USER32.DLL_SetWindowPos
mov eax, dword [ebp - 4]
mov edx, dword [0x5bc198]
call fcn.00403b34
test al, al
je 0x5e7ec4
mov eax, dword [ebp - 4]
call fcn.005e6ec0
mov edx, dword [ebp - 4]
mov ecx, dword [edx + 0x30]
mov edx, dword [ebp - 4]
call dword [eax + 0x264]
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 1
xor eax, eax
push ebp
push 0x5e7f08
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 0x94]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e7f0f
mov eax, dword [ebp - 4]
mov byte [eax + 0x2d], 0
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x5e7f32
push 0
push eax
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp - 4]
call fcn.005e6e68
cmp byte [eax + 0x140], 0
jne 0x5e800a
call fcn.005afb8c
test eax, eax
je 0x5e7f6b
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0046d270
call fcn.00487914
mov ebx, eax
call fcn.005afb8c
cmp ebx, eax
je 0x5e7f6f
xor ebx, ebx
jmp 0x5e7f71
mov bl, 1
test bl, bl
je 0x5e7f7c
mov al, 1
call fcn.005e7ccc
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x3c]
test esi, esi
jbe 0x5e7f9e
push esi
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x5e7f9e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
push eax
call sub.USER32.DLL_SetFocus
jmp 0x5e7ff7
mov eax, dword [ebp - 4]
call fcn.005e6e68
mov eax, dword [eax + 0xe0]
call fcn.00476d64
push eax
call sub.USER32.DLL_IsWindowVisible
test eax, eax
je 0x5e7fd6
mov eax, dword [ebp - 4]
call fcn.005e6e68
mov eax, dword [eax + 0xe0]
call fcn.00476d64
push eax
call sub.USER32.DLL_SetFocus
jmp 0x5e7ff7
push 2
mov eax, dword [ebp - 4]
call fcn.005e6e68
mov eax, dword [eax + 0xe0]
call fcn.00476d64
push eax
call sub.USER32.DLL_GetWindow
push eax
call sub.USER32.DLL_SetFocus
test bl, bl
je 0x5e8002
xor eax, eax
call fcn.005e7ccc
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x3c], edx
mov eax, dword [ebp - 4]
call fcn.005e6e68
cmp byte [eax + 0x33], 0
je 0x5e805e
push 0x1b
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x5e803c
push 0x11
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jl 0x5e803c
push 0x12
call sub.USER32.DLL_GetAsyncKeyState
test ax, ax
jge 0x5e805e
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0xc4]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x8c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5e807b
lea eax, [ebp - 0x18]
call fcn.004048ec
ret