Function at 0x581b10
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
mov ebx, ecx
push edi
call fcn.005da5cd
test eax, eax
je 0x581b36
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret 4
mov eax, dword [ebx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.005d9ca3
mov esi, eax
test esi, esi
je 0x581b81
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x581b81
push 0x659338
mov ecx, esi
call fcn.005dda74
test eax, eax
je 0x581b81
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x90]
test eax, eax
je 0x581b81
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret 4
mov eax, dword [ebx + 0x24]
test ah, 1
je 0x581c6a
mov eax, dword [edi + 4]
cmp eax, 0x100
jb 0x581c6a
cmp eax, 0x108
ja 0x581c6a
call dword [sym.imp.USER32.dll_GetFocus]
mov ebp, eax
test ebp, ebp
je 0x581c6a
mov eax, dword [ebx + 0x1c]
push ebp
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x581c6a
mov edi, dword [ebx + 0x1c]
mov dword [esp + 0x14], edi
cmp ebp, edi
je 0x581c66
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x581e4d
push ebp
call fcn.005d9cca
mov esi, eax
test esi, esi
je 0x581c55
mov ecx, esi
call fcn.005dcb9e
mov edi, eax
test edi, edi
je 0x581c51
mov eax, dword [esp + 0x50]
mov edx, dword [esi]
push eax
mov ecx, esi
call dword [edx + 0x90]
test eax, eax
jne 0x581b72
mov ecx, dword [edi]
lea edx, [esp + 0x10]
push edx
push 0x6b2350
push edi
mov dword [esp + 0x1c], eax
call dword [ecx]
test eax, eax
jne 0x581c51
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x50]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test esi, esi
je 0x581b72
mov edi, dword [esp + 0x14]
push ebp
call dword [sym.imp.USER32.dll_GetParent]
mov ebp, eax
test ebp, ebp
jne 0x581bd0
mov edi, dword [esp + 0x50]
mov eax, dword [ebx + 0x20]
test eax, eax
jne 0x581c7b
mov edx, dword [ebx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.005d9ca3
mov esi, dword [edi + 4]
mov ebp, eax
test byte [ebx + 0x64], 0x20
jne 0x581ca0
cmp esi, 0x201
je 0x581ca0
cmp esi, 0x202
jne 0x581e3b
cmp esi, 0x200
jb 0x581cb0
cmp esi, 0x209
jbe 0x581cc8
cmp esi, 0xa0
jb 0x581e3b
cmp esi, 0xa9
ja 0x581e3b
mov al, byte [0x6c6ea8]
test al, al
je 0x581cde
call fcn.00559b10
test eax, eax
je 0x581e3b
call fcn.005f4377
mov ecx, dword [edi + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [edi + 0x14]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x1c]
push edx
push eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov edx, dword [ebx]
mov ecx, 0xb
xor eax, eax
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push eax
mov ecx, ebx
mov dword [esp + 0x2c], 0x28
call dword [edx + 0x64]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x44]
cmp eax, 0xffffffff
je 0x581d45
push eax
call fcn.0051112b
add esp, 4
cmp esi, 0x201
jne 0x581d5e
test dword [esp + 0x24], 0x80000000
je 0x581d5e
mov edi, 1
jmp 0x581d83
xor edi, edi
cmp esi, 0x201
je 0x581d83
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x581d83
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x104]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
test eax, eax
jl 0x581dfd
test edi, edi
jne 0x581dfd
cmp esi, 0x202
jne 0x581db6
mov eax, dword [ebx]
push 0xffffffffffffffff
mov ecx, ebx
call dword [eax + 0xdc]
push 0xc8
push 0xe001
mov ecx, ebx
call fcn.005e41a2
jmp 0x581e29
test byte [ebx + 0x60], 8
jne 0x581dec
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x581dec
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
cmp edx, dword [ecx + 0x104]
je 0x581e29
push 0x12c
push 0xe000
mov ecx, ebx
call fcn.005e41a2
jmp 0x581e29
mov ecx, dword [esp + 0x10]
mov eax, dword [ebx]
push ecx
mov ecx, ebx
call dword [eax + 0xdc]
jmp 0x581e29
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x581e0e
test edi, edi
je 0x581e29
mov edx, dword [ebx]
push 0xffffffffffffffff
mov ecx, ebx
call dword [edx + 0xdc]
mov eax, dword [ebx + 0x1c]
push 0xe001
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x50]
mov dword [edx + 0x104], ecx
mov ecx, ebx
call fcn.005db417
test eax, eax
je 0x581e59
mov ecx, dword [eax + 0x50]
test ecx, ecx
je 0x581e59
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x3c
ret 4
test byte [ebx + 0x7c], 4
jne 0x581ea2
test ebp, ebp
je 0x581ea2
jne 0x581e69
xor esi, esi
jmp 0x581e6c
mov esi, dword [ebp + 0x1c]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x581ea2
push esi
call fcn.005d9cca
test eax, eax
je 0x581ea2
mov eax, dword [ebp]
push edi
mov ecx, ebp
call dword [eax + 0x90]
test eax, eax
jne 0x581b72
mov ecx, ebp
call fcn.005db2b7
mov ebp, eax
test ebp, ebp
jne 0x581e69
push edi
mov ecx, ebx
call fcn.005dc581
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4