Function at 0x51cd30
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [0x589bd0]
sub esp, 0x34
test eax, eax
push ebp
push edi
mov edi, edx
mov ebp, ecx
je 0x51cece
push ebx
mov ebx, dword [sym.imp.USER32.dll_PtInRect]
push esi
mov esi, dword [0x5a1af8]
movzx eax, bp
mov edx, ebp
shr edx, 0x10
test esi, esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
je 0x51cdd3
jmp 0x51cd70
lea ecx, [esi + 0xa24]
mov eax, dword [ecx]
mov dword [esp + 0x18], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 0xc]
inc eax
add ecx, 2
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
mov eax, dword [esi + 0xa34]
test eax, eax
je 0x51cdc5
mov ecx, dword [esp + 0x10]
push edx
push ecx
lea edx, [esp + 0x20]
push edx
call ebx
test eax, eax
je 0x51cdc5
test edi, edi
je 0x51ce71
cmp edi, 1
je 0x51cf80
mov esi, dword [esi + 0xd84]
test esi, esi
mov edx, dword [esp + 0x14]
jne 0x51cd70
test edi, edi
jne 0x51d105
mov edx, dword [0x589be8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x59f690]
push 4
push edx
xor edx, edx
call fcn.0051b280
test eax, eax
je 0x51cecc
mov eax, dword [0x5a1b04]
mov ebp, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call ebp
mov ecx, dword [0x5a1b00]
push ecx
call ebp
call fcn.0051ad70
mov eax, dword [0x5a1b00]
mov ecx, dword [0x59f690]
push 1
lea edx, [esp + 0x14]
push edx
push eax
xor esi, esi
push ecx
mov dword [0x59f6a0], esi
mov dword [0x59f698], 1
call dword [sym.imp.USER32.dll_MapWindowPoints]
push 0x7f86
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
cmp dword [0x5a00b8], esi
mov ebx, dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x5a00b4], eax
push eax
je 0x51cfec
call ebx
jmp 0x51cff3
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call edi
test ah, ah
jns 0x51ce88
mov ecx, esi
call fcn.0051cbe0
jmp 0x51ceb2
mov eax, dword [0x5a1b0c]
test eax, eax
push 0x10
je 0x51cf37
call edi
test ah, ah
jns 0x51ced4
mov eax, dword [esi]
push 0
push 0xf060
push 0x112
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [0x5a00b8]
test eax, eax
je 0x51cecc
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [0x5a00b8], 0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
ret
push 0x11
call edi
test ah, ah
jns 0x51cf04
mov ecx, dword [esi]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x51ceb2
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x51ceb2
mov ecx, dword [esi]
mov edx, 1
call fcn.00492680
jmp 0x51ceb2
mov eax, dword [esi]
cmp eax, dword [0x5a1b0c]
jne 0x51cf72
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x51cf72
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x51cf72
mov ecx, dword [esi]
mov edx, 1
call fcn.00492680
jmp 0x51ceb2
call edi
test ah, ah
jns 0x51cf51
mov ecx, dword [esi]
push 0
push 0xf060
push 0x112
push ecx
jmp 0x51ceac
push 0x11
call edi
test ah, ah
jns 0x51cf72
mov edx, dword [esi]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x51ceb2
mov eax, dword [esi]
push eax
jmp 0x51ceec
mov ecx, dword [esi]
xor edx, edx
call fcn.00492410
jmp 0x51ceb2
mov ecx, dword [esi]
push 0
push ecx
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov edi, eax
test edi, edi
jne 0x51cf9d
xor ecx, ecx
call fcn.0041c8e0
jmp 0x51ceb2
mov eax, dword [0x59f690]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
mov dword [0x59f69c], 1
mov ecx, dword [esi]
push ecx
push 0
push edx
push eax
push 0
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
test eax, eax
jne 0x51cfdd
xor ecx, ecx
call fcn.0041c8e0
mov dword [0x59f69c], 0
jmp 0x51ceb2
call ebx
mov dword [0x5a00b8], eax
cmp dword [0x59f698], esi
je 0x51d0d9
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [0x5a1b00]
cmp eax, ecx
jne 0x51d09e
push 0x209
push 0x100
push ecx
lea ecx, [esp + 0x34]
push ecx
call edi
cmp eax, 1
jne 0x51d0c4
mov eax, dword [esp + 0x2c]
cmp eax, 0x200
jne 0x51d074
mov eax, dword [0x59f6a0]
inc eax
cmp eax, 1
mov dword [0x59f6a0], eax
jne 0x51d067
movzx ecx, word [esp + 0x14]
movzx edx, word [esp + 0x10]
shl ecx, 0x10
or ecx, edx
xor edx, edx
call fcn.0051b700
jmp 0x51d0c4
mov ecx, dword [esp + 0x34]
xor edx, edx
call fcn.0051b700
jmp 0x51d0c4
cmp eax, 0x202
jne 0x51d090
mov edx, dword [0x59f6a0]
cmp edx, esi
jle 0x51d0be
mov ecx, dword [esp + 0x34]
call fcn.0051b700
jmp 0x51d0c4
cmp eax, 0x100
jb 0x51d0c4
cmp eax, 0x108
ja 0x51d0c4
mov edx, dword [0x59f6a0]
cmp edx, esi
jle 0x51d0be
movzx ecx, word [esp + 0x14]
movzx eax, word [esp + 0x10]
shl ecx, 0x10
or ecx, eax
call fcn.0051b700
jmp 0x51d0c4
mov dword [0x59f698], esi
mov ecx, dword [0x5a00b4]
push ecx
call ebx
cmp dword [0x59f698], esi
jne 0x51d005
mov edx, dword [0x5a00b8]
push edx
call ebx
mov eax, dword [0x5a1b04]
push eax
mov dword [0x5a00b8], esi
call ebp
mov ecx, dword [0x5a1b00]
push ecx
call ebp
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
jmp fcn.0051ad70
cmp edi, 1
jne 0x51d199
mov esi, dword [0x5a1af8]
test esi, esi
je 0x51d185
mov edi, 0x270f
jmp 0x51d123
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 0xa34]
test eax, eax
je 0x51d17b
lea eax, [esi + 0xa24]
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [eax + 0xc]
push edx
push ecx
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
je 0x51d17b
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0xa2c]
jl 0x51cecc
mov esi, dword [esi + 0xd84]
test esi, esi
jne 0x51d11f
mov edx, 1
mov ecx, ebp
call fcn.004d3da0
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
ret
cmp edi, 2
jne 0x51ceb2
mov edx, dword [0x589be8]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [0x59f690]
push 4
push edx
xor edx, edx
call fcn.0051b280
test eax, eax
je 0x51cecc
push 0x7f86
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ecx, dword [0x5a00b8]
test ecx, ecx
mov dword [0x5a00b4], eax
push eax
je 0x51d1f0
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x34
ret
call dword [sym.imp.USER32.dll_SetCursor]
pop esi
pop ebx
pop edi
mov dword [0x5a00b8], eax
pop ebp
add esp, 0x34
ret