Function at 0x54cf5c
Capabilities:
Log keystrokes via input method manager
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add eax, 0x5c
xor ecx, ecx
mov edx, 0xc
call fcn.00403830
mov eax, dword [ebp - 4]
call fcn.005492c4
xor eax, eax
push ebp
push 0x54d762
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x54d70a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 4]
mov dword [edx + 0x44], eax
mov byte [ebp - 0xd], 0
test bl, bl
je 0x54d02a
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x2d], eax
movsx eax, word [ebp - 0x2d]
mov dword [ebp - 0x35], eax
movsx eax, word [ebp - 0x2b]
mov dword [ebp - 0x31], eax
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x35]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
call fcn.00548dc8
mov eax, dword [ebp - 0x11]
push eax
lea eax, [ebp - 0xd]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov ecx, dword [ebp - 0x15]
movzx edx, byte [0x54d774]
mov ebx, dword [eax]
call dword [ebx + 0x34]
mov eax, dword [ebp - 4]
call fcn.0054c700
test al, al
je 0x54d024
call fcn.00404960
call fcn.00404960
jmp 0x54d769
mov byte [ebp - 0xd], 0
jmp 0x54d05a
cmp byte [ebp + 0x10], 0
je 0x54d05a
movzx edx, byte [ebp + 0xc]
xor dl, 1
mov eax, dword [ebp - 4]
call fcn.0054c76c
mov eax, dword [ebp - 4]
call fcn.0054c700
test al, al
je 0x54d05a
call fcn.00404960
call fcn.00404960
jmp 0x54d769
call sub.user32.dll_GetActiveWindow
mov dword [ebp - 0xc], eax
jmp 0x54d6e5
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x79]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x54d086
call sub.user32.dll_WaitMessage
jmp 0x54d6e5
mov eax, dword [ebp - 0x75]
sub eax, 0x201
je 0x54d099
sub eax, 3
jne 0x54d1a6
movsx eax, word [ebp - 0x6d]
mov dword [ebp - 0x3d], eax
movsx eax, word [ebp - 0x6b]
mov dword [ebp - 0x39], eax
mov eax, dword [ebp - 0x3d]
mov dword [ebp - 0x15], eax
mov eax, dword [ebp - 0x39]
mov dword [ebp - 0x11], eax
lea eax, [ebp - 0x15]
push eax
mov eax, dword [ebp - 0x79]
push eax
call sub.user32.dll_ClientToScreen
lea eax, [ebp - 0x15]
mov dl, 1
call fcn.0045a81c
mov ebx, eax
mov eax, ebx
mov edx, dword [0x54496c]
call fcn.00404178
test al, al
je 0x54d0f3
mov edx, dword [ebx + 0x25c]
mov eax, dword [ebp - 4]
call fcn.00549200
test al, al
jne 0x54d1a6
mov eax, dword [ebp - 4]
cmp byte [eax + 0x70], 0
jne 0x54d149
mov eax, dword [ebp - 4]
cmp ebx, dword [eax + 0xcc]
jne 0x54d149
lea ecx, [ebp - 0x88]
lea edx, [ebp - 0x15]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
call fcn.0045bde4
lea eax, [ebp - 0x88]
push eax
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xcc]
mov ecx, dword [eax]
call dword [ecx + 0x44]
lea eax, [ebp - 0x98]
pop edx
call fcn.00407964
test al, al
jne 0x54d158
call fcn.00404960
call fcn.00404960
jmp 0x54d769
cmp dword [ebp - 0x75], 0x201
jne 0x54d1a6
push ebp
lea eax, [ebp - 0x15]
mov dl, 1
call fcn.0054cbc4
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xac], 0
je 0x54d197
mov eax, dword [ebp - 4]
cmp byte [eax + 0x88], 0
je 0x54d197
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xac]
mov eax, dword [eax + 0x1c]
test byte [eax + 0x64], 0x10
je 0x54d1a6
call fcn.00404960
call fcn.00404960
jmp 0x54d769
push 3
mov esi, dword [ebp - 0x75]
push esi
push esi
push 0
lea eax, [ebp - 0x79]
push eax
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x54d6e5
mov eax, dword [ebp - 0x75]
cmp eax, 0x113
jg 0x54d1f1
je 0x54d38f
sub eax, 0x4d
je case.0x54d40c.518
sub eax, 0x2e
je case.0x54d40c.518
add eax, 0xffffff7b
sub eax, 0xa
jb 0x54d20f
jmp 0x54d67a
sub eax, 0x118
je case.0x54d40c.518
add eax, 0xffffff18
sub eax, 0xb
jb 0x54d3f4
jmp 0x54d67a
mov eax, dword [0x604134]
mov eax, dword [eax]
call fcn.0047e3b8
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x54d23d
cmp byte [ebp + 8], 0
je 0x54d239
push 2
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x54d23d
xor eax, eax
jmp 0x54d23f
mov al, 1
mov byte [ebp - 0x1e], al
mov eax, dword [ebp - 0x75]
sub eax, 0x100
je 0x54d264
sub eax, 2
je 0x54d2d8
sub eax, 2
je 0x54d264
sub eax, 2
je 0x54d2d8
jmp case.0x54d40c.518
cmp dword [ebp - 0x71], 0xe5
jne 0x54d279
mov eax, dword [ebp - 0x79]
push eax
call sub.imm32.dll_ImmGetVirtualKey
mov dword [ebp - 0x71], eax
cmp byte [ebp - 0x1e], 0
je 0x54d289
cmp dword [ebp - 0x71], 0x70
jne case.0x54d40c.518
movzx eax, word [ebp - 0x71]
mov word [ebp - 0x20], ax
push ebp
mov eax, dword [ebp - 0x6d]
call fcn.004722bc
push eax
push ebp
call fcn.0054cba8
pop ecx
lea edx, [ebp - 0x20]
pop ecx
call fcn.0054ccc8
pop ecx
test al, al
je 0x54d2bf
call fcn.00404960
call fcn.00404960
jmp 0x54d769
cmp word [ebp - 0x20], 0
je case.0x54d40c.518
lea eax, [ebp - 0x79]
push eax
call sub.user32.dll_TranslateMessage
jmp case.0x54d40c.518
cmp byte [ebp - 0x1e], 0
jne case.0x54d40c.518
push ebp
call fcn.0054cba8
pop ecx
mov dword [ebp - 0x1c], eax
push 0
lea eax, [ebp - 0x1d]
push eax
mov ecx, dword [ebp - 0x71]
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0xac]
mov eax, dword [ebp - 0x1c]
call fcn.0054c184
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x54d363
mov eax, dword [ebp - 0x71]
sub eax, 0x20
je 0x54d31c
sub eax, 0xd
jne 0x54d357
mov eax, dword [ebp - 4]
cmp byte [eax + 0x70], 0
jne 0x54d357
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jne 0x54d357
call sub.user32.dll_GetActiveWindow
test eax, eax
je 0x54d357
call sub.user32.dll_GetActiveWindow
mov edx, eax
mov ecx, dword [ebp - 0x71]
mov eax, dword [ebp - 4]
call fcn.0054c754
call fcn.00404960
call fcn.00404960
jmp 0x54d769
push 0
call sub.user32.dll_MessageBeep
jmp case.0x54d40c.518
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
call fcn.00549c48
mov eax, dword [ebp - 0x1c]
call fcn.0054c8d0
cmp byte [ebp - 0x1d], 0
je case.0x54d40c.518
mov dl, 1
mov eax, dword [ebp - 0x1c]
call fcn.0054c76c
jmp case.0x54d40c.518
mov eax, dword [ebp - 0x79]
call fcn.00458d04
mov ebx, eax
test ebx, ebx
je 0x54d3e6
mov eax, ebx
mov edx, dword [0x54496c]
call fcn.00404178
test al, al
je 0x54d3e6
cmp dword [ebp - 0x71], 0x2328
jl 0x54d3e6
cmp dword [ebp - 0x71], 0x232b
jg 0x54d3e6
cmp dword [ebx + 0x25c], 0
je case.0x54d40c.518
mov edx, dword [ebp - 0x71]
sub edx, 0x2328
mov eax, dword [ebx + 0x25c]
call fcn.0054ceec
jmp case.0x54d40c.518
lea eax, [ebp - 0x79]
push eax
call sub.user32.dll_DispatchMessageA
jmp case.0x54d40c.518
mov eax, dword [ebp - 0x75]
add eax, 0xfffffe00
cmp eax, 0xa
ja case.0x54d40c.518
movzx eax, byte [eax + 0x54d413]
jmp dword [eax*4 + 0x54d41e]
mov eax, dword [ebp - 0x65]
cmp eax, dword [0x60bc70]
jne 0x54d448
mov eax, dword [ebp - 0x61]
cmp eax, dword [0x60bc74]
je 0x54d461
mov eax, dword [ebp - 0x65]
mov dword [0x60bc70], eax
mov eax, dword [ebp - 0x61]
mov dword [0x60bc74], eax
push ebp
call fcn.0054cd6c
pop ecx
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0054cc1c
pop ecx
test al, al
je case.0x54d40c.518
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x65]
mov eax, dword [ebp - 0x28]
call fcn.00548dc8
mov ecx, dword [ebp - 0x11]
mov edx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x38]
jmp case.0x54d40c.518
mov byte [ebp - 0x29], 0
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0054cc1c
pop ecx
test al, al
je 0x54d4d1
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x65]
mov eax, dword [ebp - 0x28]
call fcn.00548dc8
mov eax, dword [ebp - 0x11]
push eax
lea eax, [ebp - 0x29]
push eax
movsx edx, word [ebp - 0x6f]
mov ecx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x40]
cmp byte [ebp - 0x29], 0
jne case.0x54d40c.518
cmp dword [ebp - 0x1c], 0
je case.0x54d40c.518
movsx eax, word [ebp - 0x6d]
mov dword [ebp - 0x45], eax
movsx eax, word [ebp - 0x6b]
mov dword [ebp - 0x41], eax
mov eax, dword [ebp - 0x45]
mov dword [ebp - 0x15], eax
mov eax, dword [ebp - 0x41]
mov dword [ebp - 0x11], eax
lea eax, [ebp - 0x15]
push eax
mov eax, dword [ebp - 0x79]
push eax
call sub.user32.dll_ScreenToClient
mov eax, dword [ebp - 0x11]
push eax
movsx edx, word [ebp - 0x6f]
mov ecx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0x4c]
jmp case.0x54d40c.518
cmp dword [ebp - 0x75], 0x204
setne al
or al, byte [ebp + 8]
je case.0x54d40c.518
mov eax, dword [0x604134]
mov eax, dword [eax]
call fcn.0047e3b8
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 4]
and byte [eax + 0xb3], 0xef
push ebp
lea eax, [ebp - 0x65]
mov dl, 1
call fcn.0054cbc4
pop ecx
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0054cc1c
pop ecx
test al, al
je case.0x54d40c.518
cmp dword [ebp - 0x75], 0x203
je 0x54d587
movzx eax, byte [0x54d774]
mov byte [ebp - 0x21], al
jmp 0x54d591
movzx eax, byte [0x54d778]
mov byte [ebp - 0x21], al
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x65]
mov eax, dword [ebp - 0x28]
call fcn.00548dc8
mov eax, dword [ebp - 0x11]
push eax
lea eax, [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x15]
movzx edx, byte [ebp - 0x21]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x34]
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x49], eax
movsx eax, word [ebp - 0x49]
mov dword [ebp - 0x51], eax
movsx eax, word [ebp - 0x47]
mov dword [ebp - 0x4d], eax
mov eax, dword [ebp - 0x51]
mov dword [0x60bc70], eax
mov eax, dword [ebp - 0x4d]
mov dword [0x60bc74], eax
jmp case.0x54d40c.518
cmp dword [ebp - 0x75], 0x202
sete al
or al, byte [ebp + 8]
je case.0x54d40c.518
push ebp
lea eax, [ebp - 0x65]
xor edx, edx
call fcn.0054cbc4
pop ecx
push ebp
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x1c]
call fcn.0054cc1c
pop ecx
test al, al
jne 0x54d657
cmp dword [ebp - 0x1c], 0
je 0x54d630
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 4]
jne case.0x54d40c.518
mov eax, dword [ebp - 4]
cmp byte [eax + 0x71], 0
je case.0x54d40c.518
mov eax, dword [ebp - 4]
test byte [eax + 0xb3], 0x10
jne 0x54d64b
call fcn.00404960
call fcn.00404960
jmp 0x54d769
mov eax, dword [ebp - 4]
and byte [eax + 0xb3], 0xef
jmp case.0x54d40c.518
lea ecx, [ebp - 0x15]
lea edx, [ebp - 0x65]
mov eax, dword [ebp - 0x28]
call fcn.00548dc8
movzx eax, byte [ebp - 0xd]
push eax
mov ecx, dword [ebp - 0x11]
mov edx, dword [ebp - 0x15]
mov eax, dword [ebp - 0x28]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
jmp case.0x54d40c.518
lea eax, [ebp - 0x79]
push eax
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.0054cc90
pop ecx
test al, al
jne 0x54d69d
call fcn.00404960
call fcn.00404960
jmp 0x54d769
cmp dword [0x60bc70], 0x80000000
jne 0x54d6de
call sub.user32.dll_GetMessagePos
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x55], eax
movsx eax, word [ebp - 0x55]
mov dword [ebp - 0x5d], eax
movsx eax, word [ebp - 0x53]
mov dword [ebp - 0x59], eax
mov eax, dword [ebp - 0x5d]
mov dword [0x60bc70], eax
mov eax, dword [ebp - 0x59]
mov dword [0x60bc74], eax
push ebp
call fcn.0054cd6c
pop ecx
push ebp
call fcn.0054ce60
pop ecx
push ebp
call fcn.0054cc90
pop ecx
test al, al
jne 0x54d067
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54d711
mov eax, dword [ebp - 4]
call fcn.0054c3a4
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc