Function at 0xb567a0
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x58
mov eax, 0xbc9c13
call fcn.00bc132b
mov edi, ecx
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x64], edi
test edi, edi
je 0xb567c5
lock inc dword [edi + 0x10]
and dword [ebp - 4], 0
mov eax, 0x84
mov ebx, dword [ebp + 0xc]
cmp ebx, eax
jbe 0xb56898
mov eax, 0x31a
cmp ebx, eax
jbe 0xb568c1
mov eax, ebx
sub eax, 0x464
jne 0xb56941
push 0x38
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00bc259b
mov ecx, dword [edi + 0xc4]
add esp, 0xc
mov eax, dword [ecx]
push 0
mov esi, dword [eax + 0x34]
lea eax, [ebp - 0x58]
push eax
push ecx
cmp esi, fcn.00b5f460
jne 0xbdf5b9
call fcn.00b5f460
cmp dword [ebp - 0x28], 0
jne 0xbdf5c8
mov byte [ebp - 0x59], 0
push dword [edi + 4]
and dword [ebp - 0x14], 0
xor esi, esi
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_IsWindowVisible]
test eax, eax
jne 0xbdf5db
cmp byte [ebp - 0x59], al
jne 0xbdf5db
mov eax, dword [ebp - 0x14]
movzx esi, si
shl esi, 0x10
movzx eax, ax
or esi, eax
test esi, esi
jne 0xb56878
mov esi, dword [ebp - 0x60]
push dword [ebp + 0x14]
push esi
push ebx
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_DefWindowProcW]
mov esi, eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
test edi, edi
je 0xb5688e
lock xadd dword [edi + 0x10], eax
dec eax
je 0xbdf659
mov eax, esi
call fcn.00bc12da
ret 0x10
je 0xbdf4b3
cmp ebx, 0x14
jbe 0xb568ce
mov eax, ebx
sub eax, 0x21
je 0xbdf4ab
sub eax, 0x60
je 0xb56983
sub eax, 1
jne 0xb56868
jmp 0xbdf49c
jne 0xb568ff
mov ecx, edi
call fcn.00b5699d
mov esi, eax
jmp 0xb56861
je 0xbdf476
mov eax, ebx
sub eax, 1
je 0xb56974
sub eax, 4
je 0xb56968
sub eax, 3
je 0xbdf4e6
sub eax, 7
jne 0xb56868
jmp 0xbdf504
mov eax, 0x100
cmp ebx, eax
jb 0xb56868
cmp ebx, 0x102
jbe 0xbdf514
cmp ebx, 0x103
jbe 0xb56868
cmp ebx, 0x106
jbe 0xbdf514
cmp ebx, 0x318
jne 0xb56868
jmp 0xbdf504
sub eax, 0x14
je 0xb5698c
sub eax, 0x140
jne 0xb56868
mov ecx, dword [edi + 4]
call fcn.00b6043d
mov ecx, edi
mov dword [edi + 0x14], eax
call fcn.00b5699d
jmp 0xb56868
mov ecx, edi
call fcn.00b9b14d
jmp 0xb568ca
push ecx
push ecx
push ecx
mov ecx, edi
call fcn.00b9b51c
jmp 0xb568ca
lock inc dword [edi + 0x10]
jmp 0xb56868
push dword [ebp + 0x14]
push ecx
push ecx
mov ecx, edi
call fcn.00b9b3e1
jmp 0xb568ca
cmp dword [edi + 0x18], 0
jne 0xbdf494
lea eax, [ebp - 0x20]
push eax
push ecx
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetClientRect]
push 0x10
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_FillRect]
xor esi, esi
inc esi
jmp 0xb56878
sub esp, 0xc
mov ecx, edi
call fcn.00c5de3a
jmp 0xb568ca
push 3
pop esi
jmp 0xb56878
mov edx, dword [edi + 0xc4]
push edx
push dword [ebp + 0x14]
mov eax, dword [edx]
push edx
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 0x14]
mov edx, eax
call fcn.00c711bb
test al, al
je 0xbdf4e3
or esi, 0xffffffff
jmp 0xb56878
mov esi, dword [ebp - 0x60]
cmp esi, dword [edi + 0x2c]
je 0xb56868
cmp esi, dword [edi + 0x30]
je 0xb56868
mov ecx, edi
call fcn.00c5c8ee
jmp 0xb56868
push ecx
push esi
push ebx
push ecx
mov ecx, edi
call fcn.00c5df61
jmp 0xb568ca
cmp ebx, 0x101
jne 0xbdf54b
mov al, byte [edi + 0x52]
test al, al
jne 0xbdf528
cmp byte [edi + 0x4f], al
je 0xbdf59f
cmp esi, 0x20
je 0xbdf532
cmp esi, 0xd
jne 0xbdf59f
test al, al
je 0xbdf53a
push 0
jmp 0xbdf542
cmp byte [edi + 0x4f], 0
je 0xbdf598
push 1
mov ecx, edi
call fcn.00c5c91f
jmp 0xbdf598
cmp ebx, eax
je 0xbdf557
cmp ebx, 0x104
jne 0xbdf59f
cmp byte [edi + 0x4f], 0
je 0xbdf59f
cmp esi, 0x5d
je 0xbdf574
cmp esi, 0x79
jne 0xbdf59f
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0xbdf59f
push 3
pop eax
cmp dword [edi + 0x24], eax
je 0xbdf58c
push 0
push 0
push dword [edi + 0x30]
mov dword [edi + 0x24], eax
call dword [sym.imp.ext_ms_win_ntuser_draw_l1_1_0.dll_InvalidateRect]
push ecx
push ecx
push dword [edi + 0x30]
mov ecx, edi
call fcn.00c5dc2c
xor esi, esi
jmp 0xb56878
push dword [ebp + 0x14]
push esi
push ebx
push dword [edi + 4]
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_GetParent]
push eax
call dword [sym.imp.ext_ms_win_rtcore_ntuser_window_ext_l1_1_0.dll_SendMessageW]
jmp 0xb568ca
mov ecx, esi
call dword [0xd0cffc]
call esi
jmp 0xb56825
cmp dword [ebp - 0x50], 0
mov byte [ebp - 0x59], 1
je 0xb56833
jmp 0xb5682f
cmp byte [edi + 0x29], 0
je 0xbdf61d
mov eax, dword [edi + 0x88]
test eax, eax
je 0xbdf61d
cmp dword [edi + 0x1c], 1
jbe 0xbdf602
push 6
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
lea eax, [eax*4 + 0x36]
jmp 0xbdf62c
test eax, eax
je 0xbdf61d
cmp dword [edi + 0x1c], 1
jne 0xbdf61d
push 6
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
lea eax, [eax*2 + 0x14]
jmp 0xbdf62c
push 6
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
lea eax, [eax*2 + 0x22]
push 6
mov dword [ebp - 0x18], eax
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
mov edx, dword [edi + 0x14]
lea ecx, [ebp - 0x18]
push 0
lea eax, [eax*2 + 0x20]
mov dword [ebp - 0x14], eax
call fcn.00b88bde
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
jmp 0xb56856
mov ecx, edi
call fcn.00c5c7e7
push edi
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb5688e