Function at 0x543200
Capabilities:
Hide graphical window
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5a7148
mov eax, dword fs:[0]
push eax
sub esp, 0x154
mov eax, dword [0x6340c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 1
mov edx, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], esi
nop dword [eax]
mov edx, dword [ebp + esi*4 - 0x160]
xor ebx, ebx
mov dword [ebp - 0x154], edx
nop
mov ecx, dword [eax + 0x88]
mov eax, edx
sub eax, 0
je 0x5432a1
sub eax, 1
je 0x54329c
sub eax, 1
jne 0x5432a1
mov eax, dword [ecx + 0x38]
jmp 0x5432a4
mov eax, dword [ecx + 0x30]
jmp 0x5432a4
mov eax, dword [ecx + 0x28]
cmp ebx, eax
jae 0x5432e0
push edx
push ebx
call fcn.005548d0
push dword [ebp - 0x144]
mov edi, eax
mov ecx, dword [edi]
mov esi, dword [ecx + 0x28]
mov ecx, esi
call dword [0x5c3794]
mov ecx, edi
call esi
cmp eax, 1
je 0x5435d9
mov eax, dword [ebp - 0x148]
inc ebx
mov edx, dword [ebp - 0x154]
jmp 0x543280
mov esi, dword [ebp - 0x150]
mov eax, dword [ebp - 0x148]
inc esi
mov dword [ebp - 0x150], esi
cmp esi, 2
jb 0x543270
push dword [ebp - 0x144]
mov ebx, eax
mov edi, dword [ebx + 0x104]
mov eax, dword [edi + 0x20]
mov esi, dword [eax]
mov ecx, esi
call dword [0x5c3794]
lea ecx, [edi + 0x20]
call esi
test eax, eax
jne 0x5435d9
mov eax, dword [ebx + 0x110]
test eax, eax
je 0x543360
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x543360
mov edi, dword [ebx + 0x110]
push dword [ebp - 0x144]
mov eax, dword [edi]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x5c3794]
mov ecx, edi
call esi
test eax, eax
jne 0x5435d9
mov edi, dword [ebp - 0x144]
cmp dword [edi + 4], 0x100
jne 0x543655
call dword [sym.imp.USER32.dll_GetFocus]
mov esi, eax
mov eax, dword [ebp - 0x158]
cmp eax, 9
jne 0x54348f
push edi
push dword [ebx - 0x30]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x5435d9
lea ecx, [ebx - 0x34]
call fcn.00545f50
test al, al
jne 0x543655
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x543655
mov eax, dword [ebp - 0x14c]
shr eax, 0x10
movzx ecx, al
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x14c], ecx
mov eax, dword [eax + 8]
sub eax, 0x42
je 0x5434b1
sub eax, 0xd
je 0x543649
sub eax, 2
jne 0x543655
cmp byte [ebx + 0x580], al
je 0x543655
push 1
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov esi, eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push 0
push 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x14c]
push esi
call dword [sym.imp.USER32.dll_ToUnicode]
cmp eax, 1
jne 0x543655
lea eax, [ebp - 0x28]
push 0x5e72bc
push eax
call fcn.004d879e
add esp, 8
test eax, eax
jne 0x543655
push str.User_keystroke_Quit_Recieved
lea ecx, [ebp - 0x140]
call fcn.00444ee0
push 0
lea eax, [ebp - 0x140]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebx - 0x34]
call fcn.00545af0
lea ecx, [ebp - 0x140]
call fcn.00444ea0
jmp 0x5435d9
cmp eax, 0xd
jne 0x5434f4
push edi
push dword [ebx - 0x30]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x54339c
mov eax, dword [ebx + 0x114]
cmp esi, dword [eax + 4]
jne 0x5434be
lea ecx, [ebx - 0x34]
call fcn.00540750
jmp 0x5435d9
mov ecx, dword [ebx + 0x118]
call fcn.00546f60
cmp esi, eax
jne 0x5435d9
lea ecx, [ebx - 0x34]
call fcn.00544740
test al, al
je 0x5435d9
mov ecx, dword [ebx + 0x118]
sub esp, 0x10
call fcn.00547000
jmp 0x5435d9
cmp eax, 0x1b
jne 0x54352c
push edi
push dword [ebx - 0x30]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x54339c
push dword [ebx - 0x30]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x5435d9
push 0
push dword [ebx - 0x30]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x5435d9
push 0x28
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x54356f
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [ebx + 0x98]
xor esi, esi
mov ecx, dword [ebx + 0x94]
mov edi, eax
sub edx, ecx
sar edx, 2
test edx, edx
jle 0x54356f
nop word [eax + eax]
mov eax, dword [ecx]
cmp dword [eax + 4], edi
je 0x5435b7
inc esi
add ecx, 4
cmp esi, edx
jl 0x543560
push 0x26
call dword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x54339c
call dword [sym.imp.USER32.dll_GetFocus]
mov edi, dword [ebx + 0x98]
xor esi, esi
mov ecx, dword [ebx + 0x94]
mov edx, eax
sub edi, ecx
sar edi, 2
test edi, edi
jle 0x54339c
mov eax, dword [ecx + esi*4]
cmp dword [eax + 4], edx
je 0x543611
inc esi
cmp esi, edi
jl 0x5435a5
jmp 0x54339c
lea eax, [edx - 1]
lea ecx, [ebx - 0x34]
cmp esi, eax
jne 0x5435fc
push 0
call fcn.00545980
mov eax, dword [ebx + 0x94]
mov eax, dword [eax]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004c59c5
mov esp, ebp
pop ebp
ret 4
lea eax, [esi + 1]
push eax
call fcn.00545980
mov eax, dword [ebx + 0x94]
mov eax, dword [eax + esi*4 + 4]
jmp 0x5435d0
test esi, esi
jne 0x54362e
mov eax, dword [ecx + edi*4 - 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
dec edi
lea ecx, [ebx - 0x34]
push edi
call fcn.00545980
jmp 0x5435d9
mov eax, dword [ecx + esi*4 - 4]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetFocus]
lea edi, [esi - 1]
push edi
lea ecx, [ebx - 0x34]
call fcn.00545980
jmp 0x5435d9
push 1
lea ecx, [ebx - 0x34]
call fcn.005460e0
jmp 0x5435d9
xor eax, eax
jmp 0x5435de