Function at 0x5e47f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x7bf85b
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x89b044]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x118]
call edx
test al, al
mov eax, dword [ebp + 8]
jne 0x5e4556
mov ecx, dword [eax]
cmp ecx, 8
jle 0x5e4556
cmp ecx, 0x13
jge 0x5e4556
mov ecx, dword [esi + 0x48]
push eax
test ecx, ecx
je 0x5e4c2a
mov edx, dword [ecx]
mov eax, dword [edx + 0x14c]
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [eax]
cmp ecx, 0x15
jne 0x5e4579
mov byte [esi + 0x1ad], 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp ecx, 0x14
jne 0x5e459a
mov byte [esi + 0x1ad], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
add ecx, 0xfffffffd
cmp ecx, 0xf
ja case.0x5e4807.14
movzx ecx, byte [ecx + 0x5e4c58]
jmp dword [ecx*4 + 0x5e4c48]
mov eax, dword [eax + 4]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x14]
push str.AutoTableItem
call eax
mov edi, eax
test edi, edi
je case.0x5e4807.13
cmp byte [esi + 0x58d], 0
je 0x5e4606
mov esi, dword [edi]
mov edx, dword [esi + 0x10]
mov ecx, edi
call edx
mov edx, dword [esi + 0x14]
test al, al
sete al
movzx ecx, al
push ecx
mov ecx, edi
call edx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x58c], 0
jne 0x5e4636
mov eax, dword [edi]
mov edx, dword [eax]
push 0
mov ecx, edi
call edx
push eax
mov ecx, esi
call fcn.005e3f10
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call ebx
test ax, ax
push 0x10
setl byte [esp + 0x17]
call ebx
test ax, ax
setl al
cmp byte [esp + 0x13], 0
mov ecx, edi
jne 0x5e4684
test al, al
jne 0x5e46be
mov eax, dword [edi]
mov edx, dword [eax]
push 0
call edx
push eax
mov ecx, esi
call fcn.005e3f10
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov edx, dword [eax]
call edx
mov dword [esi + 0x590], eax
mov esi, dword [edi]
mov eax, dword [esi + 0x10]
mov ecx, edi
call eax
test al, al
mov eax, dword [esi + 0x14]
sete cl
movzx edx, cl
push edx
mov ecx, edi
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [edi]
mov eax, dword [edx]
call eax
mov ecx, dword [esi + 0x590]
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x5e46dc
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
jg 0x5e46e0
mov dword [esp + 0x18], ecx
push 0x20
call fcn.00704930
add esp, 4
mov dword [esp + 0x1c], eax
xor edi, edi
mov dword [esp + 0x38], edi
cmp eax, edi
je 0x5e4701
mov ecx, eax
call fcn.005af310
mov edi, eax
mov edx, dword [esi + 0x580]
mov eax, dword [edx + 4]
lea ebx, [esi + 0x580]
push edi
mov ecx, ebx
mov dword [esp + 0x3c], 0xffffffff
call eax
mov ecx, dword [edi + 0x18]
mov edx, dword [ecx]
mov eax, dword [edi]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], eax
lea esp, [esp]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi]
lea eax, [esp + 0x24]
mov dword [esp + 0x28], ecx
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x28], edx
call fcn.005ad300
test al, al
je 0x5e477b
lea ecx, [esp + 0x1c]
call fcn.005ad830
mov eax, dword [eax]
cmp eax, dword [esp + 0x14]
jl 0x5e4766
cmp eax, dword [esp + 0x18]
jle 0x5e4770
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0xc]
mov ecx, ebx
call eax
lea ecx, [esp + 0x1c]
call fcn.005abca0
jmp 0x5e4730
mov ecx, edi
call fcn.005adab0
mov ecx, edi
call fcn.005aeac0
push edi
call fcn.00704960
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
add esp, 4
cmp edi, ebx
jg case.0x5e4807.13
mov ecx, dword [esi + 0x5a4]
mov edx, dword [ecx + 0x548]
mov eax, dword [edx]
add ecx, 0x548
push edi
call eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x14]
push str.AutoTableItem
call eax
test eax, eax
je 0x5e47d6
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x14]
push 1
call eax
inc edi
cmp edi, ebx
jle 0x5e47a2
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx ecx, word [eax + 0x14]
add ecx, 0xfffffff3
cmp ecx, 0x54
ja case.0x5e4807.14
movzx ecx, byte [ecx + 0x5e4c94]
jmp dword [ecx*4 + 0x5e4c68]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge case.0x5e4807.13
mov edx, dword [esi + 0x548]
mov eax, dword [edx + 0xc]
lea ecx, [esi + 0x548]
call eax
cmp eax, 1
jle 0x5e4842
cmp byte [esi + 0x58c], 0
je case.0x5e4807.13
mov ecx, esi
call fcn.005e1790
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x58d], 0
jne case.0x5e4807.13
mov ecx, dword [esi + 0x5a4]
mov edi, dword [esi + 0x590]
call fcn.005e8e40
cmp edi, eax
jge 0x5e488d
mov ecx, dword [esi + 0x5a4]
call fcn.005e8e40
add edi, eax
mov ecx, dword [esi + 0x5a4]
call fcn.005e8e40
sub edi, eax
js case.0x5e4807.13
lea ebx, [esi + 0x548]
mov edx, dword [ebx]
mov eax, dword [edx]
push edi
mov ecx, ebx
call eax
test eax, eax
je 0x5e48c3
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10c]
call eax
test al, al
jne 0x5e48dd
sub edi, 1
jns 0x5e48a6
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push edi
mov ecx, esi
call fcn.005e3f10
push edi
mov ecx, esi
call fcn.005e3360
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x58d], 0
jne case.0x5e4807.13
mov eax, dword [esi + 0x5a4]
mov edx, dword [eax + 0x548]
mov ebx, dword [esi + 0x590]
lea ecx, [eax + 0x548]
mov eax, dword [edx + 0xc]
call eax
mov ecx, dword [esi + 0x5a4]
mov edi, eax
call fcn.005e8e40
sub edi, eax
cmp ebx, edi
jl 0x5e494e
mov ecx, dword [esi + 0x5a4]
call fcn.005e8e40
sub ebx, eax
mov ecx, dword [esi + 0x5a4]
call fcn.005e8e40
mov edx, dword [esi + 0x548]
mov edi, eax
mov eax, dword [edx + 0xc]
add edi, ebx
lea ebx, [esi + 0x548]
mov ecx, ebx
call eax
cmp edi, eax
jge case.0x5e4807.13
mov edx, dword [ebx]
mov eax, dword [edx]
push edi
mov ecx, ebx
call eax
test eax, eax
je 0x5e4999
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10c]
call eax
test al, al
jne 0x5e48dd
mov edx, dword [ebx]
mov eax, dword [edx + 0xc]
mov ecx, ebx
inc edi
call eax
cmp edi, eax
jl 0x5e4978
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x58d], 0
jne case.0x5e4807.13
mov eax, dword [esi + 0x590]
cmp eax, 1
jge 0x5e49d9
mov eax, 1
lea edi, [eax - 1]
test edi, edi
jl case.0x5e4807.13
lea ebx, [esi + 0x548]
lea ebx, [ebx]
mov edx, dword [ebx]
mov eax, dword [edx]
push edi
mov ecx, ebx
call eax
test eax, eax
je 0x5e4a11
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10c]
call eax
test al, al
jne 0x5e48dd
sub edi, 1
jns 0x5e49f0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x58d], 0
jne case.0x5e4807.13
mov eax, dword [esi + 0x590]
cmp eax, 0xffffffff
jge 0x5e4a46
or eax, 0xffffffff
mov edx, dword [esi + 0x548]
lea edi, [esi + 0x548]
lea ebx, [eax + 1]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
cmp ebx, eax
jge case.0x5e4807.13
mov edx, dword [edi]
mov eax, dword [edx]
push ebx
mov ecx, edi
call eax
test eax, eax
je 0x5e4a81
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10c]
call eax
test al, al
jne 0x5e4aa4
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
inc ebx
call eax
cmp ebx, eax
jl 0x5e4a64
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0
push ebx
mov ecx, esi
call fcn.005e3f10
push ebx
mov ecx, esi
call fcn.005e3360
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0x1c4]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0x1c8]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x58d], 0
jne case.0x5e4807.13
mov edx, dword [esi + 0x548]
mov eax, dword [edx + 0xc]
lea edi, [esi + 0x548]
mov ecx, edi
xor ebx, ebx
call eax
test eax, eax
jle case.0x5e4807.13
mov edx, dword [edi]
mov eax, dword [edx]
push ebx
mov ecx, edi
call eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10c]
call eax
test al, al
jne 0x5e4aa4
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
inc ebx
call eax
cmp ebx, eax
jl 0x5e4b37
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp byte [esi + 0x58d], 0
jne case.0x5e4807.13
mov edx, dword [esi + 0x548]
mov eax, dword [edx + 0xc]
lea ebx, [esi + 0x548]
mov ecx, ebx
call eax
mov edi, eax
sub edi, 1
js case.0x5e4807.13
mov edx, dword [ebx]
mov eax, dword [edx]
push edi
mov ecx, ebx
call eax
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x10c]
call eax
test al, al
jne 0x5e48dd
sub edi, 1
jns 0x5e4ba2
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
movzx ecx, word [eax + 0x18]
sub ecx, 0
je 0x5e4c08
sub ecx, 1
jne case.0x5e4807.14
mov edx, dword [esi]
mov eax, dword [edx + 0x1c0]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0x1bc]
mov ecx, esi
call eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push eax
mov ecx, esi
call fcn.005b0d60
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4