Function at 0x45c2b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
cmp dword [0x615428], 0
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x45c4b4
mov eax, dword [esi + 0x6c]
test dword [eax + 0x60], 0x4000
jne 0x45c4b4
call fcn.00583987
cmp dword [esi + 0x8c], 0
je 0x45c3c7
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edi, dword [esi + 0x90]
mov ebx, dword [esi + 0x94]
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
sub edi, dword [esp + 0x10]
sub ebx, dword [esp + 0x14]
push 0x44
call ebp
mov ecx, eax
mov eax, edi
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jg 0x45c333
push 0x45
call ebp
mov ecx, eax
mov eax, ebx
cdq
xor eax, edx
sub eax, edx
cmp eax, ecx
jle 0x45c588
push 0x12
mov dword [esi + 0x8c], 0
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esi + 0x64]
mov edx, dword [ecx + 0x20]
movsx eax, ax
push esi
and eax, 0x10000000
push eax
push 0x2644
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x45c375
call dword [sym.imp.USER32.dll_ReleaseCapture]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, dword [0x61544c]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ebx, 1
mov dword [esi + 0x88], ebx
mov ecx, dword [0x615468]
push 0
call fcn.005827d1
add eax, dword [esi + 0x90]
push ebx
mov dword [esi + 0x98], eax
mov ecx, dword [0x615468]
call fcn.005827d1
add eax, dword [esi + 0x94]
pop edi
mov dword [esi + 0x9c], eax
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
cmp dword [esi + 0x88], 0
je 0x45c588
mov ecx, dword [0x615468]
push 0
call fcn.005827d1
mov ecx, dword [0x615468]
add dword [esp + 0x20], eax
push 1
call fcn.005827d1
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add ecx, eax
lea eax, [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x20]
push eax
push ecx
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
test byte [esp + 0x1c], 4
mov ebx, dword [esp + 0x14]
je 0x45c454
mov edi, dword [esi + 0x9c]
mov ecx, dword [esi + 0x98]
mov eax, ebx
sub eax, edi
cdq
mov ebp, eax
mov eax, dword [esp + 0x10]
xor ebp, edx
sub eax, ecx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
cmp ebp, eax
jle 0x45c44e
mov dword [esp + 0x10], ecx
jmp 0x45c458
mov ebx, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x10]
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x45c47a
mov edx, dword [eax + 0x10]
test edx, edx
je 0x45c47a
mov edi, 0x424f5743
cmp dword [eax + 8], edi
jne 0x45c47a
cmp dword [edx + 8], edi
jne 0x45c47a
mov eax, dword [esi + 0x68]
jmp 0x45c47d
mov eax, dword [esi + 0x64]
sub bx, word [esi + 0x9c]
sub cx, word [esi + 0x98]
push eax
movzx edx, bx
movzx eax, cx
mov ecx, dword [esi + 0x64]
shl edx, 0x10
or edx, eax
push edx
mov edx, dword [ecx + 0x20]
push 0x2645
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov ecx, dword [esi + 0x20]
lea eax, [esp + 0x20]
push eax
push ecx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, eax
cmp edi, dword [esi + 0x20]
jne 0x45c4e1
mov ecx, esi
call fcn.00583987
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx + 0x54]
cmp eax, 5
je 0x45c588
test eax, eax
je 0x45c588
mov eax, dword [esi + 0x84]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_IsChild]
mov ebx, 1
jne 0x45c51f
test byte [esi + 0xd8], bl
je 0x45c51b
push 0
push 0
jmp 0x45c539
test eax, eax
je 0x45c540
test byte [esi + 0xd8], 2
je 0x45c540
mov eax, dword [esi + 0x20]
cmp edi, eax
je 0x45c540
push edi
push eax
call ebp
test eax, eax
jne 0x45c540
push eax
push ebx
mov ecx, esi
call fcn.0045ae50
cmp dword [esi + 0x84], 0
jne 0x45c569
mov edx, dword [esi + 0x20]
push edx
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00583a2b
pop edi
mov dword [esi + 0x84], ebx
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
mov eax, dword [esi + 0x20]
cmp edi, eax
je 0x45c588
push edi
push eax
call ebp
test eax, eax
jne 0x45c588
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov dword [esi + 0x84], 0
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc