Function at 0x5709d0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xc]
push ebx
push esi
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], 0
xor eax, eax
push fcn.005709c0
push ebp
push 0x414e60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
cmp dword [eax + 0x7c], 0
jne 0x570ead
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov eax, 0x5f9ff8
mov edx, 1
mov ebx, 0x5f9ff8
call dword [ebx + 0xc4]
mov edx, dword [ebp - 8]
mov dword [edx + 0x7c], eax
mov eax, dword [ebp - 8]
mov byte [eax + 0x40], 0
mov eax, dword [ebp - 8]
mov ecx, 0x56f940
mov edx, dword [eax + 0x7c]
mov dword [edx + 0x4b0], ecx
mov dword [edx + 0x4b4], eax
xor eax, eax
push 0x570dbb
push ebp
push 0x415230
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x54]
test eax, eax
jle 0x570db0
sub eax, 1
je 0x570d10
sub eax, 1
je 0x570c70
sub eax, 1
je 0x570bc0
sub eax, 2
jne 0x570db0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
xor dl, dl
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a0]
mov ecx, dword [ecx]
call dword [ecx + 0xf4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
xor edx, edx
call fcn.0041b630
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x49c]
mov edx, 2
call fcn.0053ec60
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
mov eax, dword [eax + 0xe8]
mov edx, 0xa
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a4]
mov ecx, dword [ecx + 0xe8]
mov ecx, dword [ecx]
call dword [ecx + 0xa4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
mov eax, dword [eax + 0xe8]
mov edx, 1
call fcn.004a0910
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
mov edx, 0x14
call fcn.00501e20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
mov dl, 1
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a4]
mov ecx, dword [ecx]
call dword [ecx + 0xf4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
mov edx, 0x3c
call fcn.00502090
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, 0x26
call fcn.00501e20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a8]
xor dl, dl
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a8]
mov ecx, dword [ecx]
call dword [ecx + 0xf4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov edx, 0x60
call fcn.00502090
jmp 0x570db0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
xor edx, edx
call fcn.0041b630
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x49c]
mov edx, 2
call fcn.0053ec60
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
mov dl, 1
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a4]
mov ecx, dword [ecx]
call dword [ecx + 0xf4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, 0x16
call fcn.00501da0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, 0x26
call fcn.00501e20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a8]
xor dl, dl
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a8]
mov ecx, dword [ecx]
call dword [ecx + 0xf4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov edx, 0x60
call fcn.00502090
jmp 0x570db0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov edx, 3
call fcn.0041b630
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x49c]
xor edx, edx
call fcn.0053ec60
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
xor dl, dl
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a4]
mov ecx, dword [ecx]
call dword [ecx + 0xf4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, 0x14
call fcn.00501da0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, 0x14
call fcn.00501e20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a8]
mov edx, 0x38
call fcn.00501e20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov edx, 0x7b
call fcn.00502090
jmp 0x570db0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
xor edx, edx
call fcn.0041b630
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x49c]
mov edx, 2
call fcn.0053ec60
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a4]
mov dl, 1
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0x4a4]
mov ecx, dword [ecx]
call dword [ecx + 0xf4]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, 0x16
call fcn.00501da0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, 0x26
call fcn.00501e20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a8]
mov edx, 0x48
call fcn.00501e20
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov edx, 0x72
call fcn.00502090
nop word [eax + eax]
xor edx, edx
pop eax
add esp, 0xc
mov dword fs:[edx], eax
jmp 0x570dc0
cmp dword [ebp - 4], 0
jbe 0x570dd0
push 0
push dword [ebp - 4]
call sub.user32.dll_EnableWindow
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
lea edx, [ebp - 0xc]
call fcn.004a0ac0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0xe8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0xe8]
mov ecx, dword [ecx]
call dword [ecx + 0xa0]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x64]
call fcn.004a0650
mov edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0xe8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x7c]
mov ecx, dword [ecx + 0xe8]
mov ecx, dword [ecx]
call dword [ecx + 0xa4]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x58]
mov eax, dword [ebp - 8]
call fcn.0056fdd0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a8]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x5c]
call fcn.00503500
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.0041cb70
push 0x1b
call sub.user32.dll_GetAsyncKeyState
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x54]
cmp eax, 5
je 0x570e98
cmp eax, 7
je 0x570e98
mov eax, dword [ebp - 8]
push dword [eax + 0x4c]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x4a0]
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x48]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x44]
call fcn.00571220
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x7c]
call fcn.00500ce0
mov eax, dword [ebp - 8]
mov byte [eax + 0x80], 1
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.005709c0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret