Function at 0x505ee4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_GetParent
mov ebx, eax
push 0x461
push ebx
call sub.USER32.dll_GetDlgItem
mov edi, eax
call sub.USER32.dll_GetFocus
cmp edi, eax
jne 0x505f14
xor eax, eax
jmp 0x5061ef
push 0x57ac8f
push 0x3e7
push 0xd
push 0x480
push ebx
call sub.USER32.dll_SendDlgItemMessageA
cmp byte [0x57ac8f], 0
je 0x505f5a
push 0x2a
push 0x57ac8f
call fcn.0054c230
add esp, 8
test eax, eax
jne 0x505f5a
push 0x3f
push 0x57ac8f
call fcn.0054c230
add esp, 8
test eax, eax
je 0x505f61
xor eax, eax
jmp 0x5061ef
push 0x585c44
push 0x64
push 0xd
push 0x98
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
mov byte [0x585c44], 0
push 0x57a8a8
push 0x64
push 0xd
push 0x98
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
mov ebx, 0x57a8a8
jmp 0x505f9c
inc ebx
cmp byte [ebx], 0x20
je 0x505f9b
cmp byte [ebx], 0
je 0x505ff0
push esi
mov esi, 0x585c44
mov edi, ebx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x585c44
call fcn.0054c2d0
pop ecx
mov edi, eax
dec edi
lea eax, [edi + 0x585c44]
jmp 0x505fe7
mov byte [eax], 0
dec edi
dec eax
test edi, edi
jle 0x505ff0
cmp byte [eax], 0x20
je 0x505fe2
cmp byte [0x585c44], 0
jne 0x50601d
push 0x98
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
push 0
call fcn.0042c4bf
mov eax, 1
jmp 0x5061ef
mov ebx, 1
push 0x90
push dword [ebp + 8]
call sub.USER32.dll_IsDlgButtonChecked
cmp eax, 1
je 0x506035
dec ebx
mov dword [0x56b8a4], ebx
mov ebx, 1
push 0x97
push dword [ebp + 8]
call sub.USER32.dll_IsDlgButtonChecked
cmp eax, 1
je 0x506053
dec ebx
mov dword [0x56b8a0], ebx
mov ebx, 1
push 0x92
push dword [ebp + 8]
call sub.USER32.dll_IsDlgButtonChecked
cmp eax, 1
je 0x506071
dec ebx
mov dword [0x56b8b4], ebx
push 0x3e7
push 0x585e28
call fcn.0042e3f0
test esi, esi
je 0x506101
xor edi, edi
mov ebx, dword [esi + 0x1c]
jmp 0x5060f8
push ebx
call fcn.0054c2d0
pop ecx
mov esi, eax
add esi, ebx
inc esi
test edi, edi
jne 0x5060af
cmp byte [esi], 0
je 0x5060af
mov edi, 1
mov ebx, esi
jmp 0x5060f8
push 0x585e28
call fcn.0054c2d0
pop ecx
push eax
push ebx
call fcn.0054c2d0
pop ecx
pop edx
add edx, eax
cmp edx, 0x3b5
ja 0x506101
cmp byte [0x585e28], 0
je 0x5060e8
push 0x56bc20
push 0x585e28
call fcn.0054c1f4
add esp, 8
push ebx
push 0x585e28
call fcn.0054c1f4
add esp, 8
mov ebx, esi
test ebx, ebx
je 0x506101
cmp byte [ebx], 0
jne 0x506091
cmp byte [0x585e28], 0
jne 0x506127
push 0x460
push dword [ebp + 8]
call sub.USER32.dll_GetDlgItem
push eax
call sub.USER32.dll_SetFocus
mov eax, 1
jmp 0x5061ef
push 0x12
call sub.USER32.dll_GetKeyState
movsx edx, ax
and edx, 0x8000
cmp edx, 0x8000
jne 0x506183
push 0x53
call sub.USER32.dll_GetKeyState
movsx ecx, ax
and ecx, 0x8000
cmp ecx, 0x8000
je 0x506183
push 9
push 0x585e28
call fcn.0054c230
add esp, 8
test eax, eax
jne 0x50617c
call fcn.004127e5
push eax
push 0
push 0x585e28
call fcn.0050b5a6
mov eax, 1
jmp 0x5061ef
push 0
push 0
push 0x147
push 0x9a
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
cmp eax, 0xffffffff
jne 0x5061a0
xor eax, eax
mov dword [0x56b8a8], 0x200
test eax, eax
jle 0x5061c1
mov edx, dword [0x56b8a8]
add edx, edx
mov dword [0x56b8a8], edx
dec eax
test eax, eax
jg 0x5061ae
cmp dword [0x56b8a8], 0x200
jge 0x5061d7
mov dword [0x56b8a8], 0x200
cmp dword [0x56b8a8], 0x2000
jle 0x5061ed
mov dword [0x56b8a8], 0x2000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8