Function at 0x530390
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x72d4d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x8e0
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x50], esi
cmp dword [esi + 0x2c], ebx
je 0x530b35
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [0x80fe3c]
mov dword [ebp - 0x6c], str.Sunday
cmp eax, ebx
mov dword [ebp - 0x68], str.Monday
mov dword [ebp - 0x64], str.Tuesday
mov dword [ebp - 0x60], str.Wednesday
mov dword [ebp - 0x5c], str.Thursday
mov dword [ebp - 0x58], str.Friday
mov dword [ebp - 0x54], str.Saturday
je 0x530466
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x42]
mov eax, dword [ebp - 0x44]
and ecx, 0xffff
push ecx
mov ecx, dword [ebp - 0x48]
and edx, 0xffff
and ecx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [ebp + ecx*4 - 0x6c]
mov ecx, dword [ebp - 0x4a]
push eax
mov eax, dword [ebp - 0x46]
push edx
mov edx, dword [ebp - 0x4c]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [ebp - 0xec]
push str._d__02d__02d__s___02d:__02d:__02d
push eax
call fcn.0070dea8
add esp, 0x24
jmp 0x53059c
mov eax, dword [0x838078]
cmp eax, ebx
jbe 0x53059c
xor ecx, ecx
mov edi, eax
mov dword [ebp - 0x38], ecx
mov edx, 0x5f5e100
mov dword [ebp - 0x34], ecx
xor esi, esi
mov dword [ebp - 0x30], ecx
mov bl, 0x57
xor ecx, ecx
cmp edi, edx
jl 0x530496
sub edi, edx
inc ecx
cmp edi, edx
jge 0x53048f
mov eax, 0x66666667
imul edx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
test esi, esi
jle 0x5304ae
inc esi
jmp 0x5304b7
test ecx, ecx
jle 0x5304b9
mov esi, 1
test ecx, ecx
jne 0x5304c6
test esi, esi
jle 0x53052f
mov byte [ebp + esi - 0x39], 0x52
jmp 0x53052f
cmp ecx, 1
jne 0x5304d2
mov byte [ebp + esi - 0x39], 0x4f
jmp 0x53052f
cmp ecx, 2
jne 0x5304de
mov byte [ebp + esi - 0x39], 0x48
jmp 0x53052f
cmp ecx, 3
jne 0x5304ea
mov byte [ebp + esi - 0x39], 0x55
jmp 0x53052f
cmp ecx, 4
jne 0x5304f6
mov byte [ebp + esi - 0x39], 0x54
jmp 0x53052f
cmp ecx, 5
jne 0x530502
mov byte [ebp + esi - 0x39], 0x4e
jmp 0x53052f
cmp ecx, 6
jne 0x53050e
mov byte [ebp + esi - 0x39], 0x41
jmp 0x53052f
cmp ecx, 7
jne 0x53051a
mov byte [ebp + esi - 0x39], 0x53
jmp 0x53052f
cmp ecx, 8
jne 0x530526
mov byte [ebp + esi - 0x39], 0x45
jmp 0x53052f
cmp ecx, 9
jne 0x53052f
mov byte [ebp + esi - 0x39], bl
test edx, edx
jg 0x530489
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x42]
lea ecx, [ebp - 0x38]
and edx, 0xffff
push ecx
mov ecx, dword [ebp - 0x44]
push edx
mov edx, dword [ebp - 0x48]
and eax, 0xffff
and edx, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [ebp + edx*4 - 0x6c]
mov edx, dword [ebp - 0x4a]
push ecx
mov ecx, dword [ebp - 0x46]
push eax
mov eax, dword [ebp - 0x4c]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [ebp - 0xec]
push str._d__02d__02d__s___02d:__02d:__02d______s
push ecx
call fcn.0070dea8
mov esi, dword [ebp - 0x50]
add esp, 0x28
xor ebx, ebx
mov ecx, dword [0x79cb18]
lea edx, [ebp - 0xec]
push ebx
push edx
mov eax, dword [ecx + 0x28]
sub eax, 0x10
push eax
push 5
call fcn.0040f880
lea ecx, [ebp - 0xec]
push ebx
push ecx
mov ecx, dword [0x79cb18]
mov edx, dword [ecx + 0x28]
sub edx, 0x10
push edx
push 3
call fcn.0040f880
mov ecx, dword [0x79cb18]
mov edi, 0xf
lea eax, [ebp - 0xec]
push ebx
mov edx, dword [ecx + 0x28]
push eax
sub edx, edi
push edx
push 4
call fcn.0040f880
mov ecx, dword [0x79cb18]
lea eax, [ebp - 0xec]
push ebx
push eax
mov edx, dword [ecx + 0x28]
sub edx, 0x11
push edx
push 4
call fcn.0040f880
mov ecx, dword [0x79cb18]
lea eax, [ebp - 0xec]
push 0xffffff
push eax
mov edx, dword [ecx + 0x28]
sub edx, 0x10
push edx
push 4
call fcn.0040f880
push 0x83a340
lea eax, [ebp - 0x8ec]
push str._sScreenShot
push eax
mov dword [esi + 0x2c], ebx
call fcn.0070dea8
lea ecx, [ebp - 0x8ec]
push ebx
push ecx
call fcn.0071a511
add esp, 0x14
test eax, eax
je 0x530674
lea edx, [ebp - 0x8ec]
push edx
call fcn.0070f01e
add esp, 4
test eax, eax
jne 0x530b35
mov ecx, dword [0x7367f0]
mov al, byte [0x839d44]
push ecx
push ebx
push 0x839d44
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x2c], al
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
call fcn.0041fee0
mov edx, dword [ebp - 0x24]
xor esi, esi
cmp edx, ebx
mov dword [ebp - 4], ebx
jbe 0x53071a
mov ecx, dword [ebp - 0x28]
cmp edx, esi
jb 0x5306c4
cmp ecx, ebx
je 0x5306c4
lea ecx, [ebp - 0x2c]
call fcn.00444d90
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
lea eax, [ecx + esi]
jmp 0x5306c9
mov eax, 0x7367f4
mov al, byte [eax]
cmp al, 0x5c
je 0x5306ef
cmp al, 0x2f
je 0x5306ef
cmp al, 0x3a
je 0x5306ef
cmp al, 0x2a
je 0x5306ef
cmp al, 0x3f
je 0x5306ef
cmp al, 0x22
je 0x5306ef
cmp al, 0x3c
je 0x5306ef
cmp al, 0x3e
je 0x5306ef
cmp al, 0x7c
jne 0x530715
cmp edx, esi
jb 0x530707
cmp ecx, ebx
je 0x530707
lea ecx, [ebp - 0x2c]
call fcn.00444d90
mov edx, dword [ebp - 0x28]
lea eax, [edx + esi]
jmp 0x53070c
mov eax, 0x7367f4
mov byte [eax], 0x5f
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
inc esi
cmp edx, esi
ja 0x5306ad
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
mov cl, ah
mov eax, dword [0x80fe3c]
test cl, cl
je 0x530870
cmp eax, edi
je 0x5307d7
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x80feb8]
cmp eax, ebx
jne 0x53074d
mov eax, 0x7367f4
mov esi, dword [0x80feb8]
push ecx
push eax
push 0x83a340
lea edx, [ebp - 0x8ec]
inc esi
push str._sScreenShot_screen_s_03d.bmp
push edx
mov dword [0x80feb8], esi
call fcn.0070dea8
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071a511
add esp, 0x1c
test eax, eax
jne 0x530847
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x80feb8]
cmp eax, ebx
jne 0x53079c
mov eax, 0x7367f4
mov esi, dword [0x80feb8]
push ecx
push eax
push 0x83a340
lea ecx, [ebp - 0x8ec]
inc esi
push str._sScreenShot_screen_s_03d.bmp
push ecx
mov dword [0x80feb8], esi
call fcn.0070dea8
lea edx, [ebp - 0x8ec]
push ebx
push edx
call fcn.0071a511
add esp, 0x1c
test eax, eax
je 0x53078a
jmp 0x530847
mov eax, dword [0x80feb8]
mov ecx, eax
inc eax
mov dword [0x80feb8], eax
push ecx
push 0x83a340
lea eax, [ebp - 0x8ec]
push str._sScreenShot_screen_03d.jpg
push eax
call fcn.0070dea8
lea ecx, [ebp - 0x8ec]
push ebx
push ecx
call fcn.0071a511
add esp, 0x18
test eax, eax
jne 0x530847
mov eax, dword [0x80feb8]
lea edx, [ebp - 0x8ec]
mov ecx, eax
inc eax
push ecx
push 0x83a340
push str._sScreenShot_screen_03d.jpg
push edx
mov dword [0x80feb8], eax
call fcn.0070dea8
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071a511
add esp, 0x18
test eax, eax
je 0x53080f
push str.scr_logo.bmp
call fcn.005474c0
mov ecx, eax
call fcn.00547960
lea ecx, [ebp - 0x8ec]
push eax
push ecx
mov ecx, dword [0x79cb18]
call fcn.00410760
jmp 0x5309a8
cmp eax, edi
je 0x530914
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x80feb8]
cmp eax, ebx
jne 0x53088a
mov eax, 0x7367f4
mov esi, dword [0x80feb8]
push ecx
push eax
push 0x83a340
lea edx, [ebp - 0x8ec]
inc esi
push str._sScreenShot_screen_s_03d.jpg
push edx
mov dword [0x80feb8], esi
call fcn.0070dea8
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071a511
add esp, 0x1c
test eax, eax
jne 0x530984
mov eax, dword [ebp - 0x28]
mov ecx, dword [0x80feb8]
cmp eax, ebx
jne 0x5308d9
mov eax, 0x7367f4
mov esi, dword [0x80feb8]
push ecx
push eax
push 0x83a340
lea ecx, [ebp - 0x8ec]
inc esi
push str._sScreenShot_screen_s_03d.jpg
push ecx
mov dword [0x80feb8], esi
call fcn.0070dea8
lea edx, [ebp - 0x8ec]
push ebx
push edx
call fcn.0071a511
add esp, 0x1c
test eax, eax
je 0x5308c7
jmp 0x530984
mov eax, dword [0x80feb8]
mov ecx, eax
inc eax
mov dword [0x80feb8], eax
push ecx
push 0x83a340
lea eax, [ebp - 0x8ec]
push str._sScreenShot_screen_03d.jpg
push eax
call fcn.0070dea8
lea ecx, [ebp - 0x8ec]
push ebx
push ecx
call fcn.0071a511
add esp, 0x18
test eax, eax
jne 0x530984
mov eax, dword [0x80feb8]
lea edx, [ebp - 0x8ec]
mov ecx, eax
inc eax
push ecx
push 0x83a340
push str._sScreenShot_screen_03d.jpg
push edx
mov dword [0x80feb8], eax
call fcn.0070dea8
lea eax, [ebp - 0x8ec]
push ebx
push eax
call fcn.0071a511
add esp, 0x18
test eax, eax
je 0x53094c
push str.scr_logo.bmp
call fcn.005474c0
mov ecx, eax
call fcn.00547960
lea ecx, [ebp - 0x8ec]
push eax
push ecx
mov ecx, dword [0x79cb18]
call fcn.004116e0
lea edi, [ebp - 0x8ec]
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
mov dl, byte [ebp - 0x39]
push 1
not ecx
dec ecx
mov byte [ebp - 0x1c], dl
mov ebx, ecx
lea ecx, [ebp - 0x1c]
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
call fcn.004219f0
test al, al
je 0x5309ff
mov edi, dword [ebp - 0x18]
mov ecx, ebx
mov eax, ecx
lea esi, [ebp - 0x8ec]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
xor esi, esi
mov byte [ecx + ebx], 0
mov edi, str._is_Saved.
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [0x7367f0]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ebp - 4], 1
mov edi, ecx
mov ecx, dword [ebp - 0x14]
sub edx, ecx
cmp edx, edi
ja 0x530a28
call fcn.0070103b
cmp edi, esi
jbe 0x530ab7
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
lea ebx, [eax + edi]
call fcn.00421d90
cmp eax, ebx
jae 0x530a47
call fcn.0070103b
mov edx, dword [ebp - 0x18]
cmp edx, esi
je 0x530a6d
mov al, byte [edx - 1]
test al, al
je 0x530a6d
cmp al, 0xff
je 0x530a6d
cmp ebx, esi
jne 0x530a85
dec al
push esi
lea ecx, [ebp - 0x1c]
mov byte [edx - 1], al
call fcn.00420210
jmp 0x530ab7
cmp ebx, esi
jne 0x530a80
cmp edx, esi
je 0x530abe
push esi
lea ecx, [ebp - 0x1c]
call fcn.004219d0
jmp 0x530ab7
cmp dword [ebp - 0x10], ebx
jae 0x530a91
push ebx
lea ecx, [ebp - 0x1c]
call fcn.00421da0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov esi, str._is_Saved.
push ebx
lea edi, [edx + eax]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x1c]
call fcn.004219d0
xor esi, esi
mov eax, dword [ebp - 0x18]
cmp eax, esi
jne 0x530ac3
mov eax, 0x7367f4
push esi
push esi
push 0xff00
push eax
push 1
mov ecx, 0x7d67b0
call fcn.00510520
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
je 0x530afa
mov al, byte [ecx - 1]
test al, al
je 0x530af0
cmp al, 0xff
je 0x530af0
dec al
mov byte [ecx - 1], al
jmp 0x530afa
dec ecx
push ecx
call fcn.006ffa16
add esp, 4
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], esi
cmp ecx, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
je 0x530b35
mov al, byte [ecx - 1]
test al, al
je 0x530b2b
cmp al, 0xff
je 0x530b2b
dec al
pop edi
pop esi
mov byte [ecx - 1], al
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
dec ecx
push ecx
call fcn.006ffa16
add esp, 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret