Function at 0x556ab0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
add eax, 0xffffffd5
cmp eax, 0xea
push edi
mov edi, ecx
mov ebx, edx
ja case.0x556ad3.45
movzx eax, byte [eax + 0x556d1c]
jmp dword [eax*4 + 0x556d00]
test edi, edi
je 0x556b80
push str.RBInstance
push edi
call dword [sym.imp.USER32.dll_GetPropA]
mov edi, eax
test edi, edi
je case.0x556ad3.45
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
mov word [0x5f49b0], 0
call esi
test ax, ax
jns 0x556b19
or word [0x5f49b0], 0x1000
push 0x10
call esi
test ax, ax
jns 0x556b2b
or word [0x5f49b0], 0x200
push 0x12
call esi
test ax, ax
jns 0x556b3d
or word [0x5f49b0], 0x800
push 0x5b
call esi
test ax, ax
js 0x556b4f
push 0x5c
call esi
test ax, ax
jns 0x556b58
or word [0x5f49b0], 0x100
mov eax, dword [ebp + 0xc]
mov edx, dword [edi]
mov edx, dword [edx + 0x1e0]
movzx ecx, bx
push eax
push ecx
shr ebx, 0x10
push ebx
mov ecx, edi
call edx
test al, al
je case.0x556ad3.45
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 8]
xor esi, esi
call fcn.0041a660
test eax, eax
mov byte [esp + 0xc], 0
je 0x556ba3
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1ec]
call eax
mov byte [esp + 0xc], al
mov edx, dword [esp + 0xc]
movzx ecx, bx
push 1
push ecx
push edx
call fcn.004fd260
add esp, 0xc
test al, al
je case.0x556ad3.45
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.RBInstance
push edi
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je case.0x556ad3.45
mov edx, dword [eax]
mov edx, dword [edx + 0x1e8]
movzx ecx, bx
push ecx
mov ecx, eax
call edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.RBInstance
push edi
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je case.0x556ad3.45
mov edx, dword [eax]
mov edx, dword [edx + 0x1ec]
movzx ecx, bx
push ecx
mov ecx, eax
call edx
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
push str.RBInstance
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je case.0x556ad3.45
mov ecx, dword [ebp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x1e4]
push ecx
push edi
mov ecx, eax
call edx
test al, al
je case.0x556ad3.45
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne case.0x556ad3.45
cmp dword [edi], 1
jne case.0x556ad3.45
mov ebx, dword [edi + 0x14]
test ebx, ebx
jne 0x556c77
push 0x296
push str.........CommonWin32win32windows.cpp
xor esi, esi
mov edx, str.item
lea ecx, [ebx + 4]
call fcn.004f1fc0
add esp, 8
mov ecx, edi
mov edx, ebx
call fcn.005493c0
movzx eax, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
jne 0x556cc6
cmp dword [edi], 1
jne 0x556cc6
mov ebx, dword [edi + 0x2c]
test ebx, ebx
jne 0x556cb6
push 0x2a7
push str.........CommonWin32win32windows.cpp
xor esi, esi
mov edx, str.item
lea ecx, [ebx + 4]
call fcn.004f1fc0
add esp, 8
push ebx
call fcn.00549940
movzx eax, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 0x14]
push str.RBInstance
push eax
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je case.0x556ad3.45
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x1f0]
push edi
call eax
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], 1
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret