Function at 0x504b20
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xc8]
mov esi, dword [edi + 4]
mov ebx, ecx
cmp esi, 0x200
je 0x504b6a
cmp esi, 0xa0
je 0x504b6a
cmp esi, 0x2a3
je 0x504b6a
cmp esi, 0x202
je 0x504b6a
cmp esi, 0x205
je 0x504b6a
cmp esi, 0x208
jne 0x505178
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call ebp
test ax, ax
jl 0x505178
push 2
call ebp
test ax, ax
jl 0x505178
push 4
call ebp
test ax, ax
jl 0x505178
cmp dword [esp + 0xcc], 0
mov edi, dword [esp + 0xc4]
mov ebp, 0x401
jne 0x504be3
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax]
push ecx
call fcn.0047f1b7
test eax, eax
je 0x504bdb
mov esi, dword [sym.imp.USER32.dll_GetParent]
test dword [eax + 0x3c], ebp
jne 0x504bdb
mov edx, dword [eax + 0x20]
push edx
call esi
push eax
call fcn.0047f1b7
test eax, eax
jne 0x504bc6
cmp eax, edi
jne 0x505247
test edi, edi
jne 0x504beb
xor eax, eax
jmp 0x504bee
mov eax, dword [edi + 0x20]
push eax
call fcn.004dbec0
mov esi, eax
mov eax, dword [ebx + 0x60]
add esp, 4
mov dword [esp + 0x44], esi
test eax, eax
je 0x504c39
cmp dword [eax + 0x20], 0
je 0x504c39
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x504c39
test esi, esi
jne 0x504c39
mov ecx, dword [ebx + 0x60]
mov edx, dword [ecx + 0x20]
push esi
push esi
push ebp
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov ecx, edi
call fcn.0047f4bd
mov ecx, dword [ebx + 0x60]
mov esi, eax
test ecx, ecx
je 0x504c5c
call fcn.0043d080
cmp eax, esi
je 0x504c5c
mov ecx, dword [ebx + 0x60]
mov eax, dword [ecx]
mov edx, dword [eax + 0x60]
call edx
mov eax, dword [ebx + 0x60]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x504c77
cmp dword [eax + 0x20], 0
jne 0x504dd6
test eax, eax
jne 0x504c84
mov eax, dword [ebx]
mov edx, dword [eax + 0x50]
push esi
mov ecx, ebx
call edx
mov dword [ebx + 0x60], eax
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x505247
cmp dword [eax + 0x20], 0
jne 0x504cf2
push eax
push 0x5e2c74
call fcn.004900e7
mov ecx, dword [ebx + 0x60]
add esp, 8
test eax, eax
je 0x504cb9
mov eax, dword [ebx + 0x40]
or eax, 3
push eax
push esi
call fcn.005041e0
jmp 0x504cf2
push ecx
push 0x5d6550
call fcn.004900e7
add esp, 8
test eax, eax
je 0x505247
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x60]
mov edx, dword [ecx]
mov edx, dword [edx + 0x13c]
dec eax
neg eax
sbb eax, eax
and eax, 0xffffffc0
add eax, 0x40
or eax, dword [ebx + 0x40]
or eax, 3
push eax
push esi
call edx
mov ecx, dword [ebx + 0x60]
test ecx, ecx
je 0x505247
cmp dword [ecx + 0x20], 0
je 0x505247
push 1
lea eax, [ebx + 0x98]
push eax
call fcn.004bc2c0
mov ecx, dword [ebx + 0x3c]
mov edx, dword [ebx + 0x60]
mov eax, dword [edx + 0x20]
push ecx
push 0
push 0x418
push eax
call ebp
mov edx, dword [ebx + 0x60]
mov eax, dword [edx + 0x20]
lea ecx, [ebx + 0x44]
push ecx
push 0
push 0x41a
push eax
call ebp
mov eax, dword [ebx + 0x90]
or esi, 0xffffffff
cmp eax, esi
je 0x504d5b
mov ecx, dword [ebx + 0x60]
mov edx, dword [ecx + 0x20]
push 0
push eax
push 0x413
push edx
call ebp
mov eax, dword [ebx + 0x94]
cmp eax, esi
je 0x504d76
push 0
push eax
mov eax, dword [ebx + 0x60]
mov ecx, dword [eax + 0x20]
push 0x414
push ecx
call ebp
cmp dword [ebx + 0x58], esi
je 0x504d90
movzx edx, word [ebx + 0x58]
mov eax, dword [ebx + 0x60]
mov ecx, dword [eax + 0x20]
push edx
push 1
push 0x403
push ecx
call ebp
cmp dword [ebx + 0x54], esi
je 0x504daa
movzx edx, word [ebx + 0x54]
mov eax, dword [ebx + 0x60]
mov ecx, dword [eax + 0x20]
push edx
push 3
push 0x403
push ecx
call ebp
cmp dword [ebx + 0x5c], esi
je 0x504dc4
movzx edx, word [ebx + 0x5c]
mov eax, dword [ebx + 0x60]
mov ecx, dword [eax + 0x20]
push edx
push 2
push 0x403
push ecx
call ebp
mov edx, dword [ebx + 0x60]
mov eax, dword [edx + 0x20]
push 0
push 0
push 0x401
push eax
call ebp
mov ebp, dword [ebx + 0x60]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xc8]
mov ecx, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 0x20]
push eax
push ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x2c
lea edx, [esp + 0x4c]
push 0
push edx
call fcn.0049af70
add esp, 0xc
cmp dword [ebx + 0x20], 0
jne 0x504e44
cmp dword [ebx + 0x24], 0
mov dword [esp + 0x48], 0x28
je 0x504e4c
mov dword [esp + 0x48], 0x2c
mov ecx, dword [esp + 0x20]
mov edx, dword [ebx]
mov edx, dword [edx + 0x54]
lea eax, [esp + 0x24]
mov dword [esp + 0x70], eax
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x20]
push ecx
push eax
push edi
mov ecx, ebx
call edx
cmp dword [ebx + 0x20], 0
mov dword [esp + 0x10], eax
je 0x504ed0
mov esi, dword [esp + 0x24]
test esi, esi
je 0x504ed0
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x504ed0
mov eax, esi
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x504eb6
test dx, dx
je 0x504eb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x504eb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x504e90
xor eax, eax
jmp 0x504ebb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x504ed0
push esi
call fcn.0049bb08
add esp, 4
mov dword [esp + 0x24], 0
test byte [ebx + 0x40], 2
jne 0x504ef0
mov eax, dword [esp + 0x6c]
push eax
call fcn.004db990
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + 4]
push edx
call fcn.004db990
add esp, 8
mov eax, dword [ebx + 0x70]
cmp eax, dword [esp + 0x54]
jne 0x504f5f
mov ecx, dword [ebx + 0x6c]
cmp ecx, dword [esp + 0x50]
jne 0x504f5f
mov esi, dword [sym.imp.USER32.dll_CopyRect]
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x88]
xor edi, edi
push eax
mov dword [esp + 0x1c], edi
call esi
lea ecx, [ebx + 0x74]
push ecx
lea edx, [esp + 0x78]
push edx
call esi
lea eax, [esp + 0x84]
push eax
lea ecx, [esp + 0x78]
push ecx
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x504f68
cmp dword [esp + 0x10], 0xffffffff
je 0x50512c
mov edx, dword [esp + 0xc8]
push edx
push ebp
mov ecx, ebx
call fcn.00504800
jmp 0x50512c
mov edi, 1
mov dword [esp + 0x14], edi
cmp dword [ebx + 0x64], 0x28
lea eax, [ebx + 0x64]
mov dword [esp + 0x18], eax
jb 0x504f8a
test edi, edi
jne 0x504f8a
push eax
mov eax, dword [ebp + 0x20]
push edi
push 0x433
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0x10], 0xffffffff
je 0x5050d6
mov eax, dword [ebp + 0x20]
lea edx, [esp + 0x94]
push edx
mov ecx, 0xb
lea esi, [esp + 0x4c]
lea edi, [esp + 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x50]
push 0
push 0x432
and ecx, 0x3fffffff
push eax
mov dword [esp + 0xa8], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx + 0x30]
cmp eax, 3
je 0x505055
cmp eax, 6
je 0x505055
cmp eax, 7
je 0x505055
cmp dword [ebx + 0x34], 0x50050
jae 0x504ff0
test eax, eax
je 0x505055
cmp dword [ebx + 0x20], 0
je 0x50503e
cmp dword [esp + 0x24], 0
je 0x50503e
mov eax, dword [esp + 0x28]
test eax, eax
je 0x50503e
mov ecx, dword [ebx + 0x38]
push eax
push ecx
push 0x421
mov ecx, ebp
call fcn.0040d5c0
mov ecx, dword [ebp + 0x20]
mov edx, dword [esp + 0x24]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x94]
push eax
push 0
push 0x439
push ecx
mov dword [esp + 0xc8], edx
call esi
jmp 0x50505b
mov edx, dword [ebp + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x421
push edx
call esi
jmp 0x50505b
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebx + 0x24], 0
je 0x50509b
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x50508c
mov edx, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x28]
add edx, dword [esp + 0x10]
push eax
push edx
call fcn.004d6790
test eax, eax
je 0x50508c
push eax
mov eax, dword [ebp + 0x20]
push 0
push 0x2a49
push eax
jmp 0x505099
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0x2a49
push ecx
call esi
test dword [esp + 0x4c], 0x40000000
jne 0x5050ac
cmp dword [esp + 0x44], 0
je 0x5050ef
mov edx, dword [ebp + 0x20]
push 0
push 1
push 0x401
push edx
call esi
mov eax, dword [ebp + 0x20]
push 0x213
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x5050ef
mov ecx, dword [ebp + 0x20]
push 0
push 0
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0xc8]
push edx
push ebp
mov ecx, ebx
call fcn.00504800
mov eax, dword [esp + 0x18]
cmp dword [eax], 0x28
jb 0x50511d
cmp dword [esp + 0x14], 0
je 0x50511d
push eax
mov eax, dword [ebp + 0x20]
push 0
push 0x433
push eax
call esi
mov edi, dword [esp + 0x18]
mov ecx, 0xb
lea esi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
je 0x505145
cmp dword [esp + 0x68], 0
jne 0x505145
push eax
call fcn.0049bb08
add esp, 4
mov eax, dword [esp + 0x24]
test eax, eax
je 0x505156
push eax
call fcn.0049bb08
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x505247
push eax
call fcn.0049bb08
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
cmp dword [esp + 0xcc], 0
jne 0x5051c5
mov ecx, dword [edi]
push ecx
call fcn.0047f1b7
mov ebp, dword [esp + 0xc4]
test eax, eax
je 0x5051bd
mov edi, dword [sym.imp.USER32.dll_GetParent]
jmp 0x5051a0
cmp eax, ebp
je 0x5051c5
test dword [eax + 0x3c], 0x401
jne 0x5051bd
mov edx, dword [eax + 0x20]
push edx
call edi
push eax
call fcn.0047f1b7
test eax, eax
jne 0x5051a0
cmp eax, ebp
jne 0x505247
cmp esi, 0x100
jb 0x5051d5
cmp esi, 0x108
jbe 0x505240
lea eax, [esi - 0x104]
cmp eax, 3
jbe 0x505240
cmp esi, 0x201
je 0x505240
cmp esi, 0x203
je 0x505240
cmp esi, 0x204
je 0x505240
cmp esi, 0x206
je 0x505240
cmp esi, 0x207
je 0x505240
cmp esi, 0x209
je 0x505240
cmp esi, 0xa1
je 0x505240
cmp esi, 0xa3
je 0x505240
cmp esi, 0xa4
je 0x505240
cmp esi, 0xa6
je 0x505240
cmp esi, 0xa7
je 0x505240
cmp esi, 0xa9
jne 0x505247
mov ecx, ebx
call fcn.005048b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc