Function at 0x452800
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
push esi
mov esi, ecx
mov eax, esi
mov ecx, dword [eax + 0xf8]
test ecx, ecx
jne 0x45284e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jne 0x452806
xor ebp, ebp
push edi
mov ecx, esi
call fcn.00450e70
mov edi, eax
test edi, edi
je 0x452869
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x120]
test eax, eax
je 0x452869
mov eax, dword [edi + 0x64]
test eax, eax
je 0x452869
pop edi
pop esi
mov eax, 2
pop ebp
ret 8
mov ebp, dword [eax + 0xf8]
test ebp, ebp
je 0x452820
mov eax, dword [ebp + 0x58]
test eax, eax
je 0x452820
pop esi
mov eax, 2
pop ebp
ret 8
mov eax, dword [esi + 0x120]
test eax, eax
jg 0x452a0d
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, esi
call fcn.00450e70
mov eax, dword [eax + 0x1c]
push esi
lea edx, [esp + 0x14]
push edx
push 0x285a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, esi
call fcn.0051af91
test eax, eax
je 0x452a0d
mov ecx, dword [esi + 0xc0]
push ecx
mov ecx, esi
call fcn.0044f6b0
mov edi, eax
test edi, edi
je 0x4528f1
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 0x6c]
test eax, eax
je 0x4528f1
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [edi]
push ecx
push edx
mov ecx, edi
call dword [eax + 0xcc]
cmp eax, 1
je 0x4529ae
cmp eax, 2
je 0x4529ae
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x452a0d
mov eax, dword [esp + 0x10]
add eax, 0xfffffff7
cmp eax, 0x17
ja case.0x452913.10
movzx eax, byte [eax + 0x452c4c]
jmp dword [eax*4 + 0x452c38]
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
push 0x11
call edi
test ax, ax
jge 0x452966
test ebp, ebp
je 0x452966
mov ecx, esi
call fcn.0044e940
mov ebx, eax
push ebx
push 0x57eee8
call fcn.00503cc1
add esp, 8
test eax, eax
je 0x452966
push 0x10
call edi
xor ecx, ecx
test ax, ax
setge cl
lea ecx, [ecx + ecx - 1]
push ecx
push ebx
mov ecx, ebp
call fcn.00457e70
test eax, eax
jne 0x4529a8
mov ebx, dword [esi]
push 0x10
call edi
xor edx, edx
test ax, ax
setl dl
mov ecx, esi
push edx
call dword [ebx + 0x1b4]
mov eax, dword [esi + 0xc0]
push eax
mov ecx, esi
call fcn.0044f6b0
mov esi, eax
test esi, esi
je 0x4529a8
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xc8]
test eax, eax
je 0x4529a8
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 0x68]
mov eax, 1
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
push 5
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
push 4
mov ecx, esi
call dword [eax + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi + 0xec]
test eax, eax
jne case.0x452913.10
mov ecx, esi
call fcn.0044e970
mov ecx, eax
call fcn.004576e0
mov ecx, esi
call fcn.00450e70
mov ecx, dword [eax + 0x1c]
push 0x20
push 0xf100
push 0x112
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov edi, dword [sym.imp.USER32.dll_GetFocus]
call edi
test eax, eax
je 0x452a39
call edi
mov edx, dword [esi + 0x1c]
push eax
push edx
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
jne 0x452843
mov eax, dword [esi + 0xf4]
test eax, eax
je 0x452a5f
cmp eax, 1
je 0x452a5f
cmp eax, 4
je 0x452a5f
cmp eax, 5
jne 0x452a5b
cmp dword [esi + 0xec], 1
je 0x452a5f
xor edi, edi
jmp 0x452a64
mov edi, 1
mov ecx, esi
call fcn.0044ec80
mov edx, dword [esp + 0x10]
lea ecx, [edx - 0x23]
cmp ecx, 5
ja case.default.0x452a7b
jmp dword [ecx*4 + 0x452c64]
test edi, edi
je 0x452aa0
mov edx, dword [esi]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
push eax
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
xor edx, edx
test eax, eax
setne dl
mov ecx, esi
add edx, 2
mov eax, edx
mov edx, dword [esi]
push eax
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
test edi, edi
je 0x452adb
mov edx, dword [esi]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
push eax
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
neg eax
sbb eax, eax
add eax, 3
push eax
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
xor ecx, ecx
test edi, edi
setne cl
inc ecx
push ecx
mov ecx, esi
call dword [eax + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
neg edi
sbb edi, edi
and edi, 3
push edi
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [esi]
push 6
mov ecx, esi
call dword [eax + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esi]
push 7
mov ecx, esi
call dword [edx + 0x1b4]
pop edi
pop esi
pop ebp
ret 8
test edx, edx
je 0x452c2d
push 2
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
test eax, eax
je 0x452c2d
mov ecx, esi
call fcn.004566b0
test eax, eax
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
je 0x452b92
push 0x11
call edi
test ax, ax
jl 0x452b92
mov eax, dword [esp + 0x10]
push eax
mov ecx, esi
call fcn.004524f0
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
test ebp, ebp
je 0x452bbc
push esi
push 0x57eee8
call fcn.00503cc1
add esp, 8
test eax, eax
je 0x452bbc
mov ecx, dword [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.0045a080
test eax, eax
jne 0x452a0d
push 0x11
mov dword [esp + 0x18], 0
call edi
test ax, ax
jl 0x452c17
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, esi
call fcn.00451cf0
mov edi, eax
cmp edi, 0xffffffff
je 0x452c17
mov edx, dword [esi]
push 2
push edi
mov ecx, esi
call dword [edx + 0x13c]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x452c0c
push edi
mov ecx, esi
call fcn.0044f6b0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xa8]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8
mov eax, dword [esp + 0x10]
cmp eax, 0x10
je 0x452c2d
cmp eax, 0x11
je 0x452c2d
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
pop edi
pop esi
mov eax, 1
pop ebp
ret 8