Function at 0x563fae
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x623170
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push ebp
mov ebx, dword [esp + 0x60]
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x60]
xor ecx, ecx
mov eax, dword [esi + 0x44]
cmp eax, ecx
je 0x563fe6
mov ebp, dword [esp + 0x64]
mov dword [esp + 0x68], ecx
mov ecx, dword [esi + 0x48]
lea edx, [esp + 0x68]
push ecx
push esi
push ebx
push ebp
push edi
push edx
call eax
add esp, 0x18
test al, al
je 0x563fec
mov eax, dword [esp + 0x68]
jmp 0x56425e
mov ebp, dword [esp + 0x64]
jmp 0x563fee
xor ecx, ecx
cmp edi, 0x83
jne 0x564022
mov esi, dword [sym.imp.USER32.dll_CopyRect]
lea eax, [esp + 0x2c]
push ebx
push eax
call esi
push 2
push 0
push 1
push 1
lea ecx, [esp + 0x3c]
call fcn.005ee355
lea ecx, [esp + 0x2c]
push ecx
push ebx
call esi
jmp 0x56425c
cmp edi, 0x85
jne 0x5640ef
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0x1c]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
lea eax, [esp + 0x2c]
mov ecx, esi
push eax
call fcn.005e0f44
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
jne 0x56425c
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_OffsetRect]
lea eax, [esp + 0x1c]
neg edi
neg ebx
push edi
push ebx
push eax
call ebp
push edi
lea ecx, [esp + 0x30]
push ebx
push ecx
call ebp
push esi
lea ecx, [esp + 0x40]
call fcn.005e114e
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x3c]
push edx
mov dword [esp + 0x5c], 0
call fcn.005e0d52
mov ecx, 0x6c6940
call fcn.00524d60
mov edx, dword [eax]
push 0
push esi
push 5
mov ecx, eax
call dword [edx + 0x38]
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x44]
call fcn.005ee0f0
lea ecx, [esp + 0x3c]
mov dword [esp + 0x58], 0xffffffff
call fcn.005e11c0
jmp 0x56425c
cmp edi, 0x87
jne 0x564101
mov eax, 0x86
jmp 0x56425e
cmp edi, 0x204
je 0x56425c
cmp edi, 0x205
je 0x56425c
cmp edi, 0x206
je 0x56425c
cmp edi, 0x7b
je 0x56425c
cmp edi, 0x100
jne 0x56445b
cmp ebp, 0x1b
je 0x564406
cmp ebp, 0x12
je 0x5643ea
cmp ebp, 0xd
jne 0x564273
mov dl, byte [esi + 0x54]
or dl, 1
mov byte [esi + 0x54], dl
mov ecx, dword [0x6abf00]
mov dword [esp + 0x64], ecx
lea edx, [esp + 0x64]
mov ecx, esi
push edx
mov dword [esp + 0x5c], 1
call fcn.005da6b4
test esi, esi
jne 0x564184
xor ebx, ebx
jmp 0x564187
mov ebx, dword [esi + 0x1c]
mov edi, dword [esi + 0x3c]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
test edi, edi
je 0x5641f5
mov eax, dword [esp + 0x64]
mov edx, 0x6b3df8
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x5641a6
mov edx, eax
test ecx, ecx
jne 0x5641af
mov eax, 0x6b3df8
push edx
push eax
mov eax, dword [esi + 0x48]
push eax
push esi
call edi
add esp, 0x10
test al, al
je 0x56422d
push ebx
call ebp
test eax, eax
je 0x56424b
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x5641ee
mov eax, dword [esp + 0x64]
mov edx, dword [eax - 8]
test edx, edx
jne 0x5641e1
mov eax, 0x6b3df8
mov edx, dword [esi + 0x48]
push eax
push edx
push esi
call ecx
add esp, 0xc
jmp 0x56422d
lea eax, [esp + 0x64]
push eax
jmp 0x564225
push ebx
call ebp
test eax, eax
je 0x56424b
mov eax, dword [esi + 0x40]
test eax, eax
je 0x564220
mov ecx, dword [esp + 0x64]
mov edx, dword [ecx - 8]
test edx, edx
jne 0x564213
mov ecx, 0x6b3df8
push ecx
mov ecx, dword [esi + 0x48]
push ecx
push esi
call eax
add esp, 0xc
jmp 0x56422d
lea edx, [esp + 0x64]
push edx
mov ecx, dword [esi + 0x4c]
call fcn.005dd29d
push ebx
call ebp
test eax, eax
je 0x56424b
mov ecx, esi
call fcn.005646f0
mov eax, dword [eax + 0x1c]
push 0
push 0
push 0x1f
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0x64]
mov dword [esp + 0x58], 0xffffffff
call fcn.005dd1b0
xor eax, eax
mov ecx, dword [esp + 0x50]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x4c
ret 0xc
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
mov byte [esp + 0x68], al
je 0x56429f
mov ecx, esi
call fcn.005646f0
mov ecx, dword [eax + 0x1c]
push 0
push 0
push 0x1f
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x56425c
mov edx, dword [0x6abf00]
mov dword [esp + 0x60], edx
lea eax, [esp + 0x60]
mov ecx, esi
push eax
mov dword [esp + 0x5c], 2
call fcn.005da6b4
mov ecx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb0
push ecx
call edi
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0xb
push edx
mov ebp, eax
call edi
mov eax, dword [esp + 0x64]
push ebx
push eax
push 0x100
mov ecx, esi
call fcn.005dabce
mov ecx, dword [0x6abf00]
mov ebx, eax
mov dword [esp + 0x18], ecx
lea edx, [esp + 0x18]
mov ecx, esi
push edx
mov byte [esp + 0x5c], 3
call fcn.005da6b4
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x5643a0
mov edx, dword [esp + 0x18]
mov ecx, dword [edx - 8]
test ecx, ecx
jne 0x56432a
mov edx, 0x6b3df8
mov ecx, dword [esp + 0x60]
cmp dword [ecx - 8], 0
jne 0x564339
mov ecx, 0x6b3df8
push edx
push ecx
mov ecx, dword [esi + 0x48]
push ecx
push esi
call eax
add esp, 0x10
test al, al
jne 0x5643a0
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call edi
mov ecx, dword [esp + 0x60]
mov edx, dword [esi + 0x1c]
push ecx
push 0
push 0xc2
push edx
call edi
mov ecx, dword [esi + 0x1c]
mov eax, ebp
shr eax, 0x10
and ebp, 0xffff
push eax
push ebp
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 1
push 0xb
push eax
call edi
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 2
call fcn.005dd1b0
lea ecx, [esp + 0x60]
mov dword [esp + 0x58], 0xffffffff
call fcn.005dd1b0
mov eax, ebx
jmp 0x56425e
mov ecx, esi
call fcn.005646f0
mov eax, dword [eax + 0x1c]
push 0
push 0
push 0x1f
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x56425c
mov ecx, esi
call fcn.005646f0
mov edi, eax
mov ecx, edi
mov edx, dword [edi]
call dword [edx + 0xf0]
mov ecx, edi
mov ebx, eax
call fcn.005dcea8
mov eax, dword [edi]
mov esi, dword [esi + 0x1c]
push 0
mov ecx, edi
call dword [eax + 0x188]
mov ebp, dword [sym.imp.USER32.dll_IsWindow]
push esi
call ebp
test eax, eax
je 0x56425c
mov edx, dword [edi]
push 1
push 1
push 0
push ebx
mov ecx, edi
call dword [edx + 0x190]
push esi
call ebp
jmp 0x56425c
cmp edi, 0x102
jne 0x5645b1
mov eax, dword [0x6abf00]
mov dword [esp + 0x68], eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x58], 4
push ecx
mov ecx, esi
call fcn.005da6b4
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xb0
push edx
call edi
mov ebp, eax
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb
push eax
call edi
mov ecx, dword [esp + 0x64]
push ebx
push ecx
push 0x102
mov ecx, esi
call fcn.005dabce
mov edx, dword [0x6abf00]
mov ebx, eax
mov dword [esp + 0x60], edx
lea eax, [esp + 0x60]
mov ecx, esi
push eax
mov byte [esp + 0x5c], 5
call fcn.005da6b4
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x564567
mov edx, dword [esp + 0x60]
mov ecx, dword [edx - 8]
test ecx, ecx
jne 0x5644f1
mov edx, 0x6b3df8
mov ecx, dword [esp + 0x68]
cmp dword [ecx - 8], 0
jne 0x564500
mov ecx, 0x6b3df8
push edx
push ecx
mov ecx, dword [esi + 0x48]
push ecx
push esi
call eax
add esp, 0x10
test al, al
jne 0x564567
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
push 0
push 0xb1
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call edi
mov ecx, dword [esp + 0x68]
mov edx, dword [esi + 0x1c]
push ecx
push 0
push 0xc2
push edx
call edi
mov ecx, dword [esi + 0x1c]
mov eax, ebp
shr eax, 0x10
and ebp, 0xffff
push eax
push ebp
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 1
push 0xb
push eax
call edi
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esi + 0x1c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
lea ecx, [esp + 0x60]
mov byte [esp + 0x58], 4
call fcn.005dd1b0
lea ecx, [esp + 0x68]
mov dword [esp + 0x58], 0xffffffff
call fcn.005dd1b0
mov eax, ebx
jmp 0x56425e
cmp edi, dword [0x6c6c40]
jne 0x564689
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ecx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0xb0
push edx
call edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
je 0x564603
mov eax, dword [esi + 0x1c]
push 0x6b3df8
push 0
push 0xc2
push eax
call edi
jmp 0x56425c
mov ecx, dword [esi + 0x1c]
push 0
push 0
inc eax
push 0xb
push ecx
mov dword [esp + 0x20], eax
call edi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x1c]
push edx
push eax
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0x6b3df8
push 0
push 0xc2
push eax
call edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 0x1c]
push eax
push eax
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 1
push 0xb
push eax
call edi
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x56425c
cmp edi, dword [0x6c6c3c]
jne 0x5646b9
mov edx, dword [esi + 0x1c]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffffffffffffffff
push ecx
push 0xb1
push edx
call edi
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call edi
jmp 0x56425c
cmp edi, 8
jne 0x5646d9
push ecx
mov ecx, esi
call fcn.005dce3f
test byte [esi + 0x54], 1
jne 0x5646d9
mov ecx, dword [esi + 0x4c]
mov edx, dword [ecx]
mov ecx, esi
push edx
call fcn.005dccfa
push ebx
push ebp
push edi
mov ecx, esi
call fcn.005dabce
jmp 0x56425e