Function at 0x5ad4c0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x79ce64]
push esi
test eax, eax
mov eax, dword [0x79ce54]
push edi
mov esi, ecx
je 0x5ad4dd
mov eax, dword [0x79ce50]
dec eax
je 0x5ad925
dec eax
je 0x5ad58a
sub eax, 2
jne 0x5ad997
mov eax, dword [esi + 0x298]
test eax, eax
jne 0x5ad997
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x5ad523
fld dword [0x788548]
mov edx, dword [esi + 0xb8]
fstp dword [edx + 0x4c]
push 0x10
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x5ad53c
mov edx, dword [esi + 0xb8]
mov dword [edx + 0x44], 0xc2480000
cmp dword [0x839c58], 1
je 0x5ad997
mov eax, dword [esi + 0x294]
test eax, eax
je 0x5ad997
push 0x10
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
jne 0x5ad997
push 0x11
call edi
xor edx, edx
mov dl, ah
test dl, dl
jne 0x5ad997
mov eax, dword [esi + 0xb8]
pop edi
pop esi
mov dword [eax + 0x48], 0
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x12
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
jne 0x5ad6c5
push 0x10
call edi
xor edx, edx
mov dl, ah
test dl, dl
jne 0x5ad6c5
push 4
mov ecx, esi
call fcn.00530350
mov eax, dword [esi + 0x298]
test eax, eax
je 0x5ad61e
mov ecx, dword [esi + 0xb8]
movsx eax, word [esi + 0x2a2]
fld dword [ecx + 0x48]
fiadd dword [0x79ce3c]
mov dword [ebp - 4], eax
fisub dword [esi + 0xc4]
fild dword [ebp - 4]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 1
je 0x5ad5f7
fstp st(0)
fld dword [ebp - 4]
movsx edx, word [esi + 0x2a4]
mov dword [ebp - 4], edx
fild dword [ebp - 4]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 0x41
jne 0x5ad616
fstp st(0)
fld dword [ebp - 4]
fstp dword [ecx + 0x48]
jmp 0x5ad6b0
mov eax, dword [esi + 0x294]
test eax, eax
jne 0x5ad68e
push 6
mov ecx, 0x8365d0
call fcn.006d1980
test eax, eax
jne 0x5ad68e
mov ecx, dword [esi + 0xb8]
fld dword [ecx + 0x48]
fiadd dword [0x79ce3c]
fisub dword [esi + 0xc4]
fld dword [esi + 0x2cc]
fsub dword [0x7454c4]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 1
je 0x5ad66b
fstp st(0)
fld dword [ebp - 4]
fld dword [esi + 0x2cc]
fadd dword [0x7454c4]
fstp dword [ebp - 4]
fcom dword [ebp - 4]
fnstsw ax
test ah, 0x41
jne 0x5ad689
fstp st(0)
fld dword [ebp - 4]
fstp dword [ecx + 0x48]
jmp 0x5ad6b0
mov eax, dword [0x79ce3c]
mov ecx, dword [esi + 0xc4]
sub eax, ecx
push ecx
mov ecx, dword [esi + 0xb8]
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fstp dword [esp]
call fcn.00534460
mov ecx, dword [esi + 0xb8]
push ecx
fld dword [ecx + 0x48]
fstp dword [esp]
call fcn.0041bf70
add esp, 4
push 0x12
call edi
xor edx, edx
mov dl, ah
test dl, dl
jne 0x5ad7f0
push 0x10
call edi
xor ecx, ecx
mov cl, ah
test cl, cl
je 0x5ad7f0
mov eax, dword [0x79ce40]
mov edx, dword [esi + 0xc8]
sub eax, edx
mov dword [ebp - 4], 0x41200000
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x294]
test eax, eax
je 0x5ad712
mov dword [ebp - 4], 0x42280000
mov edx, dword [esi + 0xb8]
fld dword [edx + 0x44]
fisub dword [ebp - 8]
fstp dword [0x78854c]
mov eax, dword [esi + 0x298]
test eax, eax
je 0x5ad770
movsx eax, word [esi + 0x2aa]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld dword [0x78854c]
fcomp st(1)
fnstsw ax
test ah, 1
je 0x5ad75f
fstp dword [0x78854c]
movsx ecx, word [esi + 0x2a8]
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
jmp 0x5ad7c8
movsx ecx, word [esi + 0x2a8]
fstp st(0)
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
jmp 0x5ad7c8
fld dword [0x745704]
fsub dword [ebp - 4]
fld dword [0x78854c]
fcomp st(1)
fnstsw ax
test ah, 1
je 0x5ad790
fstp dword [0x78854c]
jmp 0x5ad792
fstp st(0)
push 0x11
call edi
xor edx, edx
mov dl, ah
test dl, dl
je 0x5ad7bf
mov eax, dword [esi + 0xb8]
fld dword [eax + 0x4c]
fcomp dword [0x788544]
fnstsw ax
test ah, 0x41
je 0x5ad7bf
fld dword [ebp - 4]
fsub dword [0x745700]
jmp 0x5ad7c8
fld dword [ebp - 4]
fsub dword [0x745760]
fld dword [0x78854c]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x5ad7df
fstp dword [0x78854c]
jmp 0x5ad7e1
fstp st(0)
fld dword [0x78854c]
mov ecx, dword [esi + 0xb8]
fstp dword [ecx + 0x44]
push 0x11
call edi
xor edx, edx
mov dl, ah
test dl, dl
je 0x5ad997
mov eax, dword [esi + 0xb8]
mov ecx, dword [esi + 0xc8]
fld dword [eax + 0x4c]
mov eax, dword [0x79ce40]
sub eax, ecx
mov ecx, dword [0x788548]
cdq
sub eax, edx
mov dword [ebp - 4], ecx
sar eax, 1
mov dword [ebp - 8], eax
fisub dword [ebp - 8]
fstp dword [0x788550]
mov eax, dword [esi + 0x294]
test eax, eax
je 0x5ad843
mov edx, dword [0x788544]
mov dword [ebp - 4], edx
mov eax, dword [esi + 0x298]
test eax, eax
je 0x5ad8b3
movsx eax, word [esi + 0x29c]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fld dword [0x788550]
fcomp st(1)
fnstsw ax
test ah, 1
je 0x5ad871
fstp dword [0x788550]
jmp 0x5ad873
fstp st(0)
movsx ecx, word [esi + 0x29e]
movsx edx, word [esi + 0x29c]
add ecx, edx
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
fld dword [0x788550]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x5ad90e
fstp dword [0x788550]
fld dword [0x788550]
mov edx, dword [esi + 0xb8]
pop edi
fstp dword [edx + 0x4c]
pop esi
mov esp, ebp
pop ebp
ret
push 5
mov ecx, 0x8365d0
call fcn.006d1980
test eax, eax
jne 0x5ad910
fld dword [0x788550]
fcomp dword [0x788540]
fnstsw ax
test ah, 1
je 0x5ad8e0
mov eax, dword [0x788540]
mov dword [0x788550], eax
fld dword [0x788550]
fcomp dword [ebp - 4]
fnstsw ax
test ah, 0x41
jne 0x5ad910
mov ecx, dword [ebp - 4]
pop edi
mov dword [0x788550], ecx
mov edx, dword [esi + 0xb8]
fld dword [0x788550]
fstp dword [edx + 0x4c]
pop esi
mov esp, ebp
pop ebp
ret
fstp st(0)
fld dword [0x788550]
mov edx, dword [esi + 0xb8]
pop edi
fstp dword [edx + 0x4c]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [0x7d69b8]
test eax, eax
je 0x5ad93a
push 0x12
mov ecx, 0x7d67b0
call fcn.00507160
mov eax, dword [esi]
push 0
push 0
push 0
push 0x12
mov ecx, esi
call dword [eax + 0x18]
mov edx, dword [esi]
push 0
push 0
push 0
push 0x47
mov ecx, esi
call dword [edx + 0x18]
mov eax, dword [0x79ce3c]
mov dword [esi + 0xcc], eax
mov ecx, dword [0x79ce40]
mov dword [esi + 0xd0], ecx
mov eax, dword [0x839c58]
cmp eax, 1
jne 0x5ad997
mov ecx, dword [0x7d6994]
test ecx, ecx
je 0x5ad997
mov edx, dword [ecx]
push 0
push 0
push 0
push 8
push 0x29
push 0
call dword [edx + 0x90]
pop edi
pop esi
mov esp, ebp
pop ebp
ret