Function at 0x52632b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push ebp
mov ebp, esp
sub esp, 0xf0
mov ecx, dword [ebp - 0x35]
xor edx, dword [ebp - 0xa3]
mov ecx, dword [ebp - 0x59]
mov edx, edx
mov cl, 0x58
movzx ebx, ah
mov word [ebp - 0xa7], bx
test bx, cx
je 0x526386
mov dword [ebp - 0x18], ecx
mov eax, 0xb374
mov eax, dword [ebp - 0xb7]
mov dword [ebp - 0x86], edx
or ecx, 0x90f0
mov dword [ebp - 0xd5], ebx
mov eax, dword [ebp - 0xb9]
mov dword [ebp - 0xd7], ebx
mov byte [ebp - 0xaa], bh
cmp ebx, ecx
je 0x5263db
mov dword [ebp - 0xa4], edx
movzx eax, byte [0x57be70]
mov eax, eax
xor edx, ecx
lea edx, [ebp - 0xc6]
mov dword [ebp - 0xe7], edx
mov eax, 0x6ef
mov dword [ebp - 0xd], ecx
mov ebx, eax
add ecx, dword [ebp - 0x4a]
mov dword [ebp - 0x2e], ecx
mov dword [ebp - 0x75], edx
mov ecx, edx
mov dword [ebp - 8], eax
mov ebx, ecx
and eax, dword [ebp - 0xd]
movzx edx, dl
mov edx, eax
mov dword [ebp - 0xab], edx
mov eax, dword [ebp - 0x98]
or dword [ebp - 0xcc], eax
mov ebx, dword [ebp - 0x74]
mov word [0x57c256], cx
cmp ebx, 0xe03fc4d6
je 0x526411
add bh, bh
mov dword [0x57bb3e], edx
add dword [ebp - 0xc6], eax
mov eax, edx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0xd6], edx
mov ecx, ecx
mov dword [ebp - 0xb5], edx
movzx ecx, ch
mov ecx, ebx
mov edx, dword [ebp - 0xe3]
sub eax, edx
mov eax, eax
test eax, eax
je 0x526429
mov ecx, eax
mov dword [ebp - 0x2b], ecx
mov dword [ebp - 0x35], eax
mov dword [0x57b057], ecx
mov dword [0x57b625], edx
add dword [ebp - 0x26], eax
cmp edx, ecx
je 0x526498
mov edx, eax
mov dx, word [ebp - 0x9a]
mov eax, dword [ebp - 0xd0]
mov ebx, 0x41bd
mov ecx, ebx
mov eax, dword [ebp - 0xa3]
sub ch, byte [ebp - 0x46]
mov ebx, eax
mov dword [ebp - 0xa8], ebx
mov edx, edx
mov ecx, dword [ebp - 0x49]
and dword [0x57c038], ecx
mov ebx, 0xa20f
mov edx, ebx
mov dword [ebp - 0xb5], edx
add eax, dword [ebp - 0x1a]
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0xde]
mov dword [ebp - 0xe6], ebx
mov ecx, dword [ebp - 0xcb]
mov edx, 0x4e44
add eax, edx
mov eax, dword [ebp - 0xb7]
mov eax, 0xe187
mov dl, byte [ebp - 0x3a]
push eax
cmp ebx, eax
jno 0x5264f5
mov edx, 0x2807
mov ecx, eax
mov ecx, dword [ebp - 0xef]
mov dword [ebp - 0x50], eax
mov ebx, 0xa304
mov ecx, ebx
movzx ecx, dx
mov eax, dword [0x57b236]
mov dword [ebp - 0x16], edx
sub dword [ebp - 0x71], ebx
mov edx, ecx
mov ebx, eax
mov ebx, dword [ebp - 0x98]
mov dword [ebp - 0x83], ebx
mov eax, ecx
mov ebx, ecx
mov dword [ebp - 0xa4], edx
call fcn.005267bc
movzx eax, word [ebp - 0x48]
cmp edx, dword [str.BSBKAYIZUCWkONQUsL]
jns 0x526503
mov ebx, dword [ebp - 0xcd]
mov ecx, 0x67f1
pop edx
and ebx, edx
mov word [0x57c240], cx
mov eax, dword [ebp - 0x23]
lea edx, [0x57b9cf]
sub edx, ebx
cmp edx, eax
jmp 0x52654a
push ecx
cmp eax, dword [0x57bef1]
jae 0x526553
add dword [ebp - 0xd8], ecx
cmp ebx, eax
je 0x526560
mov dword [ebp - 0x46], ecx
mov ebx, dword [ebp - 0xb2]
add byte [ebp - 0x7f], ch
xor dword [ebp - 0x47], ebx
mov dword [ebp - 0xbb], ebx
cmp ebx, dword [0x57b4e1]
jae 0x5265bc
sub dword [ebp - 0x88], edx
or dword [ebp - 0x8d], ecx
xor ecx, dword [ebp - 0xab]
mov ecx, dword [0x57b958]
mov ebx, dword [ebp - 0x33]
mov ebx, 0x426e
mov dword [ebp - 0xa9], ebx
mov edx, ecx
lea eax, [ebp - 0x6e]
sub ecx, 0x6d93
or ebx, dword [ebp - 0x4f]
mov edx, 0x7884
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xb0], edx
movzx eax, dh
lea eax, [ebp - 0x9f]
mov ecx, dword [ebp - 0x65]
cmp edx, 0x40cec244
je 0x5265e3
add ebx, 0x34f3
mov ebx, ebx
mov edx, dword [ebp - 0x50]
sub ecx, ebx
xor dword [ebp - 0xc9], eax
lea ecx, [ebp - 0x5b]
mov ebx, edx
mov dword [ebp - 0xb0], ebx
cmp ebx, ebx
je 0x5265f8
or ecx, 0xc501
mov edx, dword [ebp - 0x23]
mov ecx, dword [ebp - 0x3a]
cmp ecx, eax
js 0x526608
mov dword [ebp - 0x95], eax
and dword [0x57bdf0], ecx
mov eax, ecx
lea ecx, [ebp - 0xc2]
mov ah, byte [ebp - 0x73]
and dword [ebp - 0x26], edx
or edx, 0x44b8
cmp ecx, dword [0x57b65a]
jne 0x52668c
mov ecx, 0xb105
xor dword [ebp - 0xad], eax
mov dword [ebp - 0x11], edx
mov eax, eax
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xda], eax
mov dword [ebp - 0x58], ecx
cmp ecx, dword [0x57b5f1]
jae 0x52668a
mov dword [ebp - 0x41], ebx
mov dword [ebp - 0x46], edx
mov eax, dword [ebp - 0x80]
mov ebx, 0xc8ee
mov al, ch
xor dword [0x57b09b], eax
and ax, word [0x57b6ee]
mov ebx, ecx
mov edx, dword [ebp - 0x33]
movzx ecx, bl
mov ebx, dword [ebp - 0xbd]
mov dword [ebp - 0x7e], ecx
call sub.KERNEL32.dll_FindFirstFileExA
mov ebx, dword [ebp - 0xd7]
mov dl, ch
cmp eax, 0xe21f178d
jno 0x5266dc
mov ecx, dword [ebp - 0xb6]
sub eax, dword [ebp - 0x65]
mov ecx, ebx
mov dword [ebp - 0xd9], edx
mov dword [ebp - 0x82], edx
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x14]
mov ebx, ebx
mov dword [ebp - 0xe7], ebx
mov eax, eax
mov ebx, dword [ebp - 0xbc]
mov eax, eax
lea eax, [ebp - 0x20]
sub ebx, dword [ebp - 0x37]
or dword [ebp - 0x90], edx
sub edx, dword [ebp - 0x9d]
sub edx, edx
mov dword [ebp - 0x56], edx
test dword [0x57b8a1], eax
je 0x5266fa
mov byte [ebp - 4], ah
test word [0x57bc27], dx
je 0x5266f0
call sub.USER32.dll_VkKeyScanExA
mov edx, 0x6c10
test edx, 0xf6a8ee5b
js 0x526772
test ebx, eax
je 0x52671e
mov dword [ebp - 0x14], ebx
sub ebx, 0x1cac
mov ecx, ebx
movzx ebx, bh
movzx edx, ah
mov eax, ebx
mov dword [ebp - 0x77], ecx
mov edx, edx
mov edx, dword [ebp - 0x7c]
mov ecx, eax
mov edx, 0x6100
mov ecx, dword [ebp - 0xe]
mov eax, ecx
add edx, dword [ebp - 0x3a]
mov dword [ebp - 0xed], eax
mov eax, dword [ebp - 0xae]
mov ebx, 0x4c1d
mov eax, dword [ebp - 7]
sub ebx, eax
mov ebx, dword [ebp - 0x96]
sub ebx, 0xaf4d
mov dword [ebp - 0x69], edx
mov edx, edx
mov ecx, dword [ebp - 0x7d]
mov eax, ecx
mov eax, edx
mov ebx, dword [ebp - 0x92]
mov edx, ebx
mov byte [ebp - 0x60], dh
mov edx, ecx
mov dword [ebp - 0x7e], edx
mov ecx, ecx
mov eax, edx
movzx ecx, al
mov dword [ebp - 0x26], edx
mov dword [0x57b33a], ecx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xde], edx
lea ebx, [ebp - 0x34]
mov edx, dword [ebp - 0x2a]
movzx ecx, cl
mov ebx, dword [ebp - 0xbb]
mov edx, eax
sub eax, 0xf0de
cmp edx, 0xe2161120
jae 0x5267b8
movzx edx, byte [0x57bd81]
mov ebx, dword [ebp - 0xb6]
and eax, dword [ebp - 0x50]
mov dword [ebp - 0x3b], ecx
pop edx
leave
pop ebx
ret