Function at 0x4c9a10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x8000
push edi
test dword [esi + 0x3c], 0x800
je 0x4c9a9a
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test bx, ax
mov ebx, dword [ebp + 0xc]
je 0x4c9a9d
mov edi, dword [esi + 0x28]
test edi, edi
je 0x4c9a9d
cmp ebx, 0x26
je 0x4c9a48
cmp ebx, 0x28
jne 0x4c9a9d
mov eax, dword [esi + 0x2c]
test eax, eax
cmovne edi, eax
sub ebx, 0x26
je 0x4c9a7a
sub ebx, 2
jne 0x4c9a82
mov eax, dword [edi + 8]
test eax, eax
je 0x4c9a82
mov edi, eax
push edi
push esi
call fcn.004cc7f0
push ebx
push edi
push esi
call fcn.004c8200
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [edi + 4]
test eax, eax
cmovne edi, eax
push edi
push esi
call fcn.004cc7f0
push 0
push edi
push esi
call fcn.004c8200
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0xc]
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4c9b46
add ebx, 0xffffffdf
cmp ebx, 7
ja case.default.0x4c9abf
jmp dword [ebx*4 + 0x4c9cd4]
push 2
push esi
call fcn.004ccf50
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 3
push esi
call fcn.004ccf50
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 6
push esi
call fcn.004ccf50
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 7
push esi
call fcn.004ccf50
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push esi
call fcn.004ccf50
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 1
push esi
call fcn.004ccf50
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push esi
call fcn.004c8fe0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 1
push esi
call fcn.004c8fe0
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov edi, dword [esi + 0x2c]
add eax, 0xfffffff8
mov ebx, edi
cmp eax, 0x65
ja case.0x4c9b61.9
movzx eax, byte [eax + 0x4c9d24]
jmp dword [eax*4 + 0x4c9cf4]
test edi, edi
je case.default.0x4c9abf
push edi
call fcn.004c7210
add esp, 4
mov ebx, eax
jmp case.0x4c9b61.9
test edi, edi
je case.default.0x4c9abf
lea eax, [ebp + 8]
push eax
push edi
call fcn.004c71d0
add esp, 8
mov ebx, eax
jmp case.0x4c9b61.9
mov ebx, dword [esi + 0x1c]
jmp case.0x4c9b61.9
push esi
call fcn.004c9e80
add esp, 4
mov ebx, eax
jmp case.0x4c9b61.9
test edi, edi
je case.default.0x4c9abf
test byte [edi + 0x26], 0x20
je 0x4c9cb0
push 0
push edi
push esi
call fcn.004c7cb0
add esp, 0xc
jmp case.0x4c9b61.9
test edi, edi
je case.default.0x4c9abf
push edi
push esi
call fcn.004c9960
add esp, 8
test eax, eax
je case.0x4c9b61.9
test byte [edi + 0x26], 0x20
jne 0x4c9c08
push 0
push edi
push esi
call fcn.004c7e10
add esp, 0xc
jmp case.0x4c9b61.9
mov ebx, dword [edi + 0xc]
jmp case.0x4c9b61.9
push esi
call fcn.004c7f40
add esp, 4
jmp case.0x4c9b61.9
test edi, edi
je case.default.0x4c9abf
test byte [edi + 0x26], 0x20
jne case.0x4c9b61.9
push edi
push esi
call fcn.004c9960
add esp, 8
test eax, eax
je case.0x4c9b61.9
push 0
push edi
push esi
call fcn.004c7e10
add esp, 0xc
jmp case.0x4c9b61.9
test edi, edi
je case.default.0x4c9abf
test byte [edi + 0x26], 0x20
je case.0x4c9b61.9
push 0
push edi
push esi
call fcn.004c7cb0
add esp, 0xc
jmp case.0x4c9b61.9
push esi
call fcn.004c99c0
mov edx, eax
add esp, 4
mov eax, 1
cmp edx, eax
cmovl edx, eax
test edi, edi
je case.default.0x4c9abf
test edx, edx
jle case.0x4c9b61.9
cmp dword [ebp + 0xc], 0x22
jne 0x4c9c9a
lea eax, [ebp + 8]
push eax
push ebx
call fcn.004c71d0
add esp, 8
jmp 0x4c9ca3
push ebx
call fcn.004c7210
add esp, 4
test eax, eax
je case.0x4c9b61.9
mov ebx, eax
dec edx
jmp 0x4c9c81
test edi, edi
je case.default.0x4c9abf
mov ebx, dword [edi]
test ebx, ebx
je case.default.0x4c9abf
cmp ebx, edi
je case.default.0x4c9abf
push ebx
push esi
call fcn.004cc560
push 0
push ebx
push esi
call fcn.004c8200
add esp, 0x14
pop edi
pop esi
pop ebx
pop ebp
ret