Function at 0x4ef450
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0xdc]
push edi
call edx
mov ebx, dword [ebp + 8]
test al, al
jne 0x4ef4a4
mov eax, dword [ebx]
cmp eax, 8
jle 0x4ef4a4
cmp eax, 0x13
jge 0x4ef4a4
mov ecx, dword [esi + 0xb08]
push ebx
test ecx, ecx
je 0x4ef494
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, esi
call fcn.004eed60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp dword [ebx], 0x17
jne 0x4ef4e9
xor edi, edi
cmp dword [esi + 0x660], edi
jle 0x4ef4e9
lea ebx, [esi + 0x664]
lea esp, [esp]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ef584
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x660]
jl 0x4ef4c0
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0xe
jne 0x4ef535
mov eax, dword [esi]
mov edx, dword [eax + 0xcc]
mov ecx, esi
call edx
test al, al
je 0x4ef535
xor edi, edi
cmp dword [esi + 0x660], edi
jle 0x4ef535
lea ebx, [esi + 0x664]
mov edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ef5a1
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x660]
jl 0x4ef510
mov ebx, dword [ebp + 8]
mov eax, dword [esi + 0x660]
test eax, eax
jle 0x4ef5e2
cmp dword [ebx], 9
jne 0x4ef5e2
xor edi, edi
mov dword [esp + 0xc], 0xffffffff
test eax, eax
jle 0x4ef5c6
lea ebx, [esi + 0x664]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
jne 0x4ef5bf
inc edi
add ebx, 0x10
cmp edi, dword [esi + 0x660]
jl 0x4ef560
jmp 0x4ef5c3
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi + 0x164]
push 0
push edi
push str.link
mov ecx, esi
call fcn.004b0820
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [esp + 0xc], edi
mov ebx, dword [ebp + 8]
mov eax, dword [esp + 0xc]
cmp dword [esi + 0xb04], eax
je 0x4ef5e2
push esi
call fcn.004f0ad0
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xb04], ecx
cmp dword [esi + 0x660], 0
jle 0x4ef609
cmp dword [ebx], 0xa
jne 0x4ef609
cmp dword [esi + 0xb04], 0xffffffff
je 0x4ef609
push esi
call fcn.004f0ad0
mov dword [esi + 0xb04], 0xffffffff
mov eax, dword [ebx]
cmp eax, 0xd
je 0x4ef65c
cmp eax, 0xf
je 0x4ef65c
mov ecx, esi
cmp eax, 0xe
jne 0x4ef64d
mov edx, dword [esi]
mov eax, dword [edx + 0xcc]
call eax
test al, al
je 0x4ef72b
mov edx, dword [esi + 0x164]
push 0
push 0
push str.itemclick
mov ecx, esi
call fcn.004b0820
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push ebx
call fcn.004eed60
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esi]
mov eax, dword [edx + 0xcc]
mov ecx, esi
call eax
test al, al
je 0x4ef71b
mov ecx, dword [esi + 0xb08]
test ecx, ecx
je 0x4ef715
mov edx, dword [ecx]
mov eax, dword [edx + 0x30]
call eax
test al, al
jne 0x4ef6ea
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
je 0x4ef6d8
mov edx, dword [esi + 0x64c]
mov eax, dword [edx + 0x10]
lea ecx, [esi + 0x64c]
call eax
mov ecx, dword [esi + 0xb08]
test al, al
je 0x4ef6c6
mov edx, dword [ecx]
mov eax, dword [esi + 0x650]
mov edx, dword [edx + 0x34]
push eax
call edx
jmp 0x4ef715
mov eax, dword [ecx]
mov edx, dword [esi + 0x650]
mov eax, dword [eax + 0x28]
push 0
push edx
call eax
jmp 0x4ef715
mov ecx, dword [esi + 0xb08]
mov edx, dword [ecx]
mov eax, dword [edx + 0x40]
call eax
cmp eax, 1
jne 0x4ef6ff
mov edx, dword [esi + 0x64c]
mov eax, dword [edx + 0x10]
lea ecx, [esi + 0x64c]
call eax
test al, al
jne 0x4ef715
mov ecx, dword [esi + 0xb08]
mov eax, dword [esi + 0x650]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 0
push eax
call edx
push esi
call fcn.004f0ad0
mov esi, dword [esi + 0xb08]
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
push ebx
mov ecx, esi
call edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4