Function at 0x4aff3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b05c6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
sete al
cmp word [esi + 4], 0xd
jne 0x4aff92
mov edx, dword [ebx + 0x2e4]
cmp byte [edx + 0x57], 0
je 0x4aff92
mov eax, ebx
call fcn.004b3c8c
jmp 0x4b05ab
mov dx, word [esi + 4]
sub dx, 9
je 0x4affa6
sub dx, 4
je 0x4affa6
xor edx, edx
jmp 0x4affa8
mov dl, 1
test dl, al
je 0x4affba
mov edx, esi
mov eax, ebx
call fcn.00465fa4
jmp 0x4b05ab
cmp word [esi + 4], 0x24
jne 0x4affe9
mov eax, dword [ebx + 0x2e4]
cmp byte [eax + 0x57], 0
je 0x4affe9
xor edx, edx
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b05ab
cmp word [esi + 4], 0x23
jne 0x4b0026
mov eax, dword [ebx + 0x2e4]
cmp byte [eax + 0x57], 0
je 0x4b0026
mov edi, dword [ebx + 0x2e8]
mov eax, dword [edi + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b05ab
cmp word [esi + 4], 0x22
jne 0x4b00bc
mov eax, dword [ebx + 0x2e4]
cmp byte [eax + 0x57], 0
je 0x4b00bc
mov eax, dword [ebx + 0x2e8]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edi, eax
mov eax, dword [ebx + 0x2ec]
add edi, dword [eax + 0xc]
mov eax, dword [ebx + 0x2e8]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp edi, eax
jge 0x4b0092
mov edi, dword [ebx + 0x2e8]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x2ec]
add edx, dword [eax + 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x4b00b0
mov edi, dword [ebx + 0x2e8]
mov eax, dword [edi + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b05ab
cmp word [esi + 4], 0x21
jne 0x4b012b
mov eax, dword [ebx + 0x2e4]
cmp byte [eax + 0x57], 0
je 0x4b012b
mov eax, dword [ebx + 0x2e8]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, dword [ebx + 0x2ec]
cmp eax, dword [edx + 0xc]
jle 0x4b010f
mov edi, dword [ebx + 0x2e8]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x2ec]
sub edx, dword [eax + 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x4b011f
xor edx, edx
mov eax, dword [ebx + 0x2e8]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4b05ab
cmp word [esi + 4], 0xd
jne 0x4b0168
cmp byte [ebx + 0x264], 0
je 0x4b0168
mov word [esi + 4], 9
mov eax, ebx
call fcn.004670e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b0168
push 0
push 9
push pe_nt_image_headers32
mov eax, ebx
call fcn.004670e8
push eax
call sub.user32.dll_PostMessageA
cmp word [esi + 4], 0x27
jne 0x4b01bc
cmp dword [ebx + 0x27c], 0
je 0x4b01bc
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.004670e8
push eax
call sub.user32.dll_SendMessageA
call fcn.004081d4
movzx edi, ax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004b194c
mov eax, dword [ebp - 8]
call fcn.00404d58
cmp edi, eax
jl 0x4b01bc
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b05ab
cmp word [esi + 4], 0x2e
jne 0x4b0227
cmp dword [ebx + 0x27c], 0
je 0x4b0227
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.004670e8
push eax
call sub.user32.dll_SendMessageA
call fcn.004081d4
movzx edi, ax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004b194c
mov eax, dword [ebp - 0xc]
call fcn.00404d58
cmp edi, eax
jl 0x4b021e
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jne 0x4b021e
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b05ab
mov dl, 1
mov eax, ebx
call fcn.004b2b2c
cmp word [esi + 4], 0x25
jne 0x4b0274
cmp dword [ebx + 0x278], 0
je 0x4b0274
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.004670e8
push eax
call sub.user32.dll_SendMessageA
call fcn.004081d4
movzx edi, ax
mov eax, dword [ebx + 0x278]
call fcn.00404d58
cmp edi, eax
jg 0x4b0274
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b05ab
cmp word [esi + 4], 0x23
jne 0x4b02f9
cmp dword [ebx + 0x27c], 0
je 0x4b02f9
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b02bf
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004b194c
mov eax, dword [ebp - 0x10]
call fcn.00404d58
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
jmp 0x4b02e9
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004b194c
mov eax, dword [ebp - 0x14]
call fcn.00404d58
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
pop edx
sub edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b05ab
cmp word [esi + 4], 0x24
jne 0x4b0395
cmp dword [ebx + 0x278], 0
je 0x4b0395
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
jne 0x4b0345
mov eax, dword [ebx + 0x278]
call fcn.00404d58
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
jmp 0x4b0385
mov eax, dword [ebx + 0x278]
call fcn.00404d58
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004b194c
mov eax, dword [ebp - 0x18]
call fcn.00404d58
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d58
add edi, eax
push edi
push 0xb1
mov eax, ebx
call fcn.004670e8
push eax
call sub.user32.dll_SendMessageA
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b05ab
cmp word [esi + 4], 8
jne 0x4b03da
cmp dword [ebx + 0x278], 0
je 0x4b03da
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d58
inc eax
cmp edi, eax
jg 0x4b03d1
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b05ab
mov dl, 1
mov eax, ebx
call fcn.004b2b2c
cmp word [esi + 4], 0x2e
jne 0x4b04ac
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d58
cmp edi, eax
jl 0x4b04ac
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b194c
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jne 0x4b0445
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [ebx + 0x278]
call fcn.00404d58
pop edx
sub edx, eax
inc edx
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00404ff8
jmp 0x4b0473
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [ebx + 0x278]
call fcn.00404d58
pop edx
sub edx, eax
inc edx
lea eax, [ebp - 4]
pop ecx
call fcn.00404ff8
cmp word [ebx + 0x272], 0
jle 0x4b04a3
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004b18bc
dec eax
movsx edx, word [ebx + 0x272]
cmp eax, edx
jle 0x4b04a3
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4b05ab
mov dl, 1
mov eax, ebx
call fcn.004b2b2c
cmp word [esi + 4], 0x26
jne 0x4b04f4
mov eax, dword [ebx + 0x2e4]
cmp byte [eax + 0x57], 0
je 0x4b04f4
mov eax, dword [ebx + 0x2e8]
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jle 0x4b04ee
mov edi, dword [ebx + 0x2e8]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov word [esi + 4], 0
cmp word [esi + 4], 0x28
jne 0x4b0550
mov eax, dword [ebx + 0x2e4]
cmp byte [eax + 0x57], 0
je 0x4b0550
mov eax, dword [ebx + 0x2e8]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edi, eax
inc edi
mov eax, dword [ebx + 0x2e8]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp edi, eax
jge 0x4b054a
mov edi, dword [ebx + 0x2e8]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
inc edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov word [esi + 4], 0
mov edx, esi
mov eax, ebx
call fcn.00465fa4
cmp word [esi + 4], 0x2e
jne 0x4b0570
cmp byte [ebx + 0x237], 7
jne 0x4b0570
mov eax, ebx
call fcn.004b1d78
cmp dword [ebx + 0x278], 0
je 0x4b05ab
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov esi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d58
cmp esi, eax
jge 0x4b05ab
mov eax, dword [ebx + 0x278]
call fcn.00404d58
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b05cd
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404aac
ret