Function at 0x4f9aec
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0
mov eax, dword [ebp - 8]
test eax, eax
jns 0x4f9b0f
call fcn.00403c14
push eax
call sub.user32.dll_MapVirtualKeyA
test eax, eax
jns 0x4f9b1e
call fcn.00403c14
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 8], 0xa1
je 0x4f9b4a
cmp dword [ebp - 8], 0xa3
je 0x4f9b4a
cmp dword [ebp - 8], 0xa5
je 0x4f9b4a
cmp dword [ebp - 8], 0x385
jne 0x4f9b93
cmp dword [ebp - 8], 0xa1
jne 0x4f9b5a
mov dword [ebp - 8], 0x10
cmp dword [ebp - 8], 0xa3
jne 0x4f9b6a
mov dword [ebp - 8], 0x11
cmp dword [ebp - 8], 0xa5
jne 0x4f9b7a
mov dword [ebp - 8], 0x12
cmp dword [ebp - 8], 0x385
jne 0x4f9b8a
mov dword [ebp - 8], 0xd
mov dword [ebp - 0x18], 1
jmp 0x4f9be5
cmp dword [ebp - 8], 0x26
je 0x4f9bab
cmp dword [ebp - 8], 0x28
je 0x4f9bab
cmp dword [ebp - 8], 0x25
je 0x4f9bab
cmp dword [ebp - 8], 0x27
jne 0x4f9bb4
mov dword [ebp - 0x18], 1
jmp 0x4f9be5
cmp dword [ebp - 8], 0x2d
je 0x4f9bde
cmp dword [ebp - 8], 0x2e
je 0x4f9bde
cmp dword [ebp - 8], 0x24
je 0x4f9bde
cmp dword [ebp - 8], 0x23
je 0x4f9bde
cmp dword [ebp - 8], 0x21
je 0x4f9bde
cmp dword [ebp - 8], 0x22
je 0x4f9bde
cmp dword [ebp - 8], 0x6f
jne 0x4f9be5
mov dword [ebp - 0x18], 1
cmp byte [ebp + 8], 0
je 0x4f9ff4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x654]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4fa16a
cmp dword [ebp - 8], 0x10
jne 0x4f9c18
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c4], eax
cmp dword [ebp - 8], 0x11
jne 0x4f9c2a
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x9c8], eax
cmp dword [ebp - 8], 0x12
jne 0x4f9c3c
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x9cc], eax
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x14]
and eax, 0xff
shl eax, 0x10
add dword [ebp - 0x2c], eax
jae 0x4f9c58
call fcn.00403c1c
cmp dword [ebp - 0x18], 0
je 0x4f9c6c
add dword [ebp - 0x2c], 0x1000000
jae 0x4f9c6c
call fcn.00403c1c
cmp dword [ebp - 0xc], 0
je 0x4f9c7c
cmp dword [ebp - 0xc], 1
jne 0x4f9f78
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c4], 0
je 0x4f9ccd
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9c4]
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
jne 0x4f9d25
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9c4]
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x20], 1
jmp 0x4f9d25
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
je 0x4f9cf9
push 0
mov ecx, 2
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x20], 0xffffffff
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
je 0x4f9d25
push 0
mov ecx, 2
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x20], 0xfffffffe
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9c8], 0
je 0x4f9d67
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9c8]
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
jne 0x4f9dbf
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9c8]
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x24], 1
jmp 0x4f9dbf
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
je 0x4f9d93
push 0
mov ecx, 2
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x24], 0xffffffff
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
je 0x4f9dbf
push 0
mov ecx, 2
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x24], 0xfffffffe
mov eax, dword [ebp - 4]
cmp dword [eax + 0x9cc], 0
je 0x4f9e01
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9cc]
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
jne 0x4f9e59
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9cc]
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x28], 1
jmp 0x4f9e59
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
je 0x4f9e2d
push 0
mov ecx, 2
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x28], 0xffffffff
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.00504e30
test al, al
je 0x4f9e59
push 0
mov ecx, 2
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.004f9aec
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x654]
push eax
call sub.user32.dll_PostMessageA
mov edx, 0x28
mov eax, dword [ebp - 4]
call fcn.0053392c
cmp dword [ebp - 0x20], 1
jne 0x4f9ea0
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9c4]
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x24], 1
jne 0x4f9ebe
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9c8]
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x28], 1
jne 0x4f9edc
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x9cc]
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4f9ef6
push 0
mov ecx, 1
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4f9f10
push 0
mov ecx, 1
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4f9f2a
push 0
mov ecx, 1
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x20], 0xfffffffe
jne 0x4f9f44
push 0
mov ecx, 1
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x24], 0xfffffffe
jne 0x4f9f5e
push 0
mov ecx, 1
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0x28], 0xfffffffe
jne 0x4f9f78
push 0
mov ecx, 1
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.004f9aec
cmp dword [ebp - 0xc], 0
je 0x4f9f88
cmp dword [ebp - 0xc], 2
jne 0x4fa16a
cmp dword [ebp - 8], 0x10
jne 0x4f9f99
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x9c4], edx
cmp dword [ebp - 8], 0x11
jne 0x4f9faa
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x9c8], edx
cmp dword [ebp - 8], 0x12
jne 0x4f9fbb
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x9cc], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x40000000
jae 0x4f9fca
call fcn.00403c1c
add eax, 0x80000000
jae 0x4f9fd6
call fcn.00403c1c
push eax
mov eax, dword [ebp - 8]
push eax
push 0x101
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x654]
push eax
call sub.user32.dll_PostMessageA
jmp 0x4fa16a
cmp dword [ebp - 0xc], 0
je 0x4fa004
cmp dword [ebp - 0xc], 1
jne 0x4fa0bb
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xaa0], 0
jne 0x4fa055
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jns 0x4fa02d
call fcn.00403c14
push eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xff
jbe 0x4fa03d
call fcn.00403c14
push eax
mov eax, dword [ebp - 8]
cmp eax, 0xff
jbe 0x4fa04d
call fcn.00403c14
push eax
call sub.user32.dll_keybd_event
jmp 0x4fa0ac
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4fa06b
call fcn.00403c14
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffff
jbe 0x4fa07e
call fcn.00403c14
mov word [ebp - 0x42], ax
mov eax, dword [ebp - 0x18]
test eax, eax
jns 0x4fa08e
call fcn.00403c14
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
push 0x1c
lea eax, [ebp - 0x48]
push eax
push 1
mov eax, dword [ebp - 4]
call dword [eax + 0xaa0]
cmp dword [ebp - 0x1c], 0
jne 0x4fa0bb
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
cmp dword [ebp - 0xc], 0
je 0x4fa0cb
cmp dword [ebp - 0xc], 2
jne 0x4fa16a
mov eax, dword [ebp - 4]
cmp dword [eax + 0xaa0], 0
jne 0x4fa110
push 0
mov eax, dword [ebp - 0x18]
or eax, 2
test eax, eax
jns 0x4fa0e8
call fcn.00403c14
push eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xff
jbe 0x4fa0f8
call fcn.00403c14
push eax
mov eax, dword [ebp - 8]
cmp eax, 0xff
jbe 0x4fa108
call fcn.00403c14
push eax
call sub.user32.dll_keybd_event
jmp 0x4fa16a
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4fa126
call fcn.00403c14
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffff
jbe 0x4fa139
call fcn.00403c14
mov word [ebp - 0x42], ax
mov eax, dword [ebp - 0x18]
or eax, 2
test eax, eax
jns 0x4fa14c
call fcn.00403c14
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
push 0x1c
lea eax, [ebp - 0x48]
push eax
push 1
mov eax, dword [ebp - 4]
call dword [eax + 0xaa0]
mov esp, ebp
pop ebp
ret 4