Function at 0x4aaa20
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 0x64]
push 0
push ecx
push edx
mov ecx, esi
call eax
test eax, eax
push 0x17
setne byte [esp + 0x1a]
mov byte [esp + 0x1b], 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb eax, eax
neg eax
inc eax
movzx ecx, ax
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov edx, 0x8000
test dx, ax
je 0x4aaa72
mov byte [esp + 0x17], 1
mov ecx, dword [esi + 0x1e8]
mov eax, dword [esi]
mov edx, dword [eax + 0xb8]
push 3
push ecx
mov ecx, esi
call edx
mov ecx, dword [esi + 0x1e8]
mov ebp, eax
mov eax, dword [esi]
mov edx, dword [eax + 0xb8]
push 4
push ecx
mov ecx, esi
call edx
mov ecx, dword [esi + 0x1e8]
mov ebx, eax
mov eax, dword [esi]
mov edx, dword [eax + 0xb8]
push 5
push ecx
mov ecx, esi
call edx
mov ecx, dword [esi + 0x1e8]
mov dword [esp + 0x1c], eax
mov eax, dword [esi]
mov edx, dword [eax + 0xb8]
push 6
push ecx
mov ecx, esi
call edx
mov edx, dword [esi + 0x1e8]
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x7ac]
cmp edx, eax
je 0x4aaaea
mov dword [esi + 0x7ac], edx
jmp 0x4aaaec
mov eax, edx
cmp eax, edx
jne 0x4aab0d
mov ecx, dword [esp + 0x28]
mov eax, dword [esi]
push ecx
mov ecx, dword [esi + 0x1f0]
push ecx
push edx
mov edx, dword [eax + 0xbc]
mov ecx, esi
call edx
mov edi, eax
jmp 0x4aab1c
mov ecx, dword [esi + 0x1f0]
mov eax, esi
xor edi, edi
call fcn.004aae50
mov eax, dword [esi + 0x1f0]
mov ecx, eax
and ecx, 7
mov dword [esp + 0x18], ecx
mov dword [esi + 0x1f4], eax
cmp ecx, 3
jne 0x4aab7a
cmp byte [esp + 0x16], 0
je 0x4aab56
cmp edi, ebp
jb 0x4aac73
and eax, 0xfffffffa
or eax, 2
mov dword [esi + 0x1f0], eax
jmp 0x4aac73
and eax, 0xfffffffc
or eax, 4
mov ecx, dword [esp + 0x28]
mov dword [esi + 0x1f0], eax
mov eax, dword [esi]
mov edx, dword [eax + 0xb4]
push 1
push ecx
mov ecx, esi
call edx
jmp 0x4aac6f
cmp ecx, 4
jne 0x4aaba4
cmp byte [esp + 0x16], 0
jne 0x4aab9c
cmp edi, ebx
jb 0x4aac73
and eax, 0xfffffff8
mov dword [esi + 0x1f0], eax
jmp 0x4aac73
and eax, 0xfffffffb
or eax, 3
jmp 0x4aab5c
cmp ecx, 5
jne 0x4aabf6
cmp byte [esp + 0x17], 0
je 0x4aabd2
cmp byte [esp + 0x16], 0
je 0x4aabd2
cmp edi, dword [esp + 0x1c]
jb 0x4aac73
and eax, 0xfffffff9
or eax, 1
mov dword [esi + 0x1f0], eax
jmp 0x4aac73
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
and eax, 0xfffffffe
or eax, 6
mov dword [esi + 0x1f0], eax
mov eax, dword [esi]
mov eax, dword [eax + 0xb4]
push ecx
push edx
mov ecx, esi
call eax
jmp 0x4aac6f
cmp ecx, 6
jne 0x4aac4c
cmp byte [esp + 0x17], 0
je 0x4aac2d
cmp byte [esp + 0x16], 0
je 0x4aac2d
mov ecx, dword [esp + 0x28]
mov edx, dword [esi]
mov edx, dword [edx + 0xb4]
and eax, 0xfffffffd
or eax, 5
mov dword [esi + 0x1f0], eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
mov ecx, esi
call edx
jmp 0x4aac6f
cmp edi, dword [esp + 0x20]
jb 0x4aac73
cmp byte [esp + 0x16], 0
je 0x4aab8e
and eax, 0xfffffffa
or eax, 2
mov dword [esi + 0x1f0], eax
jmp 0x4aac73
cmp ecx, 1
jne 0x4aac73
cmp byte [esp + 0x16], 0
jne 0x4aac5c
push 0
jmp 0x4aac65
cmp byte [esp + 0x17], 0
jne 0x4aac73
push 2
mov edi, 6
call fcn.004aacd0
mov ecx, dword [esp + 0x18]
mov eax, dword [esi + 0x1f0]
pop edi
and eax, 7
xor edx, edx
cmp eax, ecx
pop esi
setne dl
pop ebp
mov al, dl
pop ebx
add esp, 0x14
ret 0x10