Function at 0x459fe6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 9
push ebx
push esi
push edi
mov esi, ecx
je 0x45a23e
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call edi
push 0x11
mov dword [ebp - 8], eax
call edi
push 0x12
mov ebx, eax
call edi
push 8
mov dword [ebp - 4], eax
call edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0x11
je 0x45a02e
cmp eax, 0x10
je 0x45a02e
cmp eax, 0x12
jne 0x45a032
and byte [ebp + 0xb], 0xfe
cmp eax, 0x10
jne 0x45a03b
and byte [ebp + 0xb], 0xf
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
mov ecx, esi
push eax
lea eax, [ebp + 8]
push eax
call fcn.0045a258
mov edi, 0x80
mov dword [ebp - 0x10], eax
and ebx, edi
test bx, bx
mov dword [ebp - 0xc], ebx
je 0x45a072
cmp dword [ebp + 0xc], 0x11
jne 0x45a07a
push dword [ebp + 0x10]
lea ecx, [esi + 0x44]
call fcn.004daf4b
jmp 0x45a07a
lea ecx, [esi + 0x44]
call fcn.004dad9d
mov eax, dword [ebp - 4]
and eax, edi
test ax, ax
mov dword [ebp - 4], eax
je 0x45a09a
cmp dword [ebp + 0xc], 0x12
jne 0x45a0a2
push dword [ebp + 0x10]
lea ecx, [esi + 0x48]
call fcn.004daf4b
jmp 0x45a0a2
lea ecx, [esi + 0x48]
call fcn.004dad9d
mov ebx, dword [ebp - 8]
and ebx, edi
xor edi, edi
cmp bx, di
je 0x45a0c1
cmp dword [ebp + 0xc], 0x10
jne 0x45a0c9
push dword [ebp + 0x10]
lea ecx, [esi + 0x4c]
call fcn.004daf4b
jmp 0x45a0c9
lea ecx, [esi + 0x4c]
call fcn.004dad9d
cmp bx, di
mov word [esi + 0x42], di
je 0x45a0d8
mov word [esi + 0x42], 1
cmp word [ebp - 0xc], di
je 0x45a0e2
or byte [esi + 0x42], 2
cmp word [ebp - 4], di
je 0x45a0ec
or byte [esi + 0x42], 4
lea edi, [esi + 0x3c]
mov ecx, edi
call fcn.004dad9d
mov ecx, dword [esi + 0x44]
lea eax, [esi + 0x44]
mov ebx, 0x53bb28
cmp dword [ecx - 8], 0
je 0x45a117
push eax
mov ecx, edi
call fcn.004db22a
push ebx
mov ecx, edi
call fcn.004db1ee
mov ecx, dword [esi + 0x48]
lea eax, [esi + 0x48]
cmp dword [ecx - 8], 0
je 0x45a133
push eax
mov ecx, edi
call fcn.004db22a
push ebx
mov ecx, edi
call fcn.004db1ee
mov ecx, dword [esi + 0x4c]
lea eax, [esi + 0x4c]
cmp dword [ecx - 8], 0
je 0x45a14f
push eax
mov ecx, edi
call fcn.004db22a
push ebx
mov ecx, edi
call fcn.004db1ee
mov eax, dword [ebp + 0xc]
cmp eax, 0x70
jb 0x45a15c
cmp eax, 0x7b
jbe 0x45a190
cmp eax, 0xd
je 0x45a190
cmp eax, 0x1b
je 0x45a190
cmp eax, 0x6a
je 0x45a190
cmp eax, 0x6f
je 0x45a190
mov eax, dword [edi]
cmp dword [eax - 8], 0
jne 0x45a190
cmp dword [esi + 0x50], 1
jne 0x45a190
push str.Ctrl__Alt_
mov ecx, edi
call fcn.004daf9b
mov word [esi + 0x42], 6
mov ebx, dword [ebp + 0x10]
mov ecx, edi
push dword [ebx]
call fcn.004d2299
cmp eax, 0xffffffff
je 0x45a1a7
cmp dword [ebp - 0x10], 1
jne 0x45a1c4
push ebx
mov ecx, edi
call fcn.004db22a
mov eax, dword [ebp + 8]
shr eax, 0x10
shl eax, 4
or word [esi + 0x42], ax
mov ax, word [ebp + 0xc]
mov word [esi + 0x40], ax
test byte [ebp - 0x14], 0x80
je 0x45a1e0
push str.IDS_NOSHORTKEY
mov ecx, edi
call fcn.004daf9b
and word [esi + 0x40], 0
and word [esi + 0x42], 0
push dword [edi]
mov ecx, esi
call fcn.004da3e8
mov eax, dword [edi]
push 0xffffffffffffffff
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push dword [eax - 8]
push 0xb1
push dword [esi + 0x1c]
call edi
push 0
push 0
push 0xb7
push dword [esi + 0x1c]
call edi
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.004d7285
mov ebx, eax
cmp dword [ebx + 0x1c], 0
je 0x45a23e
mov ecx, esi
call fcn.00459fc8
test ebx, ebx
je 0x45a233
mov ebx, dword [ebx + 0x1c]
push eax
push 0
push 0x497
push ebx
call edi
pop edi
pop esi
pop ebx
leave
ret 0xc