Function at 0x4fc5f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
test dword [esi + 0xa160], 0x100
mov dword [esp + 8], 0xffffffff
jne 0x4fca7b
mov ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x4fc62f
cmp dword [esi + 0xa118], ebp
je 0x4fc62f
cmp dword [esi + 0x4b5c], ebp
jne 0x4fca7b
push ebx
mov ebx, dword [esi + 0x4bc]
sub ebx, dword [esi + 0x418]
push edi
mov edi, dword [esp + 0x24]
movsx eax, di
add ebx, eax
mov edx, edi
shr edx, 0x10
movsx eax, dx
sub eax, dword [esi + 0x41c]
mov dword [esp + 0x14], ebx
add eax, dword [esi + 0x4c0]
test ecx, ecx
mov dword [esp + 0x18], eax
jne 0x4fc785
cmp dword [esi + 0x44], ebp
jne 0x4fc785
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.004f4f20
add esp, 0x10
cmp dword [esp + 0x10], ebp
jl 0x4fc785
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 0x585c]
imul edi, edi, 0xf0
mov eax, dword [edi + eax + 8]
cmp eax, 0xa
je 0x4fc6c0
cmp eax, 0xb
je 0x4fc6c0
cmp eax, 0xc
jne 0x4fc6c6
mov ebp, dword [0x622e24]
jmp 0x4fc6c6
mov ebp, dword [0x622d94]
cmp eax, 5
jl 0x4fc6e9
cmp eax, 8
jg 0x4fc6e9
jne 0x4fc6da
mov ebp, dword [0x622880]
jmp 0x4fc6e9
push 0x7f84
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebp, eax
mov ecx, dword [esi + 0x585c]
mov eax, dword [ecx + edi + 8]
add ecx, edi
cmp eax, 1
je 0x4fc6ff
cmp eax, 2
jne 0x4fc769
cmp eax, 2
jne 0x4fc724
mov edx, dword [ecx + 0xc]
mov eax, dword [esi + 0x72c]
imul edx, edx, 0x98
test dword [edx + eax + 0x28], 0x100
je 0x4fc724
push 0x7f03
jmp 0x4fc75f
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4fc75a
cmp eax, 1
je 0x4fc75a
cmp eax, 2
je 0x4fc753
cmp eax, 3
je 0x4fc753
cmp eax, 4
je 0x4fc74c
cmp eax, 7
je 0x4fc74c
push 0x7f83
jmp 0x4fc75f
push 0x7f82
jmp 0x4fc75f
push 0x7f85
jmp 0x4fc75f
push 0x7f84
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebp, eax
mov ecx, dword [esi + 0x585c]
cmp dword [edi + ecx + 8], 3
jne 0x4fca20
mov ebp, dword [0x622920]
jmp 0x4fca20
push 0
push edi
push esi
call fcn.004fc110
mov edi, dword [esi + 0xae4]
push edi
push esi
call fcn.004f5d80
add esp, 0x14
cmp eax, 0xffffffff
mov dword [esp + 0x20], eax
je 0x4fca79
cmp dword [esi + 0xb0c], ebp
mov ecx, dword [esp + 0x28]
je 0x4fc7dc
test ecx, ecx
jne 0x4fc7dc
mov eax, dword [esi + 0xb20]
test eax, eax
je 0x4fc7dc
mov ebp, eax
mov dword [esi + 0x5860], 0xffffffff
mov dword [esi + 0x62c], ecx
jmp 0x4fc93b
cmp dword [esi + 0x66c], ebp
je 0x4fc84f
cmp dword [esi + 0x678], ebp
jne 0x4fc84f
test ecx, ecx
jne 0x4fc867
cmp byte [esi + 0xaf8], 0x20
je 0x4fc81d
mov edx, dword [esi + 0x3434]
mov eax, dword [edx + 0x128]
lea eax, [eax + eax*2]
cdq
sub eax, edx
sar eax, 1
cmp dword [esi + 0xafc], eax
jle 0x4fc81d
mov ebp, dword [0x622828]
jmp 0x4fc836
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov ebp, dword [0x621870]
js 0x4fc836
mov ebp, dword [0x622d90]
mov dword [esi + 0x62c], 0
mov dword [esi + 0x5860], 0xffffffff
jmp 0x4fc93b
test ecx, ecx
jne 0x4fc867
test byte [esi + 0xa178], 2
je 0x4fc867
mov ebp, dword [0x622e08]
jmp 0x4fc93b
cmp dword [esi + 0xa100], ebp
je 0x4fc8e8
test ecx, ecx
jne 0x4fc8e8
test dword [esi + 0xa178], 0x8000000
jne 0x4fc8e8
cmp dword [esi + 0x62c], ebp
jne 0x4fc8d2
cmp dword [esi + 0x5860], ebp
jge 0x4fc8d2
mov eax, dword [esi + 0xae8]
push eax
push edi
push esi
call fcn.004a0bf0
add esp, 0xc
test dword [esi + 0xa174], 0x40000
jne 0x4fc8cc
mov ecx, dword [esi + 0xae8]
mov edx, dword [esi + 0xae4]
push 0
push ecx
push edx
push 0
push eax
push esi
call fcn.004f8a10
add esp, 0x18
test eax, eax
je 0x4fc8d2
mov ebp, dword [0x62297c]
mov dword [esi + 0x62c], 0
mov dword [esi + 0x5860], 0xffffffff
jmp 0x4fc93b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4fc943
cmp dword [esi + 0x5860], 0xffffffff
jne 0x4fc943
cmp dword [esi + 0x62c], ebp
jne 0x4fc943
cmp dword [esp + 0x28], ebp
jne 0x4fc943
test dword [esi + 0xa178], 0x8000000
jne 0x4fc943
mov eax, dword [esi + 0xae8]
mov ecx, dword [esi + 0xae4]
push eax
push ecx
push 0
push esi
call fcn.004b1d70
add esp, 0x10
test eax, eax
je 0x4fc943
mov ebp, dword [0x62297c]
test ebp, ebp
jne 0x4fca20
cmp dword [esi + 0x44], 0
jne 0x4fca11
mov eax, dword [esi + 0x4c0]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jl 0x4fca11
mov edx, dword [esi + 0x4b8]
add edx, eax
cmp ecx, edx
jg 0x4fca11
mov eax, dword [esi + 0xae4]
mov ecx, dword [esi + 0x138]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx + 0x14]
mov edx, dword [esp + 0x20]
imul eax, eax, 0x58
mov ecx, dword [esi + 0x2b38]
imul edx, edx, 0xb4
mov edi, dword [eax + ecx]
add eax, ecx
mov ecx, dword [esi + 0x704]
add ecx, edx
mov edx, dword [ecx + 0x14]
add edi, edx
cmp ebx, edi
jl 0x4fca11
mov ecx, dword [ecx + 0x24]
sub ecx, dword [eax + 4]
add ecx, edx
cmp ebx, ecx
jge 0x4fca20
push esi
call fcn.004f79c0
add esp, 4
test eax, eax
jne 0x4fca11
mov edx, dword [esi + 0xae8]
mov eax, dword [esi + 0xae4]
push edx
push eax
push esi
call fcn.004a0bf0
imul eax, eax, 0x170
mov ecx, dword [esi + 0x3434]
add esp, 0xc
test byte [ecx + eax + 0x134], 0x80
jne 0x4fca20
mov edx, dword [esp + 0x20]
push edx
push esi
call fcn.004fd450
add esp, 8
test eax, eax
jle 0x4fca0a
mov ebp, dword [0x622db0]
jmp 0x4fca20
push 0x7f01
jmp 0x4fca16
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov ebp, eax
cmp dword [esp + 0x10], 0
jge 0x4fca86
cmp ebp, dword [esi + 0xb20]
je 0x4fca86
cmp dword [esi + 0x570], 0
jne 0x4fca86
cmp dword [esi + 0xb08], 0
jne 0x4fca86
xor ebp, ebp
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
cmp ebp, dword [0x622e08]
sete al
xor ecx, ecx
mov dword [esi + 0xa118], eax
cmp ebp, dword [0x62297c]
sete cl
mov dword [esi + 0xa11c], ecx
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
test ebp, ebp
je 0x4fca43
push ebp
jmp 0x4fca51