Function at 0x4c49a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x634b28]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, dword [eax + 4]
mov ebx, ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xa4], eax
cmp esi, 0x200
je 0x4c4a01
cmp esi, 0xa0
je 0x4c4a01
cmp esi, 0x2a3
je 0x4c4a01
cmp esi, 0x202
je 0x4c4a01
cmp esi, 0x205
je 0x4c4a01
cmp esi, 0x208
jne 0x4c5058
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4c5052
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4c5052
push 4
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4c5052
cmp dword [ebp + 0x10], 0
mov esi, dword [sym.imp.USER32.dll_GetParent]
jne 0x4c4a71
mov eax, dword [ebp - 0xa4]
push dword [eax]
call fcn.00548f8f
test eax, eax
je 0x4c4a69
test dword [eax + 0x60], 0x401
jne 0x4c4a69
push dword [eax + 0x20]
call esi
push eax
call fcn.00548f8f
test eax, eax
jne 0x4c4a51
cmp eax, edi
jne 0x4c511e
test edi, edi
jne 0x4c4a79
xor eax, eax
jmp 0x4c4a7c
mov eax, dword [edi + 0x20]
push eax
call fcn.00473100
mov ecx, dword [ebx + 0x60]
add esp, 4
mov dword [ebp - 0xb0], eax
test ecx, ecx
je 0x4c4ad5
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x4c4ad5
push ecx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4c4ad5
cmp dword [ebp - 0xb0], 0
jne 0x4c4ad5
mov eax, dword [ebx + 0x60]
push 0
push 0
push 0x401
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret 0xc
mov ecx, edi
call fcn.005491dc
mov ecx, dword [ebx + 0x60]
mov edx, eax
mov dword [ebp - 0xa0], edx
test ecx, ecx
je 0x4c4b15
mov eax, dword [ecx + 0x5c]
test eax, eax
jne 0x4c4af7
push dword [ecx + 0x20]
call esi
push eax
call fcn.00548f8f
mov edx, dword [ebp - 0xa0]
cmp eax, edx
je 0x4c4b15
mov ecx, dword [ebx + 0x60]
mov eax, dword [ecx]
call dword [eax + 0x60]
mov edx, dword [ebp - 0xa0]
mov edi, dword [ebx + 0x60]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0xac], edi
test edi, edi
je 0x4c4b36
cmp dword [edi + 0x20], 0
jne 0x4c4ca7
test edi, edi
jne 0x4c4b4b
mov eax, dword [ebx]
mov ecx, ebx
push edx
call dword [eax + 0x50]
mov edi, eax
mov dword [ebx + 0x60], eax
test edi, edi
je 0x4c511e
cmp dword [edi + 0x20], 0
jne 0x4c4bb6
push edi
push 0x5e1e98
call fcn.00557e68
mov ecx, dword [ebx + 0x60]
add esp, 8
test eax, eax
je 0x4c4b7a
mov eax, dword [ebx + 0x40]
or eax, 3
push eax
push dword [ebp - 0xa0]
call fcn.004c3bc0
jmp 0x4c4bb6
push ecx
push 0x5f7a20
call fcn.00557e68
add esp, 8
test eax, eax
je 0x4c511e
cmp dword [ebx + 0x30], 1
mov eax, 3
mov ecx, dword [ebx + 0x60]
mov edi, 0x43
cmove eax, edi
or eax, dword [ebx + 0x40]
push eax
mov edx, dword [ecx]
push dword [ebp - 0xa0]
call dword [edx + 0x164]
mov eax, dword [ebx + 0x60]
test eax, eax
je 0x4c511e
mov ecx, dword [eax + 0x20]
test ecx, ecx
je 0x4c511e
lea eax, [ebx + 0x98]
test eax, eax
je 0x4c4bd9
mov eax, dword [eax + 4]
push 1
push eax
push 0x30
push ecx
call esi
push dword [ebx + 0x3c]
mov eax, dword [ebx + 0x60]
push 0
push 0x418
push dword [eax + 0x20]
call esi
lea eax, [ebx + 0x44]
push eax
mov eax, dword [ebx + 0x60]
push 0
push 0x41a
push dword [eax + 0x20]
call esi
mov eax, dword [ebx + 0x90]
cmp eax, 0xffffffff
je 0x4c4c21
push 0
push eax
mov eax, dword [ebx + 0x60]
push 0x413
push dword [eax + 0x20]
call esi
mov eax, dword [ebx + 0x94]
cmp eax, 0xffffffff
je 0x4c4c3c
push 0
push eax
mov eax, dword [ebx + 0x60]
push 0x414
push dword [eax + 0x20]
call esi
mov eax, dword [ebx + 0x58]
cmp eax, 0xffffffff
je 0x4c4c57
movzx eax, ax
push eax
mov eax, dword [ebx + 0x60]
push 1
push 0x403
push dword [eax + 0x20]
call esi
mov eax, dword [ebx + 0x54]
cmp eax, 0xffffffff
je 0x4c4c72
movzx eax, ax
push eax
mov eax, dword [ebx + 0x60]
push 3
push 0x403
push dword [eax + 0x20]
call esi
mov eax, dword [ebx + 0x5c]
cmp eax, 0xffffffff
je 0x4c4c8d
movzx eax, ax
push eax
mov eax, dword [ebx + 0x60]
push 2
push 0x403
push dword [eax + 0x20]
call esi
mov eax, dword [ebx + 0x60]
push 0
push 0
push 0x401
push dword [eax + 0x20]
call esi
mov edi, dword [ebx + 0x60]
mov dword [ebp - 0xac], edi
mov ecx, dword [ebp - 0xa4]
xor eax, eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x18]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xb4], ecx
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_ScreenToClient]
cmp dword [ebx + 0x20], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
jne 0x4c4d41
cmp dword [ebx + 0x24], 0
mov dword [ebp - 0x70], 0x28
je 0x4c4d48
mov dword [ebp - 0x70], 0x2c
lea ecx, [ebp - 0x70]
push ecx
push dword [ebp - 0xb4]
lea eax, [ebp - 0x44]
mov ecx, ebx
push dword [ebp - 0xb8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx]
push dword [ebp - 0xa8]
call dword [eax + 0x54]
cmp dword [ebx + 0x20], 0
mov dword [ebp - 0xa0], eax
je 0x4c4dc6
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4c4dc6
mov ecx, dword [ebp - 0x40]
test ecx, ecx
je 0x4c4dc6
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c4dab
test dx, dx
je 0x4c4da7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c4dab
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c4d85
xor eax, eax
jmp 0x4c4db0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4c4dc6
push dword [ebp - 0x44]
call fcn.005823b1
add esp, 4
mov dword [ebp - 0x44], 0
test byte [ebx + 0x40], 2
jne 0x4c4de2
push dword [ebp - 0x4c]
call fcn.00473680
mov eax, dword [ebp - 0x48]
push dword [eax + 4]
call fcn.00473680
add esp, 8
cmp dword [ebx + 0xa8], 0
je 0x4c4e01
push dword [ebp - 0x4c]
call fcn.004c7310
mov eax, dword [ebp - 0x48]
push dword [eax + 4]
call fcn.004c7310
add esp, 8
mov eax, dword [ebx + 0x70]
cmp eax, dword [ebp - 0x64]
jne 0x4c4e66
mov eax, dword [ebx + 0x6c]
cmp eax, dword [ebp - 0x68]
jne 0x4c4e66
mov esi, dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
lea eax, [ebx + 0x74]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x4c4e73
cmp dword [ebp - 0xa0], 0xffffffff
je 0x4c5004
mov eax, dword [ebp - 0xa4]
mov ecx, ebx
push eax
push edi
call fcn.004c6c10
jmp 0x4c5004
mov ecx, 1
mov dword [ebp - 0xa8], ecx
jmp 0x4c4e7b
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
cmp dword [ebx + 0x64], 0x28
lea eax, [ebx + 0x64]
mov dword [ebp - 0xbc], eax
jb 0x4c4e9a
test ecx, ecx
jne 0x4c4e9a
push eax
push ecx
push 0x433
push dword [edi + 0x20]
call esi
cmp dword [ebp - 0xa0], 0xffffffff
je 0x4c4fba
mov eax, dword [ebp - 0x6c]
lea esi, [ebp - 0x70]
and eax, 0x3fffffff
lea edi, [ebp - 0x9c]
mov ecx, 0xb
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xac]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0x432
push dword [edi + 0x20]
call esi
mov eax, dword [ebx + 0x30]
cmp eax, 3
je 0x4c4f48
cmp eax, 6
je 0x4c4f48
cmp eax, 7
je 0x4c4f48
cmp dword [ebx + 0x34], 0x50050
jae 0x4c4f03
test eax, eax
je 0x4c4f48
cmp dword [ebx + 0x20], 0
je 0x4c4f3a
cmp dword [ebp - 0x44], 0
je 0x4c4f3a
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4c4f3a
push eax
push dword [ebx + 0x38]
push 0x421
push dword [edi + 0x20]
call esi
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0x439
jmp 0x4c4f43
push 0
push 0
push 0x421
push dword [edi + 0x20]
call esi
cmp dword [ebx + 0x24], 0
je 0x4c4f80
mov ecx, dword [ebp - 0x3c]
test ecx, ecx
je 0x4c4f71
mov eax, dword [ebx + 0x2c]
push dword [ebx + 0x28]
add eax, dword [ebp - 0xa0]
push eax
call fcn.00480650
mov ecx, dword [edi + 0x20]
test eax, eax
je 0x4c4f74
push eax
jmp 0x4c4f76
mov ecx, dword [edi + 0x20]
push 0
push 0
push 0x2a49
push ecx
call esi
test dword [ebp - 0x6c], 0x40000000
jne 0x4c4f92
cmp dword [ebp - 0xb0], 0
je 0x4c4fc8
push 0
push 1
push 0x401
push dword [edi + 0x20]
call esi
push 0x213
push 0
push 0
push 0
push 0
push 0
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4c4fc8
push 0
push 0
push 0x401
push dword [edi + 0x20]
call esi
mov eax, dword [ebp - 0xa4]
mov ecx, ebx
push eax
push edi
call fcn.004c6c10
mov ebx, dword [ebp - 0xbc]
cmp dword [ebx], 0x28
jb 0x4c4ff8
cmp dword [ebp - 0xa8], 0
je 0x4c4ff8
push ebx
push 0
push 0x433
push dword [edi + 0x20]
call esi
mov ecx, 0xb
lea esi, [ebp - 0x70]
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x4c]
cmp eax, 0xffffffff
je 0x4c501b
cmp dword [ebp - 0x50], 0
jne 0x4c501b
push eax
call fcn.005823b1
add esp, 4
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4c502b
push eax
call fcn.005823b1
add esp, 4
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4c511e
push eax
call fcn.005823b1
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp - 0xa4]
cmp dword [ebp + 0x10], 0
jne 0x4c509c
push dword [eax]
call fcn.00548f8f
test eax, eax
je 0x4c5094
lea esp, [esp]
cmp eax, edi
je 0x4c509c
test dword [eax + 0x60], 0x401
jne 0x4c511e
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call fcn.00548f8f
test eax, eax
jne 0x4c5070
cmp eax, edi
jne 0x4c511e
cmp esi, 0x100
jb 0x4c50ac
cmp esi, 0x109
jbe 0x4c5117
lea eax, [esi - 0x104]
cmp eax, 3
jbe 0x4c5117
cmp esi, 0x201
je 0x4c5117
cmp esi, 0x203
je 0x4c5117
cmp esi, 0x204
je 0x4c5117
cmp esi, 0x206
je 0x4c5117
cmp esi, 0x207
je 0x4c5117
cmp esi, 0x209
je 0x4c5117
cmp esi, 0xa1
je 0x4c5117
cmp esi, 0xa3
je 0x4c5117
cmp esi, 0xa4
je 0x4c5117
cmp esi, 0xa6
je 0x4c5117
cmp esi, 0xa7
je 0x4c5117
cmp esi, 0xa9
jne 0x4c511e
mov ecx, ebx
call fcn.004c3ba0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057b6ac
mov esp, ebp
pop ebp
ret 0xc