Function at 0x4497f9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0x56fc60
cmp dword [0x54e3bc], 0
je 0x44a2bf
push 0
push 0x56fc7c
push dword [ebp + 8]
call fcn.00516353
mov dword [0x56fc5c], eax
cmp dword [0x56fc5c], 0
je 0x44a2bf
mov eax, dword [0x56fc5c]
cmp dword [eax + 0x618], 0
je 0x44a2bf
push 0x10
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x44985d
mov dword [0x56fc64], 1
jmp 0x449865
xor edx, edx
mov dword [0x56fc64], edx
push 0x11
call sub.USER32.dll_GetKeyState
test ax, ax
jge 0x44987d
mov dword [0x56fc68], 1
jmp 0x449885
xor ecx, ecx
mov dword [0x56fc68], ecx
mov eax, dword [0x54e3ac]
mov dword [0x54e39c], eax
mov edx, dword [0x54e3b0]
mov dword [0x54e3a0], edx
mov ecx, dword [0x54e3b4]
mov dword [0x54e3a4], ecx
mov eax, dword [0x54e3b8]
mov dword [0x54e3a8], eax
mov edx, dword [0x54e3a8]
cmp edx, dword [0x54e3a0]
jne 0x4498d1
mov ecx, dword [0x54e3a4]
cmp ecx, dword [0x54e39c]
jle 0x44a2bf
mov eax, dword [0x54e3a8]
cmp eax, dword [0x54e3a0]
jg 0x44a2bf
cmp dword [0x54e39c], 0
jl 0x44a2bf
cmp dword [0x54e3a0], 0
jl 0x44a2bf
cmp dword [0x54e3a4], 0
jl 0x44a2bf
cmp dword [0x54e3a8], 0
jl 0x44a2bf
mov edx, dword [0x56fc5c]
mov ecx, dword [edx + 0x644]
mov eax, dword [0x56fc5c]
sub ecx, dword [eax + 0x648]
mov dword [0x56fc74], ecx
mov edx, dword [0x56fc5c]
mov ecx, dword [edx + 0x618]
mov eax, dword [ecx + 0x38]
mov dword [edi], eax
jmp 0x449963
mov edx, dword [0x56fc5c]
mov ecx, dword [edx + 0x618]
mov eax, dword [edi]
cmp ecx, eax
je 0x44996c
mov edx, dword [eax + 0x38]
mov dword [edi], edx
dec dword [0x56fc74]
cmp dword [0x56fc74], 0
jg 0x449946
cmp dword [edi], 0
je 0x44a2bf
mov ecx, 0x64
mov dword [0x56fc94], ecx
push dword [0x56fc94]
call fcn.00545a4c
pop ecx
mov dword [0x56fc54], eax
test eax, eax
jne 0x4499a1
push 0
call fcn.0041c2be
jmp 0x44a2bf
mov edx, dword [0x56fc5c]
mov ecx, dword [edx + 0x818]
mov dword [0x56fc8c], ecx
mov eax, dword [0x56fc5c]
cmp dword [eax + 0x670], 1
je 0x4499d9
mov edx, dword [0x56fc5c]
cmp dword [edx + 0x670], 2
jne 0x4499ec
cmp dword [0x5578ec], 1
jne 0x4499ec
mov ecx, dword [0x56fc5c]
mov eax, dword [ecx + 0x818]
dec eax
add dword [0x56fc8c], eax
mov edx, dword [0x56fc88]
sub edx, dword [0x56fc8c]
dec edx
mov dword [0x56fc70], edx
xor ecx, ecx
mov dword [0x56fc74], ecx
jmp 0x449a3b
mov eax, dword [0x56fc8c]
sub dword [0x56fc70], eax
neg eax
cmp eax, dword [0x56fc70]
jg 0x449a49
mov edx, dword [0x56fc5c]
mov ecx, dword [edx + 0x618]
mov eax, dword [edi]
cmp ecx, eax
je 0x449a49
mov edx, dword [eax + 0x38]
mov dword [edi], edx
inc dword [0x56fc74]
mov ecx, dword [0x56fc74]
cmp ecx, dword [0x54e3a0]
jl 0x449a09
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov dword [0x56fc90], edx
mov byte [0x57c4a0], 0
mov ecx, dword [0x56fc54]
mov byte [ecx], 0
xor eax, eax
mov dword [0x56fca0], eax
mov dword [0x56fc9c], eax
mov dword [0x56fc98], eax
mov edx, dword [edi]
mov ecx, dword [edx + 0x1c]
mov dword [0x56fca4], ecx
mov eax, dword [0x54d290]
mov dword [0x56fca8], eax
xor edx, edx
mov dword [0x56fcac], edx
xor ecx, ecx
mov dword [0x56fcb0], ecx
xor eax, eax
mov dword [0x56fcb4], eax
jmp 0x44a243
mov edx, dword [ebx + 8]
cmp edx, dword [0x56fc90]
je 0x449ae8
xor ecx, ecx
mov dword [0x56fca0], ecx
mov dword [0x56fc9c], ecx
mov dword [0x56fc98], ecx
mov eax, dword [ebx + 0x1c]
mov dword [0x56fca4], eax
mov edx, dword [0x54d290]
mov dword [0x56fca8], edx
xor eax, eax
mov dword [0x56fcac], eax
xor edx, edx
mov dword [0x56fcb0], edx
mov ecx, dword [0x56fc74]
cmp ecx, dword [0x54e3a0]
jne 0x449df3
mov dword [0x56fcb0], 1
mov eax, dword [ebx]
push edi
mov edi, eax
mov esi, 0x57c887
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push 0x57c887
call fcn.005395b8
pop ecx
mov ebx, eax
mov dword [0x56fc6c], ebx
cmp ebx, dword [0x54e39c]
jge 0x449b4d
mov dword [0x54e39c], ebx
mov eax, dword [0x56fc74]
cmp eax, dword [0x54e3a8]
jne 0x449bad
cmp dword [0x54b000], 0
je 0x449b7f
push dword [0x54e3a4]
push 0x57c887
call fcn.00544ef0
add esp, 8
dec eax
jne 0x449b7f
inc dword [0x54e3a4]
mov edx, dword [0x56fc6c]
cmp edx, dword [0x54e3a4]
jge 0x449b99
mov ecx, dword [0x56fc6c]
mov dword [0x54e3a4], ecx
mov eax, dword [0x54e3a4]
mov byte [eax + 0x57c888], 0
xor edx, edx
mov dword [0x56fc74], edx
cmp dword [0x54b000], 0
je 0x449bd4
push dword [0x54e39c]
push 0x57c887
call fcn.00544ef0
add esp, 8
cmp eax, 2
jne 0x449bd4
dec dword [0x54e39c]
cmp dword [0x54e39c], 0
jge 0x449be5
xor ecx, ecx
mov dword [0x54e39c], ecx
mov eax, 0x57c887
add eax, dword [0x54e39c]
push edi
mov edi, eax
mov esi, 0x57c4a0
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
cmp dword [0x56fc68], 0
je 0x449fa0
mov ebx, dword [edi]
test ebx, ebx
je 0x449c4c
mov eax, dword [0x56fc5c]
cmp ebx, dword [eax + 0x618]
je 0x449c4c
mov ebx, dword [ebx + 0x38]
mov edx, dword [edi]
mov ecx, dword [edx + 8]
cmp ecx, dword [ebx + 8]
je 0x449c48
mov ebx, dword [ebx + 0x34]
jmp 0x449c4c
test ebx, ebx
jne 0x449c29
test ebx, ebx
je 0x449c58
mov eax, dword [ebx + 0x1c]
mov dword [0x56fca4], eax
test ebx, ebx
je 0x449fa0
xor esi, esi
push dword [ebx]
call fcn.005395b8
pop ecx
mov dword [ebp - 4], eax
cmp esi, dword [ebp - 4]
jge 0x449ddb
cmp ebx, dword [edi]
jne 0x449c86
cmp esi, dword [0x54e39c]
jge 0x449ddb
cmp dword [0x54b000], 0
je 0x449ca7
push esi
push dword [ebx]
call fcn.00544ef0
add esp, 8
cmp eax, 1
je 0x449ca4
cmp eax, 2
jne 0x449ca7
inc esi
jmp 0x449c6d
mov eax, dword [ebx]
xor edx, edx
mov dl, byte [eax + esi]
cmp edx, 0xf
jg 0x449cc6
je 0x449d9a
sub edx, 2
je 0x449cd5
dec edx
je 0x449d39
jmp 0x449dd1
sub edx, 0x16
je 0x449d18
sub edx, 9
je 0x449cf6
jmp 0x449dd1
mov ecx, dword [0x56fc98]
cmp ecx, 1
sbb eax, eax
neg eax
mov dword [0x56fc98], eax
mov dword [0x56fcb4], 1
jmp 0x449dd1
mov edx, dword [0x56fc9c]
cmp edx, 1
sbb ecx, ecx
neg ecx
mov dword [0x56fc9c], ecx
mov dword [0x56fcb4], 1
jmp 0x449dd1
mov eax, dword [0x56fca0]
cmp eax, 1
sbb edx, edx
neg edx
mov dword [0x56fca0], edx
mov dword [0x56fcb4], 1
jmp 0x449dd1
push dword [0x54d290]
push dword [ebx + 0x1c]
push 0x56fca8
push 0x56fca4
mov ecx, dword [ebx]
add ecx, esi
push ecx
call fcn.004df748
add esi, eax
cmp dword [0x56fcac], 0
jne 0x449d8e
test eax, eax
jne 0x449d6e
xor eax, eax
mov dword [0x56fcac], eax
jmp 0x449d8e
cmp eax, 2
jg 0x449d7f
mov dword [0x56fcac], 1
jmp 0x449d8e
cmp eax, 2
jle 0x449d8e
mov dword [0x56fcac], 2
mov dword [0x56fcb4], 1
jmp 0x449dd1
xor edx, edx
mov dword [0x56fca0], edx
mov dword [0x56fc9c], edx
mov dword [0x56fc98], edx
mov eax, dword [ebx + 0x1c]
mov dword [0x56fca4], eax
mov ecx, dword [0x54d290]
mov dword [0x56fca8], ecx
xor eax, eax
mov dword [0x56fcac], eax
xor edx, edx
mov dword [0x56fcb4], edx
inc esi
cmp esi, dword [ebp - 4]
jl 0x449c76
cmp ebx, dword [edi]
je 0x449fa0
mov ebx, dword [ebx + 0x34]
test ebx, ebx
jne 0x449c60
jmp 0x449fa0
mov ecx, dword [edi]
mov eax, dword [ecx]
push edi
mov edi, eax
mov esi, 0x57c887
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, dword [0x56fc74]
cmp eax, dword [0x54e3a8]
jne 0x449e8d
push 0x57c887
call fcn.005395b8
pop ecx
mov dword [0x56fc6c], eax
cmp dword [0x54b000], 0
je 0x449e5f
push dword [0x54e3a4]
push 0x57c887
call fcn.00544ef0
add esp, 8
dec eax
jne 0x449e5f
inc dword [0x54e3a4]
mov edx, dword [0x56fc6c]
cmp edx, dword [0x54e3a4]
jge 0x449e79
mov ecx, dword [0x56fc6c]
mov dword [0x54e3a4], ecx
mov eax, dword [0x54e3a4]
mov byte [eax + 0x57c888], 0
xor edx, edx
mov dword [0x56fc74], edx
cmp dword [0x56fc64], 0
jne 0x449f7d
mov ecx, dword [edi]
mov eax, dword [ecx + 8]
cmp eax, dword [0x56fc90]
jne 0x449f7d
mov edx, dword [edi]
mov eax, dword [edx + 0x10]
test eax, eax
jle 0x449f52
mov dword [0x56fc6c], eax
mov dword [0x56fc78], 0x57c887
jmp 0x449ed9
dec dword [0x56fc6c]
cmp al, 0x20
jne 0x449eee
inc dword [0x56fc78]
mov edx, dword [0x56fc78]
mov al, byte [edx]
test al, al
je 0x449eee
cmp dword [0x56fc6c], 0
jg 0x449ec9
mov edx, dword [0x56fc78]
cmp byte [edx], 0
je 0x449f27
mov ecx, dword [0x56fc78]
push edi
mov esi, 0x57c4a0
mov edi, ecx
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x449fa0
push edi
mov esi, 0x57c4a0
mov edi, 0x57c887
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x449fa0
push edi
mov esi, 0x57c4a0
mov edi, 0x57c887
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x449fa0
push edi
mov esi, 0x54e3c8
mov edi, 0x57c4a0
mov eax, edi
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop edi
push 0x57c887
push 0x57c4a0
call fcn.005394dc
add esp, 8
mov edx, dword [0x56fc5c]
mov ecx, dword [edx + 0x62c]
mov eax, dword [edi]
cmp ecx, eax
jne 0x449fbf
cmp dword [eax + 0x20], 2
jne 0x449fbf
mov byte [0x57c4a0], 0
cmp byte [0x57c4a0], 0
je 0x44a22c
cmp dword [0x56fc68], 0
je 0x44a196
cmp dword [0x56fcb0], 0
je 0x44a1a2
xor edx, edx
mov dword [0x56fcb0], edx
mov byte [0x57c887], 0
cmp dword [0x56fc98], 0
je 0x44a01f
push 2
push 0x54e3cc
push 0x57c887
call fcn.005395b8
pop ecx
add eax, 0x57c887
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [0x56fc9c], 0
je 0x44a049
push 0x1f
push 0x54e3d0
push 0x57c887
call fcn.005395b8
pop ecx
add eax, 0x57c887
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [0x56fca0], 0
je 0x44a073
push 0x16
push 0x54e3d4
push 0x57c887
call fcn.005395b8
pop ecx
add eax, 0x57c887
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
cmp dword [0x56fcac], 2
jne 0x44a0ef
xor ecx, ecx
mov cl, byte [0x57c4a0]
test byte [ecx*2 + str.________________________________H], 4
je 0x44a0c0
push dword [0x56fca8]
push dword [0x56fca4]
push 3
push str._c_d__02d
push 0x57c887
call fcn.005395b8
pop ecx
add eax, 0x57c887
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x44a159
push dword [0x56fca8]
push dword [0x56fca4]
push 3
push str._c_d__d
push 0x57c887
call fcn.005395b8
pop ecx
add eax, 0x57c887
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x14
jmp 0x44a159
cmp dword [0x56fcac], 1
jne 0x44a159
xor eax, eax
mov al, byte [0x57c4a0]
test byte [eax*2 + str.________________________________H], 4
je 0x44a132
push dword [0x56fca4]
push 3
push str._c_02d
push 0x57c887
call fcn.005395b8
pop ecx
add eax, 0x57c887
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x44a159
push dword [0x56fca4]
push 3
push str._c_d
push 0x57c887
call fcn.005395b8
pop ecx
add eax, 0x57c887
push eax
call sub.USER32.dll_wsprintfA
add esp, 0x10
push 0x57c4a0
push 0x57c887
call fcn.005394dc
add esp, 8
push edi
mov esi, 0x57c4a0
mov edi, 0x57c887
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
xchg edi, esi
mov eax, edi
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
jmp 0x44a1a2
push 0xf
push 0x57c4a0
call fcn.004fec28
push dword [0x56fc54]
call fcn.005395b8
pop ecx
mov ebx, eax
push 0x57c4a0
call fcn.005395b8
pop ecx
add ebx, eax
add ebx, 0x14
mov dword [0x56fc6c], ebx
cmp ebx, dword [0x56fc94]
jle 0x44a219
add dword [0x56fc6c], 0x64
mov eax, dword [0x56fc6c]
mov dword [0x56fc94], eax
push dword [0x56fc94]
push dword [0x56fc54]
call fcn.00545f18
add esp, 8
mov dword [0x56fc58], eax
cmp dword [0x56fc58], 0
jne 0x44a20d
push 0
call fcn.0041c2be
jmp 0x44a2aa
mov edx, dword [0x56fc58]
mov dword [0x56fc54], edx
push 0x57c4a0
push dword [0x56fc54]
call fcn.005394dc
add esp, 8
mov ecx, dword [edi]
mov eax, dword [ecx + 8]
mov dword [0x56fc90], eax
mov edx, dword [edi]
mov ecx, dword [edx + 0x34]
mov dword [edi], ecx
dec dword [0x56fc74]
mov ebx, dword [edi]
test ebx, ebx
je 0x44a256
cmp dword [0x56fc74], 0
jge 0x449aa6
push dword [0x56fc54]
call fcn.005395b8
pop ecx
cmp eax, 1
jbe 0x44a2aa
cmp dword [0x56fcb4], 0
je 0x44a292
push 0xf
push 0x54e3fa
push dword [0x56fc54]
call fcn.005395b8
pop ecx
add eax, dword [0x56fc54]
push eax
call sub.USER32.dll_wsprintfA
add esp, 0xc
push 0
push dword [0x56fc54]
call fcn.0041d1e7
test eax, eax
jne 0x44a2aa
push 0
call fcn.0041c2be
cmp dword [0x56fc54], 0
je 0x44a2bf
push dword [0x56fc54]
call fcn.00545938
pop ecx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4