Function at 0x4f5b64
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], 1
call fcn.0047cfd9
lea edi, [esi + 0x34]
mov ecx, dword [edi]
mov dword [ebp - 8], edi
test ecx, ecx
jne 0x4f5b97
cmp byte [ebp - 1], 0
je 0x4f5da9
call fcn.0047cff8
jmp 0x4f5da9
call fcn.004a3a85
test al, al
jne 0x4f5ba5
and dword [edi], 0
jmp 0x4f5b83
mov eax, dword [ebp + 8]
test eax, eax
je 0x4f5b83
dec eax
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push ebx
mov ebx, 0x100c
je 0x4f5d04
sub eax, 3
je 0x4f5ce4
dec eax
je 0x4f5cc4
dec eax
je 0x4f5ca4
dec eax
jne 0x4f5d2a
and dword [ebp - 0xc], eax
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 8]
push 2
push 0xffffffffffffffff
push ebx
push eax
jmp 0x4f5c0b
mov edx, dword [esi + 0x30]
mov ecx, eax
imul ecx, ecx, 0x2c
cmp dword [ecx + edx + 8], 0
je 0x4f5c00
inc dword [ebp - 0xc]
mov ecx, dword [esi + 0x2c]
mov ecx, dword [ecx + 8]
push 2
push eax
push ebx
push ecx
call edi
cmp eax, 0xffffffff
jne 0x4f5bee
cmp byte [0x88f82f], 0
je 0x4f5d2a
cmp byte [ebp - 1], 0
je 0x4f5c2e
mov byte [ebp - 1], 0
call fcn.0047cff8
push dword [ebp - 0xc]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x1c], 0x88f82f
mov dword [ebp - 0x2c], 0x24
call fcn.004f5afa
mov ecx, eax
call fcn.004a0ff9
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00477c73
pop ecx
pop ecx
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], eax
call fcn.004a0c7d
cmp byte [ebp - 1], 0
jne 0x4f5c7c
mov byte [ebp - 1], 1
call fcn.0047cfd9
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call fcn.004a3a85
test al, al
jne 0x4f5c95
mov eax, dword [ebp - 8]
and dword [eax], 0
jmp 0x4f5d9d
cmp dword [ebp - 0xc], 6
je 0x4f5d2a
jmp 0x4f5d9d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov al, byte [ecx + 0x1cf]
and al, 6
cmp al, 4
setne al
movzx eax, al
push eax
call fcn.00459a0b
jmp 0x4f5d9d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov al, byte [ecx + 0x1cf]
and al, 0xa
cmp al, 8
setne al
movzx eax, al
push eax
call fcn.004f59d2
jmp 0x4f5d9d
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov al, byte [ecx + 0x1cf]
and al, 3
cmp al, 1
setne al
movzx eax, al
push eax
call fcn.004599f1
jmp 0x4f5d9d
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, dword [ebp - 8]
xor edx, edx
inc edx
test ax, ax
lea eax, [ebp - 1]
push eax
jge 0x4f5d25
call fcn.0044ebcd
jmp 0x4f5d2a
call fcn.004f7164
push 2
push 0xffffffffffffffff
jmp 0x4f5d8b
mov eax, dword [ebp - 0xc]
mov ecx, dword [esi + 0x30]
imul eax, eax, 0x2c
mov eax, dword [eax + ecx + 8]
mov ecx, dword [ebp + 8]
dec ecx
dec ecx
je 0x4f5d69
dec ecx
je 0x4f5d5d
sub ecx, 4
jne 0x4f5d86
test eax, eax
je 0x4f5d86
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call fcn.00419039
jmp 0x4f5d86
test eax, eax
je 0x4f5d6d
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
test eax, eax
jne 0x4f5d7b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
and dword [eax + 0x348], 0
jmp 0x4f5d86
push eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call fcn.0040f51e
push 2
push dword [ebp - 0xc]
mov eax, dword [esi + 0x2c]
mov eax, dword [eax + 8]
push ebx
push eax
call edi
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
jne 0x4f5d30
cmp byte [ebp - 1], 0
je 0x4f5da8
call fcn.0047cff8
pop ebx
pop edi
pop esi
leave
ret 4