Function at 0x4b9650
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x450
mov eax, dword [0x67f864]
xor eax, esp
mov dword [esp + 0x44c], eax
push ebx
mov ebx, dword [esp + 0x458]
push ebp
push esi
mov esi, edx
mov eax, dword [esi]
push edi
xor ebp, ebp
mov edi, ecx
push eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x54], ebp
call fcn.004b9520
add esp, 4
cmp dword [esi], ebp
mov dword [esp + 0x4c], eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
jne 0x4b96bf
mov eax, dword [0x691184]
cmp eax, ebp
je 0x4b96bf
mov ecx, dword [0x691188]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
push ebp
push ebp
push 0xc
xor eax, eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x48], ebp
call fcn.00432080
add esp, 0xc
cmp eax, ebp
mov dword [esp + 0x28], eax
je 0x4b9b32
mov eax, dword [esi]
xor edx, edx
cmp eax, 2
sete dl
mov edi, 1
cmp eax, edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], edx
je 0x4b997f
push 0x100
lea eax, [esp + 0x5c]
push eax
push 3
push 3
call fcn.0051a1e0
mov eax, dword [0x690ca0]
add esp, 0x10
cmp eax, ebp
je 0x4b9732
cmp dword [eax + 0x118], ebp
lea esi, [edi + 2]
jne 0x4b9737
mov esi, 2
xor edi, edi
xor eax, eax
cmp ebx, ebp
jne 0x4b9756
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp eax, 0xffffffff
je 0x4b9b2a
add eax, 1
cmp esi, ebp
jne 0x4b9761
mov edi, 0x800
jmp 0x4b9791
cmp esi, 1
je 0x4b977d
cmp esi, 2
je 0x4b977d
cmp esi, 3
jne 0x4b9791
cmp ebx, ebp
je 0x4b978d
mov eax, dword [ebx]
lea edx, [eax + 1]
mov dword [ebx], edx
jmp 0x4b978d
cmp ebx, ebp
mov edi, 1
je 0x4b978d
mov eax, dword [ebx]
lea ecx, [eax + 1]
mov dword [ebx], ecx
mov dword [esp + 0x14], eax
push eax
push edi
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0x60]
call fcn.00515020
add esp, 8
cmp eax, ebp
je 0x4b9b2a
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push edx
call fcn.004322c0
add esp, 4
cmp eax, ebp
je 0x4b9b2a
mov ecx, dword [esp + 0x14]
push 0x100
lea edx, [esp + 0x5c]
push edx
push 4
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], 2
add dword [esp + 0x38], 1
push 3
call fcn.0051a1e0
add esp, 0x10
cmp dword [esp + 0x4c], ebp
je 0x4b9802
cmp dword [0x690ca0], ebp
mov eax, 3
jne 0x4b9807
mov eax, 2
push ebp
push ebp
lea ecx, [esp + 0x60]
push ecx
push eax
push edi
lea eax, [esp + 0x28]
call fcn.0053b3d0
add esp, 0x14
test eax, eax
je 0x4b9b2a
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push edx
call fcn.004322c0
add esp, 4
cmp eax, ebp
je 0x4b9b2a
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x58]
push 0x100
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], 3
mov esi, 1
add dword [esp + 0x30], esi
push edx
call fcn.00534ab0
neg eax
sbb eax, eax
neg eax
add eax, 7
push eax
push 3
call fcn.0051a1e0
xor ecx, ecx
cmp dword [esp + 0x5c], ebp
push ebp
setne cl
push ebp
lea eax, [esp + 0x70]
push eax
mov edx, edi
lea eax, [esp + 0x30]
add ecx, 2
push ecx
push edx
call fcn.0053b3d0
add esp, 0x24
test eax, eax
je 0x4b9b2a
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push eax
call fcn.004322c0
add esp, 4
cmp eax, ebp
je 0x4b9b2a
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov dword [eax + 4], ebp
mov dword [eax + 8], 4
mov eax, dword [0x690cac]
add dword [esp + 0x2c], esi
cmp eax, ebp
mov dword [esp + 0x3c], esi
mov word [esp + 0x40], 0xd
je 0x4b991f
mov ebx, dword [eax + 0x18]
cmp ebx, ebp
jne 0x4b98ed
xor edi, edi
jmp 0x4b98ef
mov edi, dword [ebx]
xor esi, esi
cmp edi, ebp
jle 0x4b9913
push esi
lea edx, [esp + 0x28]
push ebx
push edx
call fcn.004b91c0
add esp, 0xc
test eax, eax
je 0x4b9b2a
add esi, 1
cmp esi, edi
jl 0x4b98f5
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x3c], 1
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x4c], ebp
jne 0x4b9985
cmp dword [esi], 1
jne 0x4b9985
push 0x100
lea eax, [esp + 0x5c]
push eax
push 0x12
push 3
call fcn.0051a1e0
mov ecx, dword [esp + 0x34]
add esp, 0x10
xor eax, eax
cmp dword [esp + 0x30], ebp
mov edi, ecx
jne 0x4b9961
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp eax, 0xffffffff
je 0x4b9978
add eax, 1
push eax
push 1
lea ecx, [esp + 0x60]
call fcn.00515020
add esp, 8
cmp eax, ebp
jne 0x4b9a23
xor eax, eax
jmp 0x4b9b44
mov dword [esp + 0x3c], edi
jmp 0x4b9923
xor ecx, ecx
cmp dword [esi], 1
lea edi, [esp + 0x24]
sete cl
mov ebx, 0x4b94b0
lea ecx, [ecx + ecx + 0xe]
mov word [esp + 0x40], cx
call fcn.004f03a0
mov eax, dword [esp + 0x20]
xor edx, edx
cmp dword [eax], 1
mov eax, dword [0x6919cc]
sete dl
cmp eax, ebp
mov dword [esp + 0x3c], 1
lea edx, [edx + edx + 0xf]
mov word [esp + 0x40], dx
je 0x4b9a1f
mov edi, dword [eax + 0x18]
xor esi, esi
cmp edi, ebp
jl 0x4b9a1f
jmp 0x4b99da
mov eax, dword [0x6919cc]
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x54]
call fcn.00432240
add esp, 8
test eax, eax
je 0x4b99fc
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x14]
add eax, edx
jmp 0x4b99fe
xor eax, eax
mov edx, dword [eax]
push edx
lea ecx, [eax + 4]
lea edx, [esp + 0x28]
call fcn.004b9360
add esp, 4
test eax, eax
je 0x4b9b2a
add esi, 1
cmp esi, edi
jle 0x4b99d5
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp dword [eax], 1
je 0x4b9b11
xor eax, eax
cmp ebx, ebp
jne 0x4b9a4d
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp eax, 0xffffffff
je 0x4b9b2a
add eax, 1
lea edx, [esp + 0x258]
push edx
push eax
mov eax, dword [esp + 0x20]
push 0x800
push eax
mov word [esp + 0x268], bp
call dword [sym.imp.USER32.dll_AppendMenuW]
cmp eax, ebp
je 0x4b9b2a
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
push 0x100
jge 0x4b9aa0
lea ecx, [esp + 0x5c]
push ecx
push 6
push 3
call fcn.0051a1e0
add esp, 0x10
mov ebx, 1
jmp 0x4b9ab3
lea edx, [esp + 0x5c]
push edx
push 5
push 3
call fcn.0051a1e0
add esp, 0x10
xor ebx, ebx
mov eax, dword [esp + 0x1c]
cmp eax, ebp
jne 0x4b9ad2
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov esi, eax
cmp esi, 0xffffffff
je 0x4b9b2a
add esi, 1
jmp 0x4b9ad9
mov esi, dword [eax]
lea ecx, [esi + 1]
mov dword [eax], ecx
mov edi, dword [esp + 0x18]
push esi
push ebp
lea ecx, [esp + 0x60]
call fcn.00515020
add esp, 8
cmp eax, ebp
je 0x4b9b2a
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
push edx
call fcn.004322c0
add esp, 4
cmp eax, ebp
je 0x4b9b2a
mov dword [eax], esi
mov dword [eax + 4], ebp
mov dword [eax + 8], ebx
add dword [esp + 0x2c], 1
mov eax, dword [esp + 0x48]
cmp eax, ebp
mov dword [esp + 0x54], eax
je 0x4b9b2a
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov dword [ecx + 4], eax
jmp 0x4b9b40
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
cmp eax, ebp
mov dword [esi + 4], ebp
je 0x4b9b40
mov edi, eax
call fcn.00432140
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x45c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005ce60a
add esp, 0x450
ret