Function at 0x4ff9b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov dword [ebp - 0x10], 0x556a
mov al, byte [ebp + 8]
mov byte [ebp - 1], al
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0x3f6e
je 0x4ff9e0
cmp dword [ebp - 0x20], 0x556a
je 0x4ffa0c
jmp 0x4ffc25
lea edx, [ebp - 0x10]
push edx
push 0xbc
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x10]
add ecx, 0x111a
mov dword [ebp - 0x10], ecx
call fcn.004ff880
jmp 0x4ffc25
movzx edx, byte [ebp - 1]
and edx, 0x25
movzx eax, byte [ebp + 8]
cmp edx, eax
je 0x4ffa31
movzx ecx, byte [ebp + 8]
sar ecx, 7
mov byte [ebp - 1], cl
mov edx, dword [ebp - 0x10]
xor edx, 0x4f2b
mov dword [ebp - 0x10], edx
mov al, byte [ebp - 1]
mov byte [ebp - 0x24], al
cmp byte [ebp - 0x24], 0
je 0x4ffa4c
cmp byte [ebp - 0x24], 0x33
je 0x4ffbd0
jmp 0x4ffbe0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x2c], ecx
movzx edx, byte [ebp - 1]
shl edx, 0xc0
movzx eax, byte [ebp + 8]
cmp edx, eax
jge 0x4ffa93
mov cl, byte [ebp - 1]
mov byte [ebp - 0x34], cl
cmp byte [ebp - 0x34], 0xac
je 0x4ffa6f
jmp 0x4ffa7e
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
mov dword [ebp - 0x30], eax
jmp 0x4ffa93
mov al, byte [ebp - 1]
mov byte [ebp + 8], al
push 0x81
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 0x14], ax
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x10]
cdq
mov ecx, 0x3781
idiv ecx
cmp eax, dword [ebp - 0x2c]
jg 0x4ffae2
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0
je 0x4ffac0
cmp dword [ebp - 0x28], 0x9dde
je 0x4ffadb
jmp 0x4ffae0
mov byte [ebp - 2], 0x3d
mov al, byte [ebp - 1]
mov byte [ebp - 4], al
mov ecx, 0x496
mov word [ebp - 8], cx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
jmp 0x4ffae0
call fcn.004ff880
jmp 0x4ffb0f
movzx eax, byte [ebp - 1]
sub eax, 0xb1
movzx ecx, byte [ebp + 8]
cmp eax, ecx
jl 0x4ffb0f
movsx edx, word [ebp + 0x10]
movsx eax, word [ebp - 0x14]
add edx, eax
mov ecx, dword [ebp - 0x18]
mov word [ecx], dx
mov edx, dword [ebp - 0x2c]
and edx, 0x1770
mov dword [ebp - 0x10], edx
mov al, byte [ebp - 2]
mov byte [ebp - 0x38], al
cmp byte [ebp - 0x38], 0x4f
je 0x4ffb1d
jmp 0x4ffb34
movsx ecx, word [ebp - 0x14]
movsx edx, word [ebp + 0x10]
sub ecx, edx
mov eax, dword [ebp - 0x18]
mov word [eax], cx
call fcn.004ff880
jmp 0x4ffb9f
mov cl, byte [ebp - 1]
mov byte [ebp - 3], cl
mov dx, word [ebp - 8]
mov word [ebp - 0xc], dx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
movsx ecx, byte [ebp - 2]
cmp ecx, 0x51
jle 0x4ffb77
mov edx, dword [ebp + 0xc]
sub edx, 0x72de
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
movzx edx, byte [ebp + 8]
push edx
mov edx, dword [ebp - 0x14]
mov cl, byte [ebp - 3]
call fcn.005004b0
jmp 0x4ffb9f
movsx eax, byte [ebp - 2]
add eax, 0x52
cmp eax, 0xc
jge 0x4ffb9f
movsx ecx, word [ebp - 0x14]
movsx edx, word [ebp + 0x10]
or ecx, edx
mov eax, dword [ebp - 0x18]
mov word [eax], cx
mov ecx, dword [ebp - 0x50]
push ecx
call sub.WINSPOOL.DRV_AbortPrinter
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x18]
movzx eax, word [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
movzx edx, byte [ebp - 4]
push edx
call fcn.004ff9b0
add esp, 0xc
mov eax, dword [ebp + 0xc]
add eax, 0x5303
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x54]
push ecx
call sub.WINSPOOL.DRV_FindClosePrinterChangeNotification
mov dword [ebp - 0x3c], eax
jmp 0x4ffbe0
mov edx, 0x1ad
mov word [ebp + 0x10], dx
mov dword [ebp + 0xc], 0x2c99
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebp - 0x30], eax
mov dword [ebp + 0xc], 0xc9c2
mov edx, dword [ebp - 0x58]
push edx
call sub.WINSPOOL.DRV_AbortPrinter
mov dword [ebp - 0x5c], eax
movzx eax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
movzx edx, byte [ebp - 1]
push edx
call fcn.004ff9b0
add esp, 0xc
mov eax, dword [ebp - 0x10]
or eax, 0x49ac
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x53f9
mov dword [ebp - 0x10], ecx
push 0x88
push 0x1b
mov edx, dword [ebp - 0x10]
push edx
movzx eax, byte [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00500600
mov eax, 0xcc
mov esp, ebp
pop ebp
ret