Function at 0x50b2b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x50b717
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x24]
mov edx, dword [0x48f77c]
call fcn.00403140
test al, al
je 0x50b2f3
mov edx, edi
mov eax, dword [esi + 0x24]
mov bx, 0xffbe
call fcn.004031a4
cmp byte [edi], 9
jne 0x50b300
mov byte [edi], 0
jmp 0x50b6f9
mov al, byte [edi]
add al, 0xe0
sub al, 0xe0
jb 0x50b324
mov al, byte [edi]
cmp al, 8
je 0x50b324
cmp byte [edi], 0xd
jne 0x50b44b
cmp byte [esi + 0x239], 0
je 0x50b44b
mov eax, esi
call fcn.0050babc
test eax, eax
je 0x50b354
mov eax, esi
call fcn.0050babc
cmp byte [eax + 0x2d], 0
jne 0x50b354
mov eax, esi
call fcn.0050babc
mov al, byte [eax + 0x2e]
add al, 0xfe
sub al, 2
jb 0x50b354
mov byte [edi], 0
jmp 0x50b6f9
mov eax, esi
call fcn.0050babc
test eax, eax
jne 0x50b37c
mov eax, esi
call fcn.0050bb44
test al, al
jne 0x50b6f9
xor edx, edx
mov eax, esi
call fcn.0050bb50
jmp 0x50b44b
mov eax, esi
call fcn.0050bb44
test al, al
jne 0x50b44b
mov eax, dword [esi + 0x258]
cmp dword [eax + 0x1c], 0
je 0x50b44b
mov eax, dword [esi + 0x258]
mov eax, dword [eax + 0x1c]
call fcn.00510394
test al, al
je 0x50b44b
mov ebx, dword [esi + 0x258]
mov eax, dword [ebx + 0x1c]
cmp byte [eax + 0x35], 0
jne 0x50b6f9
mov eax, ebx
call fcn.0046cb98
mov edx, dword [eax]
call dword [edx + 0x124]
test al, al
je 0x50b6f9
mov eax, dword [esi + 0x258]
mov eax, dword [eax + 0x1c]
call fcn.00510394
test al, al
je 0x50b439
mov ebx, dword [esi + 0x24]
mov eax, ebx
mov edx, dword [0x4f53a4]
call fcn.00403140
test al, al
je 0x50b429
mov eax, ebx
mov edx, dword [0x4f53a4]
call fcn.00403158
cmp byte [eax + 0x371], 0
je 0x50b429
mov eax, dword [esi + 0x258]
call fcn.0046cb98
call fcn.00471cb8
jmp 0x50b439
mov eax, dword [esi + 0x258]
call fcn.0046cb98
call fcn.00471cb8
cmp byte [esi + 0x1f6], 0
je 0x50b44b
xor edx, edx
mov eax, esi
call fcn.0042ad4c
mov eax, dword [esi + 0x228]
call fcn.0050e120
test al, al
je 0x50b465
mov eax, esi
call fcn.00509ea8
test al, al
jne 0x50b4bf
cmp byte [esi + 0x26c], 0
je 0x50b4bf
mov al, byte [edi]
cmp al, 0x20
jne 0x50b4bf
mov eax, esi
mov bx, 0xffb5
call fcn.004031a4
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x50b4bf
mov edx, edi
mov eax, esi
call fcn.0050acdc
test al, al
je 0x50b4bf
cmp word [esi + 0x232], 0
je 0x50b6f9
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.0045cc28
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0050d304
jmp 0x50b6f9
mov bl, byte [edi]
mov edx, edi
mov eax, esi
call fcn.0050d604
mov byte [ebp - 5], 0
cmp byte [edi], 0
jne 0x50b4e7
cmp byte [esi + 0x241], 0
je 0x50b4e7
mov dl, 1
mov eax, esi
call fcn.0050e244
jmp 0x50b501
mov eax, esi
call fcn.0045cedc
test al, al
je 0x50b501
cmp byte [edi], 0
jne 0x50b501
test bl, bl
je 0x50b501
mov byte [edi], bl
mov byte [ebp - 5], 1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x128]
test al, al
jne 0x50b60d
mov eax, dword [esi + 0x258]
mov ebx, dword [eax + 0x1c]
mov eax, ebx
mov edx, dword [0x461124]
call fcn.00403140
test al, al
jne 0x50b547
mov eax, ebx
mov edx, dword [0x461838]
call fcn.00403140
test al, al
je 0x50b5d8
cmp dword [ebx + 0xd0], 0
je 0x50b5d8
mov al, byte [edi]
add al, 0xe0
sub al, 0xe0
jae 0x50b60d
mov eax, dword [esi + 0x258]
mov eax, dword [eax + 0x1c]
mov edx, dword [0x461124]
call fcn.00403140
test al, al
je 0x50b59c
mov al, byte [edi]
sub al, 0x2b
je 0x50b60d
sub al, 2
je 0x50b60d
add al, 0xfd
sub al, 0xa
jb 0x50b60d
push 0
call sub.user32.dll_MessageBeep
mov byte [edi], 0
jmp 0x50b60d
push esi
push edi
mov esi, 0x50b728
lea edi, [ebp - 0x2c]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [0x531524]
mov al, byte [eax]
and eax, 0xff
bts dword [ebp - 0x2c], eax
mov al, byte [edi]
and eax, 0xff
bt dword [ebp - 0x2c], eax
jb 0x50b60d
push 0
call sub.user32.dll_MessageBeep
mov byte [edi], 0
jmp 0x50b60d
mov al, byte [edi]
add al, 0xe0
sub al, 0xe0
jae 0x50b60d
mov eax, dword [esi + 0x258]
cmp dword [eax + 0x1c], 0
je 0x50b60d
mov dl, byte [edi]
mov eax, dword [esi + 0x258]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax]
call dword [ecx + 0xc8]
test al, al
jne 0x50b60d
push 0
call sub.user32.dll_MessageBeep
mov byte [edi], 0
xor eax, eax
mov al, byte [edi]
cmp eax, 0x16
jg 0x50b62e
je 0x50b646
sub eax, 8
je 0x50b646
dec eax
je 0x50b6db
sub eax, 4
je 0x50b6a5
jmp 0x50b6f0
sub eax, 0x18
je 0x50b646
sub eax, 3
je 0x50b671
add eax, 0xfffffffb
sub eax, 0xe0
jae 0x50b6f0
mov eax, dword [esi + 0x258]
call fcn.004a8624
mov dl, 1
mov eax, esi
call fcn.0050e244
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
jne 0x50b6f0
mov byte [edi], 0
jmp 0x50b6f0
mov eax, esi
mov edx, dword [eax]
call dword [edx + pe_nt_image_headers32]
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x74]
mov byte [edi], 0
mov ebx, dword [esi + 0x24]
mov eax, ebx
mov edx, dword [0x4f53a4]
call fcn.00403140
test al, al
je 0x50b6f0
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xb0]
jmp 0x50b6f0
cmp byte [esi + 0x239], 0
je 0x50b6c4
mov eax, dword [esi + 0x258]
call fcn.004a8624
mov dl, 1
mov eax, esi
call fcn.0050e244
jmp 0x50b6f0
mov eax, dword [esi + 0x24]
mov edx, dword [0x4f53a4]
call fcn.00403140
test al, al
je 0x50b6f0
mov byte [edi], 0
jmp 0x50b6f0
mov eax, dword [esi + 0x24]
mov edx, dword [0x4f53a4]
call fcn.00403140
test al, al
je 0x50b6f0
mov byte [edi], 0
cmp byte [ebp - 5], 0
je 0x50b6f9
mov byte [edi], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50b71e
lea eax, [ebp - 0xc]
call fcn.00403c90
lea eax, [ebp - 4]
call fcn.00403c90
ret