Function at 0x4ed7e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 4], ax
push 0x90
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 8], ax
push 0x91
call dword [sym.imp.USER32.dll_GetKeyState]
mov word [ebp - 0xc], ax
push 0x596fc8
push 0x59c1a0
call fcn.00427390
add esp, 8
test eax, eax
jne 0x4ed82b
jmp 0x4edbd8
cmp dword [0x59cea0], 0
je 0x4ed83d
cmp dword [0x59bfe8], 0
jne 0x4ed853
mov dword [0x5a3e60], 2
push 0xffffffffffffffff
push 0x5a3e70
call fcn.00403084
cmp dword [0x5a40e8], 0
je 0x4ed86d
mov eax, dword [0x5a40e8]
push eax
call dword [sym.imp.WINMM.dll_timeBeginPeriod]
mov dword [0x5a7f64], eax
movsx ecx, word [ebp - 4]
test ecx, ecx
je 0x4ed87f
push 0x14
call fcn.004edf00
add esp, 4
movsx edx, word [ebp - 8]
test edx, edx
je 0x4ed894
push 0x90
call fcn.004edf00
add esp, 4
movsx eax, word [ebp - 0xc]
test eax, eax
je 0x4ed8a9
push 0x91
call fcn.004edf00
add esp, 4
mov ecx, 1
imul edx, ecx, 0
movsx eax, byte [edx + 0x54015c]
cmp eax, 0x59
jne 0x4ed8d6
mov ecx, dword [0x5a6a44]
mov dword [0x5a6bb4], ecx
push 0x5a6ba0
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
mov dword [0x5a5720], 1
jmp 0x4ed8f1
mov edx, dword [0x5a5720]
add edx, 1
mov dword [0x5a5720], edx
mov eax, dword [0x5a5720]
cmp eax, dword [0x59bfe8]
jg 0x4edb82
imul ecx, dword [0x5a5720], 0x418
mov edx, dword [0x59cea0]
cmp dword [edx + ecx + 0x40c], 0
jle 0x4edb7d
imul eax, dword [0x5a5720], 0x418
mov ecx, dword [0x59cea0]
lea edx, [ecx + eax + 0x109]
push edx
call fcn.004ed5a0
add esp, 4
mov dword [0x5a4234], 1
jmp 0x4ed959
mov eax, dword [0x5a4234]
add eax, 1
mov dword [0x5a4234], eax
imul ecx, dword [0x5a5720], 0x418
mov edx, dword [0x59cea0]
mov eax, dword [0x5a4234]
cmp eax, dword [edx + ecx + 0x40c]
jg 0x4edb5d
imul ecx, dword [0x5a5720], 0x418
add ecx, dword [0x59cea0]
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [ecx + eax + 8]
cmp ecx, 0x59
jne 0x4ed9d7
imul edx, dword [0x5a5720], 0x418
imul eax, dword [0x5a4234], 0x41
mov ecx, dword [0x59cea0]
mov edx, dword [ecx + edx + 0x410]
add edx, eax
push edx
push 0
call fcn.004ee060
add esp, 8
push 0x596fc4
push 0
call fcn.004ee060
add esp, 8
push str.NULLOBJECT
imul eax, dword [0x5a5720], 0x418
imul ecx, dword [0x5a4234], 0x41
mov edx, dword [0x59cea0]
mov eax, dword [edx + eax + 0x410]
add eax, ecx
push eax
call fcn.00427390
add esp, 8
test eax, eax
jne 0x4eda2e
imul ecx, dword [0x5a5720], 0x418
mov edx, dword [0x59cea0]
lea eax, [edx + ecx + 0x20a]
push eax
call fcn.004ed5a0
add esp, 4
jmp 0x4edb58
imul ecx, dword [0x5a5720], 0x418
imul edx, dword [0x5a4234], 0x10c
mov eax, dword [0x59cea0]
mov ecx, dword [eax + ecx + 0x414]
add ecx, edx
push ecx
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x4edb58
imul edx, dword [0x5a5720], 0x418
imul eax, dword [0x5a4234], 0x10c
mov ecx, dword [0x59cea0]
mov edx, dword [ecx + edx + 0x414]
add edx, eax
push edx
imul eax, dword [0x5a5720], 0x418
mov ecx, dword [0x59cea0]
mov edx, dword [ecx + eax + 4]
push edx
call fcn.004ee060
add esp, 8
imul eax, dword [0x5a5720], 0x418
mov ecx, dword [0x59cea0]
mov edx, dword [0x5a4234]
cmp edx, dword [ecx + eax + 0x40c]
jge 0x4edb58
mov eax, dword [0x5a4234]
add eax, 1
mov dword [0x5a5088], eax
jmp 0x4edae3
mov ecx, dword [0x5a5088]
add ecx, 1
mov dword [0x5a5088], ecx
imul edx, dword [0x5a5720], 0x418
mov eax, dword [0x59cea0]
mov ecx, dword [0x5a5088]
cmp ecx, dword [eax + edx + 0x40c]
jg 0x4edb58
imul edx, dword [0x5a5720], 0x418
imul eax, dword [0x5a5088], 0x10c
mov ecx, dword [0x59cea0]
mov edx, dword [ecx + edx + 0x414]
add edx, eax
push edx
call fcn.0040cf90
add esp, 4
test eax, eax
je 0x4edb53
imul eax, dword [0x5a5720], 0x418
mov ecx, dword [0x59cea0]
lea edx, [ecx + eax + 0x20a]
push edx
call fcn.004ed5a0
add esp, 4
jmp 0x4edb58
jmp 0x4edad4
jmp 0x4ed94c
imul eax, dword [0x5a5720], 0x418
mov ecx, dword [0x59cea0]
lea edx, [ecx + eax + 0x30b]
push edx
call fcn.004ed5a0
add esp, 4
jmp 0x4ed8e2
movsx eax, word [ebp - 4]
test eax, eax
je 0x4edb94
push 0x14
call fcn.004edf00
add esp, 4
movsx ecx, word [ebp - 8]
test ecx, ecx
je 0x4edba9
push 0x90
call fcn.004edf00
add esp, 4
movsx edx, word [ebp - 0xc]
test edx, edx
je 0x4edbbe
push 0x91
call fcn.004edf00
add esp, 4
cmp dword [0x5a40e8], 0
je 0x4edbd8
mov eax, dword [0x5a40e8]
push eax
call dword [sym.imp.WINMM.dll_timeEndPeriod]
mov dword [0x5a7f64], eax
mov esp, ebp
pop ebp
ret