Function at 0x4c6be0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esi + 0x18c64], 1
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edi, eax
movsx eax, di
mov ecx, edi
mov dword [esp + 0x14], eax
shr ecx, 0x10
movsx edx, cx
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x20], edx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 2
mov ecx, esi
call fcn.004d7e40
mov eax, dword [esi + 0x18c1c]
mov ebp, dword [sym.imp.USER32.dll_PtInRect]
xor ebx, ebx
cmp eax, ebx
jle 0x4c6ca0
cmp dword [esi + 0x18dd4], ebx
je 0x4c6c81
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esi + 0x18db4]
push eax
push ecx
call ebp
test eax, eax
je 0x4c6c81
push ebx
push ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
mov dword [esi + 0x18c50], ebx
mov dword [esi + 0x18c48], ebx
mov dword [esi + 0x18c2c], 0xffffffff
call fcn.004c4900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp dword [esi + 0x18dd8], ebx
je 0x4c6ca0
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esi + 0x18dc4]
push eax
push ecx
call ebp
test eax, eax
jne 0x4c6c57
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esi + 0x2578]
push eax
push ecx
call ebp
test eax, eax
je 0x4c6cde
push 1
mov ecx, esi
call fcn.004c91f0
mov edx, dword [esi + 4]
lea ecx, [esi + 0x2c]
push edx
mov dword [esi + 0x18c50], 1
call fcn.004d7640
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp dword [esi + 0x18c1c], ebx
jle 0x4c6e90
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.004c60a0
mov ecx, dword [esi + 0x25dc]
mov ebx, eax
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x4c6d99
mov eax, dword [esi + 0x18c44]
test eax, eax
jne 0x4c6d99
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x4c6d99
cmp dword [esi + 0x18c40], edi
je 0x4c6d99
mov eax, dword [esi + 0x18c4c]
test eax, eax
jne 0x4c6d99
cmp ebx, 0xffffffff
jne 0x4c6d58
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esi + 0x18da4]
push eax
push ecx
call ebp
test eax, eax
jne 0x4c6e54
mov eax, dword [esi + 0x18c54]
test eax, eax
je 0x4c6d99
mov edx, dword [esi + 0x18c20]
cmp dword [esi + edx*4 + 0x18604], ebx
je 0x4c6d99
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov ecx, esi
push eax
call fcn.004c8830
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
or edi, 0xffffffff
cmp ebx, edi
je 0x4c6e54
mov eax, dword [esi + 0x18c2c]
cmp eax, ebx
je 0x4c6df8
mov dword [esi + 0x18c2c], ebx
mov dword [esi + 0x18c34], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x18c3c], eax
mov eax, dword [esi + 0x25dc]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x4c6de8
mov edx, dword [eax + 0x74]
mov eax, dword [esi + 4]
push 0
push edx
push 0x100
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push edi
push 0
mov ecx, esi
call fcn.004c4900
jmp 0x4c6e69
mov ecx, dword [esi + 0x18c20]
cmp eax, dword [esi + ecx*4 + 0x18604]
je 0x4c6e0f
cmp dword [esi + 0x18c34], edi
je 0x4c6e69
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
lea ecx, [esi + 0x2568]
push eax
push ecx
call ebp
mov ecx, dword [esi + 0x18c44]
test ecx, ecx
je 0x4c6e36
mov ecx, dword [esi + 0x18c48]
test ecx, ecx
jne 0x4c6e3e
cmp dword [esi + 0x18c48], eax
je 0x4c6e69
push 0
push 0
push edi
push 0
mov ecx, esi
mov dword [esi + 0x18c48], eax
call fcn.004c4900
jmp 0x4c6e69
push 0
mov ecx, esi
call fcn.004c91f0
mov edx, dword [esi + 4]
lea ecx, [esi + 0x2c]
push edx
call fcn.004d75f0
cmp dword [esi + 0x25d8], ebx
je 0x4c6e90
mov eax, dword [esi + 4]
lea edi, [esi + 0x2c]
push eax
mov ecx, edi
mov dword [esi + 0x25d8], ebx
call fcn.004d7640
mov ecx, dword [esi + 4]
push ecx
mov ecx, edi
call fcn.004d75f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret