Function at 0x4e6d50
Capabilities:
Get number of processors
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x584c7b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x310
mov eax, dword [0x5f0524]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, esi
lea eax, [esi + 0x10]
neg edx
lea ecx, [ebp - 0x2a0]
sbb edx, edx
and edx, eax
push edx
call fcn.004fb811
lea eax, [ebp - 0x228]
mov dword [ebp - 4], 0
push eax
push dword [esi + 0x30]
xorps xmm0, xmm0
movups xmmword [ebp - 0x228], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x220]
sub edx, dword [ebp - 0x224]
sub ecx, dword [ebp - 0x228]
push 1
call fcn.00466aa0
mov ecx, esi
lea edx, [esi + 0x10]
neg ecx
sbb ecx, ecx
and ecx, edx
mov edx, eax
call fcn.0049d120
add esp, 4
mov edi, eax
cmp byte [esi + 0x185], 0
mov dword [ebp - 0x2e4], edi
je 0x4e6e24
push 1
push 0
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [esi + 0x185], 0
cmp byte [esi + 0xd4], 0
jne 0x4e6e8b
test edi, edi
je 0x4e6e3c
lea eax, [edi + 8]
mov dword [ebp - 0x2d4], eax
jmp 0x4e6e46
mov dword [ebp - 0x2d4], 0
movzx eax, byte [esi + 0xd2]
mov ecx, dword [esi + 0x180]
push eax
movzx eax, byte [esi + 0xd1]
push eax
movzx eax, byte [esi + 0xd0]
mov edx, dword [ecx]
push eax
push 1
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push dword [ebp - 0x2d4]
call dword [edx + 0x24]
jmp 0x4e6ed5
test edi, edi
je 0x4e6e94
lea eax, [edi + 8]
jmp 0x4e6e96
xor eax, eax
push eax
mov ecx, esi
call fcn.00486130
test edi, edi
je 0x4e6ea7
lea edx, [edi + 8]
jmp 0x4e6ea9
xor edx, edx
mov ecx, dword [esi + 0x180]
push 0
push 0
push 0
mov eax, dword [ecx]
push 0
push dword [ebp - 0x21c]
push dword [ebp - 0x220]
push dword [ebp - 0x224]
push dword [ebp - 0x228]
push edx
call dword [eax + 0x24]
lea eax, [ebp - 0x248]
mov dword [ebp - 0x2dc], 0
push eax
push dword [esi + 0x30]
xorps xmm0, xmm0
mov dword [ebp - 0x2d8], 0
movups xmmword [ebp - 0x248], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2dc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x4e6f2e
mov eax, dword [ebp - 0x248]
sub dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x244]
sub dword [ebp - 0x2d8], eax
jmp 0x4e6f42
mov dword [ebp - 0x2d8], 0xffff8001
mov dword [ebp - 0x2dc], 0xffff8001
push 0
push 0
push 0x1200
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2d4], eax
movups xmmword [ebp - 0x238], xmm0
test ecx, ecx
jle 0x4e7176
dec ecx
lea edi, [esi + 0x1b4]
mov dword [ebp - 0x2e8], ecx
lea ecx, [esi + 0xd8]
mov dword [ebp - 0x2f0], ecx
nop
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x320], 0x86
mov dword [ebp - 0x318], ecx
lea ecx, [ebp - 0x320]
push ecx
push eax
push 0x120b
push dword [esi + 0x30]
mov dword [ebp - 0x310], 0xff
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x238]
push eax
push dword [ebp - 0x2d4]
push 0x1207
push dword [esi + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x2e8]
cmp dword [ebp - 0x300], eax
jne 0x4e7008
mov ecx, dword [ebp - 0x230]
cmp ecx, dword [ebp - 0x220]
cmovl ecx, dword [ebp - 0x220]
mov dword [ebp - 0x230], ecx
mov eax, dword [ebp - 0x29c]
lea ecx, [esi + 0x10]
mov dword [ebp - 0x2d0], 0x64
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2c4], 1
test ecx, ecx
jne 0x4e7037
mov dword [ebp - 0x2bc], ecx
jmp 0x4e7040
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2d4]
lea edx, [ebp - 0x2d0]
movups xmm0, xmmword [ebp - 0x238]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ecx]
push edx
movups xmmword [ebp - 0x2b4], xmm0
call dword [eax + 0x16c]
push dword [ebp - 0x2d8]
lea ecx, [ebp - 0x238]
mov dword [ebp - 0x2e0], 0
push dword [ebp - 0x2dc]
call fcn.00466a00
test eax, eax
je 0x4e70ac
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
mov byte [esi + 0x185], 1
test ax, ax
sets cl
inc ecx
mov dword [ebp - 0x2e0], ecx
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax + 0x30]
call eax
mov edx, dword [ebp - 0x2d4]
cmp eax, edx
ja 0x4e70f4
mov eax, dword [ebp - 0x230]
sub eax, dword [ebp - 0x238]
mov dword [ebp - 0x2ec], eax
mov eax, dword [edi + 0x20]
cmp eax, dword [edi + 0x24]
jne 0x4e70e0
mov ecx, edi
call fcn.0042d690
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x1c]
mov edx, dword [ebp - 0x2ec]
mov dword [eax + ecx*4], edx
inc dword [edi + 0x20]
jmp 0x4e7109
mov ecx, dword [ebp - 0x230]
mov eax, dword [esi + 0x1d0]
sub ecx, dword [ebp - 0x238]
mov dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x2e4]
test eax, eax
je 0x4e7118
lea edx, [eax + 8]
jmp 0x4e711a
xor edx, edx
push dword [ebp - 0x2f0]
mov ecx, dword [esi + 0x180]
lea edi, [ebp - 0x218]
push edi
push dword [ebp - 0x2e0]
push dword [ebp - 0x22c]
mov eax, dword [ecx]
push dword [ebp - 0x230]
push dword [ebp - 0x234]
push dword [ebp - 0x238]
push edx
call dword [eax + 0x28]
mov eax, dword [ebp - 0x2d4]
lea edi, [esi + 0x1b4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp eax, dword [ebp - 0x2f4]
jl 0x4e6f90
mov edi, dword [ebp - 0x2e4]
cmp byte [esi + 0x1e2], 0
jne 0x4e71c5
test edi, edi
je 0x4e7188
lea eax, [edi + 8]
jmp 0x4e718a
xor eax, eax
mov ecx, dword [ebp - 0x21c]
mov edx, dword [ebp - 0x220]
sub ecx, dword [ebp - 0x224]
sub edx, dword [ebp - 0x228]
test eax, eax
je 0x4e71a9
mov eax, dword [eax + 4]
push 0xcc0020
push 0
push 0
push eax
push ecx
push edx
push 0
push 0
push dword [ebp - 0x29c]
call dword [sym.imp.GDI32.dll_BitBlt]
test edi, edi
je 0x4e71d2
mov eax, dword [edi + 4]
lea ecx, [edi + 4]
call dword [eax + 4]
lea ecx, [ebp - 0x2a0]
call fcn.004fb99c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0051a19b
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret