Function at 0x4c7970
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x34]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4c80e7
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 1
mov eax, dword [0x4f8668]
mov eax, dword [eax]
xor edx, edx
call fcn.0044e53c
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
call fcn.004c4584
test eax, eax
jle 0x4c7a76
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x24]
mov eax, ebx
call fcn.004c4584
mov edx, eax
dec edx
mov eax, ebx
call fcn.004c458c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x24]
mov ebx, dword [esi + 0x84]
test ebx, ebx
jl 0x4c7a62
mov eax, esi
call fcn.004c4584
cmp ebx, eax
jge 0x4c7a62
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x24]
mov edx, dword [ebx + 0x84]
mov eax, ebx
call fcn.004c458c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
cmp byte [eax + 0x70], 0
je 0x4c7a4e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x24]
mov eax, ebx
call fcn.004c4584
mov edx, dword [ebx + 0x84]
inc edx
cmp eax, edx
jle 0x4c7a4e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x24]
mov edx, dword [ebx + 0x84]
inc edx
mov eax, ebx
call fcn.004c458c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4c7a62
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0x10]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.004c6f0c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x4c7a8c
mov eax, ebx
call fcn.00437cf8
call fcn.004820c0
mov byte [ebp - 6], 1
jmp 0x4c80af
cmp byte [ebp - 6], 0
jne 0x4c7aa0
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4c808e
mov eax, dword [edi + 4]
sub eax, 0x12
je 0x4c7bae
sub eax, 0x34
je 0x4c7ad2
add eax, 0xffffffa5
sub eax, 9
jb 0x4c7bae
sub eax, 0x157
je 0x4c7ae3
jmp 0x4c7bba
push ebp
call fcn.004c791c
pop ecx
call fcn.004036d8
jmp 0x4c80ee
lea edx, [ebp - 0x10]
mov eax, dword [edi + 0xc]
call fcn.00407888
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00431790
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
test ebx, ebx
je 0x4c7b5f
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebx + 0x90]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4c7b5f
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4c7bba
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4c7b91
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x30]
call fcn.00431790
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [esi + 0x34]
add eax, 0x90
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4c7b8e
mov bl, 1
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x4c7b99
test bl, bl
je 0x4c7b66
test bl, bl
jne 0x4c7bba
push ebp
call fcn.004c791c
pop ecx
call fcn.004036d8
jmp 0x4c80ee
push ebp
call fcn.004c791c
pop ecx
jmp 0x4c808e
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4c808e
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x4c808e
add eax, 0xffffff7b
sub eax, 9
jb 0x4c7c0c
add eax, 0xffffff09
sub eax, 0xb
jb 0x4c7ecd
sub eax, 0x264
jne 0x4c8088
mov eax, dword [ebp - 4]
call fcn.004c75cc
jmp 0x4c808e
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4c808e
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4c7c42
sub eax, 2
je 0x4c7e74
sub eax, 2
je 0x4c7c42
sub eax, 2
je 0x4c7e74
jmp 0x4c808e
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4c7c85
je 0x4c7d37
cmp eax, 0x12
jg 0x4c7c6e
je 0x4c7e5d
sub eax, 9
je 0x4c808e
sub eax, 4
je 0x4c7caa
jmp 0x4c7e69
sub eax, 0x1b
je 0x4c7d0f
sub eax, 5
je 0x4c808e
jmp 0x4c7e69
sub eax, 0x26
je 0x4c7e20
dec eax
je 0x4c7da1
dec eax
je 0x4c7e3a
sub eax, 0x51
je 0x4c7e5d
jmp 0x4c7e69
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
test eax, eax
je 0x4c7cbd
mov bx, 0xfff0
call fcn.0040307c
mov eax, dword [ebp - 4]
call fcn.004c75cc
test al, al
jne 0x4c808e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
je 0x4c808e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov eax, dword [eax + 0x24]
mov edx, 0x4c80fc
call fcn.00404470
je 0x4c808e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
cmp byte [eax + 0x29], 0
je 0x4c808e
push ebp
call fcn.004c791c
pop ecx
jmp 0x4c808e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x4c7d1d
mov byte [eax + 0x38], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x34], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.004036d8
jmp 0x4c80ee
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28], 0
je 0x4c7d4d
mov eax, dword [ebp - 4]
call fcn.004c77dc
jmp 0x4c808e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4c808e
cmp byte [ebx + 0x28], 0
je 0x4c7d82
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
call fcn.004036d8
jmp 0x4c80ee
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4c808e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28], 0
je 0x4c7db7
mov eax, dword [ebp - 4]
call fcn.004c76ac
jmp 0x4c808e
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
je 0x4c808e
mov eax, dword [ebp - 4]
call fcn.004c75cc
test al, al
jne 0x4c808e
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
cmp byte [ebx + 0x28], 0
je 0x4c7e01
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
call fcn.004036d8
jmp 0x4c80ee
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4c808e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28], 0
jne 0x4c808e
mov eax, dword [ebp - 4]
call fcn.004c77dc
jmp 0x4c808e
mov eax, dword [ebp - 4]
cmp byte [eax + 0x28], 0
jne 0x4c7e50
mov eax, dword [ebp - 4]
call fcn.004c76ac
jmp 0x4c808e
mov eax, dword [ebp - 4]
call fcn.004c75cc
jmp 0x4c808e
push ebp
call fcn.004c791c
pop ecx
jmp 0x4c808e
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4c808e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dl, byte [edi + 8]
call fcn.004c6494
test eax, eax
je 0x4c808e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dl, byte [edi + 8]
call fcn.004c6494
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x34], ebx
test ebx, ebx
je 0x4c7eae
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4c808e
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x4c7ee5
sub eax, 2
je 0x4c7fd0
jmp 0x4c808e
lea edx, [ebp - 0x10]
mov eax, dword [edi + 0xc]
call fcn.00407888
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x511eec]
jne 0x4c7f16
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x511ef0]
je 0x4c808e
mov esi, dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea edx, [ebp - 0x4c]
mov eax, dword [esi + 0x30]
call fcn.004315f4
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4c7f43
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004c6f0c
jmp 0x4c7fb9
mov esi, dword [ebp - 4]
jmp 0x4c7f4a
mov esi, eax
mov eax, dword [esi + 0x3c]
test eax, eax
jne 0x4c7f48
test esi, esi
je 0x4c7fb9
mov ebx, dword [esi + 0x34]
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.004c6f0c
cmp ebx, dword [esi + 0x34]
je 0x4c7fb2
cmp esi, dword [ebp - 4]
je 0x4c7fb2
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4c7f91
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x3c]
cmp esi, ebx
jne 0x4c7f73
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
call fcn.004036d8
jmp 0x4c80ee
mov esi, dword [esi + 0x40]
test esi, esi
jne 0x4c7f55
mov eax, dword [ebp - 0x10]
mov dword [0x511eec], eax
mov eax, dword [ebp - 0xc]
mov dword [0x511ef0], eax
jmp 0x4c808e
lea edx, [ebp - 0x10]
mov eax, dword [edi + 0xc]
call fcn.00407888
lea eax, [ebp - 0x10]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00431790
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
test ebx, ebx
je 0x4c804c
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea eax, [ebx + 0x90]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4c804c
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00437cf8
push eax
call sub.user32.dll_PostMessageA
jmp 0x4c808e
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4c807e
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x18]
mov eax, dword [esi + 0x30]
call fcn.00431790
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [esi + 0x34]
add eax, 0x90
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4c807b
mov bl, 1
mov esi, dword [esi + 0x3c]
test esi, esi
je 0x4c808e
test bl, bl
je 0x4c8053
jmp 0x4c808e
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004c7948
pop ecx
test al, al
je 0x4c80af
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4c7aa9
push ebp
call fcn.004c7948
pop ecx
test al, al
jne 0x4c7a95
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c80ee
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
test eax, eax
je 0x4c80da
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x39], 0
call fcn.004820e0
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret