Function at 0x4eb200
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x5fc150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x3c], ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
cmp ebx, 0x200
ja 0x4eb491
je 0x4eb298
cmp ebx, 0x2b
je 0x4eb27a
cmp ebx, 0x100
jne case.0x4eb4b2.517
cmp dword [ebp + 0x10], 0xa2
jne 0x4eba5c
push 0x57e
push dword [edi + 4]
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
push esi
call fcn.004ea1b0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edi + 0x30], 0
je 0x4eb2fb
cmp byte [edi + 0x38], 0
jne 0x4eb2fb
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x4eb2be
mov byte [edi + 0x30], 0
mov dword [edi + 0x34], 0
jmp 0x4eb2fb
inc dword [edi + 0x34]
cmp dword [edi + 0x34], 2
jle 0x4eb2fb
push 0
push 0
push 0x130b
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
js 0x4eb2fb
mov dword [edi + 0x40], eax
mov dword [edi + 0x3c], eax
mov byte [edi + 0x38], 1
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [edi + 0xc]
je 0x4eb2fb
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, esi
movzx edx, si
shr eax, 0x10
cmp byte [edi + 0x38], 0
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
je 0x4eb346
push eax
push edx
mov ecx, edi
call fcn.004ea910
lea esi, [edi + 0x48]
push esi
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esi + 4]
mov ecx, edi
push dword [esi]
call fcn.004ea0d0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 0xc], eax
xor cl, cl
lea eax, [ebp - 0x10]
mov byte [ebp - 0x35], cl
push eax
push 0
push 0x130d
push dword [edi + 0xc]
mov dword [ebp - 0x10], edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x64]
cmp ecx, eax
jne 0x4eb371
cmp ecx, 0xffffffff
jne 0x4eb3aa
cmp eax, 0xffffffff
jne 0x4eb385
cmp ecx, eax
je 0x4eb3aa
push eax
mov dword [edi + 0x64], eax
push 0xfffffdcc
jmp 0x4eb3a3
cmp ecx, 0xffffffff
jne 0x4eb392
push eax
push 0xfffffdcd
jmp 0x4eb3a0
cmp ecx, eax
je 0x4eb3aa
push eax
mov byte [ebp - 0x35], 1
push 0xfffffdcb
mov dword [edi + 0x64], eax
mov ecx, edi
call fcn.004eb0a0
cmp byte [0x611305], 0
je 0x4eb469
mov eax, dword [edi + 0x54]
lea ecx, [edi + 0x54]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 8], eax
mov al, byte [edi + 0x70]
mov byte [ebp - 0x36], al
mov eax, dword [edi + 0x64]
push ecx
cmp eax, 0xffffffff
je 0x4eb40c
push eax
push 0x130a
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [edi + 0x2c]
lea ecx, [edi + 0x68]
push eax
lea eax, [edi + 0x54]
push eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.004eafc0
mov byte [edi + 0x70], al
jmp 0x4eb416
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov byte [edi + 0x70], 0
mov al, byte [ebp - 0x35]
mov cl, byte [ebp - 0x36]
test al, al
jne 0x4eb425
cmp byte [edi + 0x70], cl
je 0x4eb45a
test cl, cl
mov ecx, dword [sym.imp.USER32.dll_InvalidateRect]
je 0x4eb449
test al, al
jne 0x4eb438
cmp byte [edi + 0x70], al
jne 0x4eb44f
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x3c]
call ecx
mov ecx, dword [sym.imp.USER32.dll_InvalidateRect]
cmp byte [edi + 0x70], 0
je 0x4eb469
push 0
lea eax, [edi + 0x54]
push eax
push dword [ebp - 0x3c]
call ecx
cmp byte [edi + 0x70], 0
je 0x4eb469
push 2
mov ecx, edi
call fcn.004ebc80
xor eax, eax
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 8], eax
mov eax, dword [edi + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], 2
call dword [sym.imp.USER32.dll_TrackMouseEvent]
jmp case.0x4eb4b2.517
cmp ebx, 0x215
ja 0x4eba03
je 0x4eb9dd
lea eax, [ebx - 0x201]
cmp eax, 9
ja case.0x4eb4b2.517
jmp dword [eax*4 + 0x4ebaec]
cmp byte [edi + 0x38], 0
jne 0x4eba5c
mov ebx, dword [ebp + 0x10]
push 0
push 0
push 0x1304
push dword [edi + 0xc]
shr ebx, 0x10
shr bx, 0xf
call dword [sym.imp.USER32.dll_SendMessageW]
lea esi, [eax - 1]
mov eax, dword [ebp + 0x10]
mov ecx, eax
and ecx, 0xc
cmp ecx, 0xc
jne 0x4eb518
movzx ecx, bl
neg ecx
sbb ecx, ecx
and ecx, esi
push ecx
mov ecx, edi
call fcn.004ebb20
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
test al, 4
je 0x4eb581
cmp byte [0x611304], 0
je 0x4eb581
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x130b
push dword [edi + 0xc]
call eax
xor ecx, ecx
mov edx, eax
test bl, bl
setne cl
lea ecx, [ecx*2 - 1]
add ecx, edx
js 0x4eb558
xor eax, eax
cmp ecx, esi
setg al
lea esi, [eax - 1]
and esi, ecx
cmp edx, esi
je 0x4eba5c
push esi
push edx
mov ecx, edi
call fcn.004ea9a0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
test ecx, ecx
je 0x4eb5d4
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x130b
push dword [edi + 0xc]
call eax
xor ecx, ecx
test bl, bl
setne cl
lea ecx, [ecx*2 - 1]
add eax, ecx
jns 0x4eb5bd
mov eax, dword [ebp + 0x10]
test al, 8
je 0x4eba5c
mov eax, esi
push eax
jmp 0x4eb4f9
cmp eax, esi
jle 0x4eb5ce
mov eax, dword [ebp + 0x10]
test al, 8
je 0x4eba5c
xor eax, eax
push eax
jmp 0x4eb4f9
cmp byte [edi + 0x2d], 0
jne 0x4eba5c
lea eax, [ebp - 0x24]
push eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
push esi
push 0x130a
push dword [edi + 0xc]
call eax
lea eax, [ebp - 0x34]
push eax
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetClientRect]
call fcn.0040baa0
push 0x60
push dword [eax + 0xc]
push 0xc
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x130d
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x3c], eax
cmp eax, 1
jge 0x4eb653
xor edx, edx
cmp byte [edi + 0x2c], dl
je 0x4eb642
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x28]
jmp 0x4eb648
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x2c]
setl dl
test edx, edx
jne 0x4eba5c
call fcn.0040baa0
push 0x60
push dword [eax + 0xc]
push 0x2c
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor edx, edx
mov dword [ebp - 0x40], eax
cmp byte [edi + 0x2c], dl
je 0x4eb679
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x18]
cmp ecx, eax
jmp 0x4eb682
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x40]
setl dl
test edx, edx
jne 0x4eb6f0
test bl, bl
jne 0x4eba5c
mov ebx, dword [ebp - 0x3c]
dec ebx
test ebx, ebx
js 0x4eba5c
cmp ebx, esi
jg 0x4eba5c
cmp byte [edi + 0x70], 0
je 0x4eb6be
push 0
lea eax, [edi + 0x54]
mov byte [edi + 0x70], 0
push eax
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_InvalidateRect]
movzx eax, bx
push 0
shl eax, 0x10
or eax, 4
push eax
push 0x114
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
test bl, bl
je 0x4eb691
mov ebx, dword [ebp - 0x3c]
inc ebx
jmp 0x4eb695
push 0xfffffffffffffff0
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100
je 0x4eb746
mov eax, esi
mov ecx, edi
shr eax, 0x10
push eax
movzx eax, si
push eax
call fcn.004eab80
mov dword [ebp - 0x40], eax
cmp eax, 0xffffffff
je 0x4eb746
push 0
push 0
push 0x130b
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x40]
cmp ecx, eax
je 0x4eb746
push ecx
mov ecx, edi
call fcn.004ebb20
cmp byte [0x611305], 0
je 0x4eb7b1
movzx eax, byte [edi + 0x2c]
mov ecx, esi
push eax
shr ecx, 0x10
lea eax, [edi + 0x54]
push eax
movzx edx, si
push ecx
mov dword [ebp - 0x40], ecx
lea ecx, [edi + 0x68]
push edx
mov dword [ebp - 0x44], edx
call fcn.004eafc0
test al, al
je 0x4eb7b1
push dword [ebp - 0x40]
mov ecx, edi
push dword [ebp - 0x44]
call fcn.004eab80
push 0
push 0xac08
push 0x111
push dword [edi + 8]
mov dword [edi + 0x74], eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x10]
push esi
push ebx
push dword [ebp - 0x3c]
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_CallWindowProcW]
push 0
push 0
push 0x130b
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp esi, 2
je 0x4eba5c
cmp byte [0x611304], 0
je 0x4eb7eb
mov byte [edi + 0x30], 1
push eax
push 0xfffffffffffffffe
mov ecx, edi
call fcn.004eb0a0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
push 0xfffffffffffffff0
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x100
je 0x4eb855
mov eax, esi
mov ecx, edi
shr eax, 0x10
push eax
movzx eax, si
push eax
call fcn.004eab80
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4eb855
push 0
push 0
push 0x130b
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp ebx, eax
je 0x4eb855
push ebx
mov ecx, edi
call fcn.004ebb20
push esi
push dword [ebp + 0x10]
push 0x201
push dword [ebp - 0x3c]
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
mov eax, esi
movzx ecx, si
shr eax, 0x10
push eax
mov dword [ebp - 0x40], ecx
push ecx
mov ecx, edi
mov byte [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [ebp - 0x44], eax
call fcn.004eab80
cmp byte [edi + 0x38], 0
mov dword [ebp - 0x48], eax
je 0x4eb8f4
call dword [sym.imp.USER32.dll_GetCapture]
cmp eax, dword [edi + 0xc]
jne 0x4eb8c0
call dword [sym.imp.USER32.dll_ReleaseCapture]
jmp 0x4eb8c4
mov byte [edi + 0x38], 0
push dword [ebp - 0x48]
xor eax, eax
mov ecx, edi
cmp byte [edi + 0x39], al
setne al
add eax, 0xfffffdcf
push eax
call fcn.004eb0a0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
cmp byte [0x611305], 0
je case.0x4eb4b2.517
cmp dword [edi + 0x74], eax
jne 0x4eb990
movzx eax, byte [edi + 0x2c]
lea ecx, [edi + 0x54]
push eax
push ecx
push dword [ebp - 0x44]
lea ecx, [edi + 0x68]
push dword [ebp - 0x40]
call fcn.004eafc0
test al, al
je 0x4eb990
push dword [ebp - 0x48]
mov ecx, edi
push 0xfffffdce
call fcn.004eb0a0
mov ebx, dword [ebp - 0x44]
mov ecx, edi
mov esi, dword [ebp - 0x40]
push ebx
push esi
mov dword [edi + 0x74], 0xffffffff
call fcn.004eab80
cmp eax, 0xffffffff
je 0x4eb978
lea ecx, [edi + 0x54]
push ecx
push eax
push 0x130a
push dword [edi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, byte [edi + 0x2c]
lea ecx, [edi + 0x68]
push eax
lea eax, [edi + 0x54]
push eax
push ebx
push esi
call fcn.004eafc0
mov byte [edi + 0x70], al
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
mov dword [edi + 0x74], 0xffffffff
jmp case.0x4eb4b2.517
cmp byte [0x611306], 0
je 0x4eba5c
mov eax, esi
shr eax, 0x10
push eax
movzx eax, si
push eax
call fcn.004eab80
push eax
push 0xfffffdce
mov ecx, edi
call fcn.004eb0a0
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edi + 0x38], 0
je case.0x4eb4b2.517
mov byte [edi + 0x38], 0
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
cmp ebx, 0x2a3
je 0x4eba74
cmp ebx, 0x8024
jne case.0x4eb4b2.517
mov ebx, dword [ebp - 0x3c]
push 0xfffffffffffffff0
push ebx
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp dword [ebp + 0x10], 0
mov ecx, eax
jbe 0x4eba2f
or ecx, esi
jmp 0x4eba33
not esi
and ecx, esi
mov eax, ecx
shr eax, 7
and al, 1
mov byte [edi + 0x2c], al
mov eax, ecx
push ecx
shr eax, 9
push 0xfffffffffffffff0
and al, 1
push ebx
mov byte [edi + 0x2d], al
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10
cmp byte [edi + 0x70], 0
je 0x4eba89
push 0
lea eax, [edi + 0x54]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [edi + 0x54]
mov dword [edi + 0x64], 0xffffffff
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0x64]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0x4e
push dword [edi + 8]
mov byte [edi + 0x70], 0
mov dword [ebp - 0x1c], 0xfffffdcc
mov dword [ebp - 0x20], edi
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
push dword [ebp + 0x10]
push ebx
push dword [ebp - 0x3c]
push dword [edi + 0x50]
call dword [sym.imp.USER32.dll_CallWindowProcW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052c233
mov esp, ebp
pop ebp
ret 0x10