Function at 0x4cb281
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd08
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [0x62ae3c]
xor ebx, ebx
push edi
mov dword [ecx + 0x1954], eax
cmp dword [esi + 0x1f4], ebx
mov dword [esi + 0x1ec], eax
je 0x4cb2bc
push 1
mov ecx, esi
call fcn.004ca049
jmp 0x4cb506
mov ecx, esi
mov dword [esi + 0x1d4], ebx
call fcn.004cb02e
push 1
lea eax, [ebp - 0x108]
pop edi
push eax
mov dword [esi + 0x1d0], edi
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov al, byte [ebp - 0xf8]
and al, 0x80
cmp al, 0x80
jne 0x4cb2f3
mov dword [esi + 0x1e4], edi
jmp 0x4cb2f9
mov dword [esi + 0x1e4], ebx
mov eax, dword [0x62ae3c]
mov eax, dword [eax + 0x1950]
mov dword [esi + 0x1e8], eax
mov ecx, dword [0x62ae3c]
lea eax, [esi + 0x1d8]
mov ecx, dword [ecx + 0x195c]
mov dword [eax], ecx
mov ecx, dword [0x62ae3c]
cmp dword [eax], ebx
mov ecx, dword [ecx + 0x1960]
mov dword [esi + 0x1dc], ecx
jne 0x4cb4e7
cmp dword [0x5c5000], ebx
je 0x4cb4e7
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push dword [esi + 0x1c]
call fcn.00463bb0
mov eax, dword [ebp + 8]
sub eax, dword [ebp - 8]
cmp dword [esi + 0x20c], ebx
je 0x4cb364
add eax, eax
cmp eax, 0x3e9
jge 0x4cb4e7
cmp eax, ebx
jle 0x4cb4e7
add eax, 2
push eax
mov eax, dword [0x62ae3c]
lea ecx, [eax + 0x1948]
call fcn.0053ef7f
push eax
push dword [esi + 0x1c]
call fcn.00463754
cmp dword [esi + 0x20c], ebx
je 0x4cb4e7
mov eax, dword [esi + 0x3c]
cmp dword [eax + 0x190], ebx
mov eax, dword [0x62ae3c]
je 0x4cb491
mov eax, dword [eax + 0x1948]
cmp eax, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 4], eax
je 0x4cb3ed
push eax
call ebx
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00524e70
mov eax, esp
push edi
push dword [ebp - 4]
push eax
call fcn.0053f142
test eax, eax
mov dword [ebp - 4], eax
jne 0x4cb3f1
xor eax, eax
jmp 0x4cb414
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.00524e70
mov eax, esp
push edi
push dword [ebp - 4]
push eax
call fcn.0053f119
mov ecx, dword [0x62ae3c]
push eax
mov ecx, dword [ecx + 0x1948]
push ecx
call fcn.005282af
pop ecx
test eax, eax
mov eax, dword [0x62ae3c]
pop ecx
jne 0x4cb441
mov edi, dword [eax + 0x1948]
test edi, edi
je 0x4cb49b
push edi
call ebx
jmp 0x4cb4a6
push dword [eax + 0x1948]
lea eax, [ebp - 0xd08]
push eax
call fcn.005244aa
lea eax, [ebp - 0x508]
push 0x400
push eax
lea eax, [ebp - 0xd08]
push eax
call fcn.004c74e5
and byte [ebp + eax - 0x508], 0
mov eax, dword [0x62ae3c]
add esp, 0x14
lea ecx, [eax + 0x1948]
push 0xffffffffffffffff
call fcn.0053efce
lea eax, [ebp - 0x508]
push eax
jmp 0x4cb4d5
mov edi, dword [eax + 0x1948]
test edi, edi
jne 0x4cb49f
xor edi, edi
jmp 0x4cb4c2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.00524e70
mov eax, esp
push ebx
push edi
push eax
call fcn.0053f142
mov edi, eax
mov eax, dword [0x62ae3c]
push 0xffffffffffffffff
lea ecx, [eax + 0x1948]
call fcn.0053efce
push edi
mov eax, dword [0x62ae3c]
lea ecx, [eax + 0x1948]
call fcn.0053ecd8
xor ebx, ebx
mov eax, dword [0x62ae3c]
push ebx
push dword [esi + 0x1e8]
mov ecx, esi
push dword [esi + 0x1ec]
push dword [eax + 0x1948]
call fcn.004c8470
lea esp, [ebp - 0xd14]
pop edi
pop esi
pop ebx
leave
ret 4