Function at 0x4a5e80
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xb0
push ebx
mov ebx, dword [esp + 0xbc]
push ebp
push esi
mov esi, dword [ebx + 4]
cmp esi, 0x200
push edi
mov ebp, ecx
je 0x4a5ec2
cmp esi, 0xa0
je 0x4a5ec2
cmp esi, 0x202
je 0x4a5ec2
cmp esi, 0x205
je 0x4a5ec2
cmp esi, 0x208
jne 0x4a6429
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call edi
test ax, ax
jl 0x4a6429
push 2
call edi
test ax, ax
jl 0x4a6429
push 4
call edi
test ax, ax
jl 0x4a6429
mov eax, dword [esp + 0xcc]
test eax, eax
mov edi, dword [esp + 0xc4]
jne 0x4a5f34
mov eax, dword [ebx]
push eax
call fcn.004fdb8c
test eax, eax
je 0x4a5f2c
mov esi, dword [sym.imp.USER32.dll_GetParent]
test dword [eax + 0x38], 0x401
jne 0x4a5f2c
mov ecx, dword [eax + 0x1c]
push ecx
call esi
push eax
call fcn.004fdb8c
test eax, eax
jne 0x4a5f13
cmp eax, edi
jne 0x4a6513
test edi, edi
jne 0x4a5f3c
xor eax, eax
jmp 0x4a5f3f
mov eax, dword [edi + 0x1c]
push eax
call fcn.004670b0
mov esi, eax
mov eax, dword [ebp + 0x58]
add esp, 4
test eax, eax
mov dword [esp + 0x44], esi
je 0x4a5f8e
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x4a5f8e
mov edx, ecx
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4a5f8e
test esi, esi
jne 0x4a5f8e
mov eax, dword [ebp + 0x58]
mov ecx, dword [eax + 0x1c]
push esi
push esi
push 0x401
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov ecx, edi
call fcn.004fde7c
mov ebx, dword [ebp + 0x58]
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
je 0x4a5fca
mov ecx, ebx
call fcn.004218a4
cmp eax, edi
je 0x4a6094
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x60]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 4]
mov dword [ebp + 0x58], 0
mov edx, dword [ebp]
push edi
mov ecx, ebp
call dword [edx + 0x50]
mov ebx, eax
test ebx, ebx
je 0x4a6513
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x4a6202
mov ecx, dword [ebp + 0x34]
push ecx
push 0
push 0x418
push eax
call esi
mov eax, dword [ebx + 0x1c]
lea edx, [ebp + 0x3c]
push edx
push 0
push 0x41a
push eax
call esi
mov eax, dword [ebp + 0x88]
or edi, 0xffffffff
cmp eax, edi
je 0x4a6022
mov ecx, dword [ebx + 0x1c]
push 0
push eax
push 0x413
push ecx
call esi
mov eax, dword [ebp + 0x8c]
cmp eax, edi
je 0x4a603a
mov edx, dword [ebx + 0x1c]
push 0
push eax
push 0x414
push edx
call esi
mov eax, dword [ebp + 0x50]
cmp eax, edi
je 0x4a6052
mov ecx, dword [ebx + 0x1c]
movzx eax, ax
push eax
push 1
push 0x403
push ecx
call esi
mov eax, dword [ebp + 0x4c]
cmp eax, edi
je 0x4a606a
movzx edx, ax
mov eax, dword [ebx + 0x1c]
push edx
push 3
push 0x403
push eax
call esi
mov eax, dword [ebp + 0x54]
cmp eax, edi
je 0x4a6082
mov edx, dword [ebx + 0x1c]
movzx ecx, ax
push ecx
push 2
push 0x403
push edx
call esi
mov eax, dword [ebx + 0x1c]
push 0
push 0
push 0x401
push eax
call esi
mov dword [ebp + 0x58], ebx
mov eax, dword [esp + 0xc8]
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0xc4]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 0x1c]
push ecx
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
xor eax, eax
mov ecx, 0xb
lea edi, [esp + 0x48]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
jne 0x4a6104
mov eax, dword [ebp + 0x20]
test eax, eax
mov dword [esp + 0x48], 0x28
je 0x4a610c
mov dword [esp + 0x48], 0x2c
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x78], ecx
mov ecx, dword [esp + 0xcc]
mov edx, dword [ecx]
push eax
call dword [edx + 0x6c]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x1c]
xor edi, edi
cmp eax, edi
je 0x4a616b
mov ecx, dword [esp + 0x24]
cmp ecx, edi
je 0x4a616b
mov eax, dword [esp + 0x28]
cmp eax, edi
je 0x4a616b
push eax
push ecx
call fcn.0042ca45
add esp, 8
test eax, eax
jne 0x4a616b
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0042c87d
add esp, 4
mov dword [esp + 0x24], edi
test byte [ebp + 0x38], 2
jne 0x4a618b
mov edx, dword [esp + 0x6c]
push edx
call fcn.00466f80
mov eax, dword [esp + 0x74]
mov ecx, dword [eax + 4]
push ecx
call fcn.00466f80
add esp, 8
mov edx, dword [ebp + 0x68]
cmp edx, dword [esp + 0x54]
jne 0x4a621f
mov eax, dword [ebp + 0x64]
cmp eax, dword [esp + 0x50]
jne 0x4a621f
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0xb4]
mov dword [esp + 0x14], edi
mov edi, dword [sym.imp.USER32.dll_CopyRect]
push edx
call edi
lea eax, [ebp + 0x6c]
push eax
lea ecx, [esp + 0xa4]
push ecx
call edi
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x4a6227
cmp dword [esp + 0x14], 0xffffffff
je 0x4a63dc
mov ecx, dword [esp + 0xc8]
push ecx
push ebx
mov ecx, ebp
call fcn.004a5b60
jmp 0x4a63dc
mov edx, dword [ebx]
mov ecx, ebx
call dword [edx + 0x60]
mov eax, dword [ebx]
push 1
mov ecx, ebx
call dword [eax + 4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov dword [esp + 0x10], 1
mov ecx, dword [ebp + 0x5c]
cmp ecx, 0x28
lea eax, [ebp + 0x5c]
mov dword [esp + 0x18], eax
jb 0x4a624c
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x4a624c
mov edx, dword [ebx + 0x1c]
push eax
push 0
push 0x433
push edx
call esi
cmp dword [esp + 0x14], 0xffffffff
je 0x4a6389
lea eax, [esp + 0x74]
push eax
mov ecx, 0xb
lea esi, [esp + 0x4c]
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [esp + 0x7c]
mov ecx, dword [ebx + 0x1c]
push 0
push 0x432
and edx, 0x3fffffff
push ecx
mov dword [esp + 0x88], edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x28]
cmp eax, 3
je 0x4a6306
cmp dword [ebp + 0x2c], 0x50050
jae 0x4a62a2
test eax, eax
je 0x4a6306
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4a62ef
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a62ef
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4a62ef
mov edx, dword [ebp + 0x30]
push eax
push edx
push 0x421
mov ecx, ebx
call fcn.004069f0
mov edx, dword [ebx + 0x1c]
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esp + 0x74]
push ecx
push 0
push 0x439
push edx
mov dword [esp + 0xa8], eax
call esi
jmp 0x4a630c
mov eax, dword [ebx + 0x1c]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x421
push eax
call esi
jmp 0x4a630c
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x4a634d
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x4a633e
mov edx, dword [ebp + 0x24]
mov eax, dword [esp + 0x14]
push 1
add edx, eax
push edx
call fcn.00498f80
test eax, eax
je 0x4a633e
push eax
mov eax, dword [ebx + 0x1c]
push 0
push 0x2a49
push eax
jmp 0x4a634b
mov ecx, dword [ebx + 0x1c]
push 0
push 0
push 0x2a49
push ecx
call esi
test dword [esp + 0x4c], 0x40000000
jne 0x4a635f
mov eax, dword [esp + 0x44]
test eax, eax
je 0x4a639e
mov edx, dword [ebx + 0x1c]
push 0
push 1
push 0x401
push edx
call esi
mov eax, dword [ebx + 0x1c]
push 0x213
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x4a639e
mov ecx, dword [ebx + 0x1c]
push 0
push 0
push 0x401
push ecx
call esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [esp + 0xc8]
push edx
push ebx
mov ecx, ebp
call fcn.004a5b60
mov eax, dword [esp + 0x18]
cmp dword [eax], 0x28
jb 0x4a63cd
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x4a63cd
push eax
mov eax, dword [ebx + 0x1c]
push 0
push 0x433
push eax
call esi
mov edi, dword [esp + 0x18]
mov ecx, 0xb
lea esi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x6c]
cmp eax, 0xffffffff
je 0x4a63f6
mov ecx, dword [esp + 0x68]
test ecx, ecx
jne 0x4a63f6
push eax
call fcn.0042c87d
add esp, 4
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4a6407
push eax
call fcn.0042c87d
add esp, 4
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4a6513
push eax
call fcn.0042c87d
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc
mov eax, dword [esp + 0xcc]
test eax, eax
jne 0x4a6475
mov ecx, dword [ebx]
push ecx
call fcn.004fdb8c
test eax, eax
mov edi, dword [esp + 0xc4]
je 0x4a646d
mov ebx, dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ecx]
cmp eax, edi
je 0x4a6475
test dword [eax + 0x38], 0x401
jne 0x4a646d
mov edx, dword [eax + 0x1c]
push edx
call ebx
push eax
call fcn.004fdb8c
test eax, eax
jne 0x4a6450
cmp eax, edi
jne 0x4a6513
cmp esi, 0x100
jb 0x4a6485
cmp esi, 0x108
jbe 0x4a64f5
cmp esi, 0x104
jb 0x4a6495
cmp esi, 0x107
jbe 0x4a64f5
cmp esi, 0x201
je 0x4a64f5
cmp esi, 0x203
je 0x4a64f5
cmp esi, 0x204
je 0x4a64f5
cmp esi, 0x206
je 0x4a64f5
cmp esi, 0x207
je 0x4a64f5
cmp esi, 0x209
je 0x4a64f5
cmp esi, 0xa1
je 0x4a64f5
cmp esi, 0xa3
je 0x4a64f5
cmp esi, 0xa4
je 0x4a64f5
cmp esi, 0xa6
je 0x4a64f5
cmp esi, 0xa7
je 0x4a64f5
cmp esi, 0xa9
jne 0x4a6513
mov ebp, dword [ebp + 0x58]
test ebp, ebp
je 0x4a6513
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4a6513
push 0
push 0
push 0x401
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb0
ret 0xc