Function at 0x494200
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 8]
push edi
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
mov dword [0xc8b958], ecx
lea edx, [esi - 0xf0]
lea eax, [ecx - 0x140]
mov edi, edx
mov dword [esp + 8], esi
imul edi, edx
mov edx, eax
mov dword [0xc8b95c], esi
imul edx, eax
add edi, edx
test ecx, ecx
mov dword [0xc8b990], edi
jle 0x49427c
test esi, esi
jle 0x49427c
movsx eax, word [0xc8b998]
cmp eax, ecx
jl 0x49427c
movsx edx, word [0xc8b99a]
cmp edx, esi
jl 0x49427c
xor eax, eax
jmp 0x494281
mov eax, 1
push ebx
push ebp
test eax, eax
mov word [0xc8b98c], 0xffff
jne 0x4942e3
mov eax, dword [0xc8b994]
xor ebp, ebp
and eax, 0xff
lea eax, [eax + eax*4]
shl eax, 7
add eax, 0xc8b9a2
mov dl, byte [eax - 2]
test dl, dl
je 0x4942d1
movsx edi, word [eax]
cmp edi, ecx
jg 0x4942d1
movsx edx, word [eax + 2]
cmp edx, esi
jg 0x4942d1
movsx ebx, word [eax + 4]
add ebx, edi
cmp ebx, ecx
jle 0x4942d1
movsx edi, word [eax + 6]
add edi, edx
cmp edi, esi
jg 0x4942dc
inc ebp
add eax, 0xa
cmp ebp, 0x40
jl 0x4942a7
jmp 0x4942e3
mov word [0xc8b98c], bp
mov ax, word [0xc8b98a]
test ax, ax
mov word [0xc8b988], ax
je 0x4942fd
mov word [0xc8b98a], 0
mov al, byte [0xc8b996]
test al, al
jne 0x494439
mov eax, dword [esp + 0x24]
test eax, eax
je 0x494439
mov al, byte [0xc8b997]
test al, al
je 0x49440d
mov al, byte [0xc8b962]
test al, al
jne 0x494349
mov al, byte [0xc8b964]
test al, al
jne 0x494363
mov al, byte [0xc8b963]
test al, al
jne 0x494363
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
jmp 0x4943d0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
test eax, 0x8001
setne cl
mov byte [0xc8b962], cl
jmp 0x49436d
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
mov al, byte [0xc8b964]
push 2
test al, al
je 0x49438a
call esi
test eax, 0x8001
setne dl
mov byte [0xc8b964], dl
jmp 0x49438c
call esi
mov al, byte [0xc8b963]
push 4
test al, al
je 0x4943a7
call esi
test eax, 0x8001
setne byte [0xc8b963]
jmp 0x4943a9
call esi
mov al, byte [0xc8b962]
test al, al
jne 0x494452
mov al, byte [0xc8b964]
test al, al
jne 0x494452
mov al, byte [0xc8b963]
test al, al
jne 0x494452
push 1
call esi
test eax, 0x8001
setne al
test al, al
mov byte [0xc8b962], al
jne 0x494452
push 2
call esi
test eax, 0x8001
setne al
test al, al
mov byte [0xc8b964], al
jne 0x494452
push 4
call esi
test eax, 0x8001
setne al
mov byte [0xc8b963], al
jmp 0x494452
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
call esi
test eax, 0x8001
setne cl
push 2
mov byte [0xc8b962], cl
call esi
test eax, 0x8001
setne dl
mov byte [0xc8b964], dl
jmp 0x4943fa
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 1
mov byte [0xc8b996], 0
call esi
push 2
call esi
push 4
call esi
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x49447b
mov cl, byte [0xc8b964]
xor eax, eax
mov al, byte [0xc8b962]
mov byte [0xc8b962], cl
mov bl, al
mov byte [0xc8b964], bl
jmp 0x494481
mov bl, byte [0xc8b964]
mov al, byte [0xc8b962]
test al, al
je 0x4944a3
mov edx, dword [0xc931ac]
lea ecx, [edx + 1]
cmp ecx, 8
jle 0x49449f
mov esi, 8
jmp 0x4944a5
mov esi, ecx
jmp 0x4944a5
xor esi, esi
test bl, bl
mov dword [0xc931ac], esi
je 0x4944c7
mov eax, dword [0xc931b4]
lea ecx, [eax + 1]
cmp ecx, 8
jle 0x4944c3
mov edx, 8
jmp 0x4944c9
mov edx, ecx
jmp 0x4944c9
xor edx, edx
mov al, byte [0xc8b963]
mov dword [0xc931b4], edx
test al, al
je 0x4944eb
mov ecx, dword [0xc931b0]
inc ecx
cmp ecx, 8
jle 0x4944ed
mov ecx, 8
jmp 0x4944ed
xor ecx, ecx
cmp esi, 8
mov dword [0xc931b0], ecx
je 0x494504
cmp esi, 1
mov byte [0xc8b968], 0
jne 0x49450b
mov byte [0xc8b968], 1
cmp edx, 8
je 0x49451c
cmp edx, 1
mov byte [0xc8b96a], 0
jne 0x494523
mov byte [0xc8b96a], 1
cmp ecx, 8
je 0x494534
cmp ecx, 1
mov byte [0xc8b969], 0
jne 0x49453b
mov byte [0xc8b969], 1
mov esi, dword [0xc931a0]
test esi, esi
jne 0x49456b
cmp byte [0xc8b962], 1
jne 0x49456b
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
mov byte [0xc8b965], 1
mov dword [0xc8b970], edi
mov dword [0xc8b974], ebp
jmp 0x49457a
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x10]
mov byte [0xc8b965], 0
mov edx, dword [0xc931a8]
test edx, edx
jne 0x49459d
cmp bl, 1
jne 0x49459d
mov byte [0xc8b967], bl
mov dword [0xc8b980], edi
mov dword [0xc8b984], ebp
jmp 0x4945a4
mov byte [0xc8b967], 0
mov ecx, dword [0xc931a4]
test ecx, ecx
jne 0x4945c5
cmp al, 1
jne 0x4945c5
mov byte [0xc8b966], al
mov dword [0xc8b978], edi
mov dword [0xc8b97c], ebp
jmp 0x4945cc
mov byte [0xc8b966], 0
cmp esi, 1
jne 0x4945e8
mov bl, byte [0xc8b962]
mov byte [0xc8b96b], 1
test bl, bl
mov bl, byte [0xc8b964]
je 0x4945ef
mov byte [0xc8b96b], 0
or esi, 0xffffffff
cmp edx, 1
jne 0x494601
test bl, bl
mov byte [0xc8b96d], dl
je 0x494608
mov byte [0xc8b96d], 0
cmp ecx, 1
jne 0x494617
test al, al
mov byte [0xc8b96c], cl
je 0x49461e
mov byte [0xc8b96c], 0
mov cl, byte [0xc8b962]
test cl, cl
jne 0x494634
mov dword [0xc8b970], esi
mov dword [0xc8b974], esi
test bl, bl
pop ebp
pop ebx
jne 0x494646
mov dword [0xc8b980], esi
mov dword [0xc8b984], esi
test al, al
jne 0x494656
mov dword [0xc8b978], esi
mov dword [0xc8b97c], esi
xor edx, edx
pop edi
mov dl, cl
mov ecx, dword [0xc8b964]
mov dword [0xc931a0], edx
and ecx, 0xff
xor edx, edx
mov dword [0xc931a8], ecx
mov dl, al
pop esi
mov dword [0xc931a4], edx
add esp, 0xc
ret