Function at 0x4bcc50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x60]
cmp edi, 0x10
mov dword [ebp - 4], eax
je 0x4bd3e6
cmp edi, 0x11
je 0x4bd3e6
push esi
lea ecx, [ebp - 0x18]
call fcn.004b7302
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
cmp edi, 9
je 0x4bcca2
cmp edi, 0x2d
je 0x4bcca2
push 0x11
call ebx
test ax, ax
jl 0x4bcca2
push dword [esi + 0x60]
mov ecx, esi
call fcn.004bb391
mov ecx, esi
call fcn.004b675b
mov ecx, esi
mov dword [0x58cce4], eax
call fcn.004b676f
push 0x2e
mov dword [0x58cce0], eax
call ebx
test ax, ax
jl 0x4bcd14
push 9
call ebx
test ax, ax
jl 0x4bcd14
push 0x2d
call ebx
test ax, ax
jl 0x4bcd14
push 8
call ebx
test ax, ax
jl 0x4bcd14
push 0x10
call ebx
test ax, ax
jl 0x4bcd14
push dword [esi + 0x68]
mov ecx, esi
push dword [esi + 0x64]
push dword [esi]
call fcn.004ba1ed
mov eax, dword [esi + 0x60]
mov ecx, esi
mov dword [esi + 0x68], eax
mov dword [esi + 0x64], eax
call fcn.004ba0bd
push 0xfffffbff
push dword [esi]
call fcn.004bbaa0
jmp 0x4bcd25
mov eax, dword [esi + 0x68]
cmp eax, dword [esi + 0x64]
jne 0x4bcd25
mov eax, dword [esi + 0x60]
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
push dword [esi]
mov dword [ebp - 8], 1
call dword [sym.imp.USER32.dll_GetParent]
mov eax, dword [esi + 0x68]
cmp eax, dword [esi + 0x64]
je 0x4bcd47
cmp edi, 8
jne 0x4bcd47
push 0x2e
pop edi
mov dword [ebp + 8], edi
cmp edi, 0x24
ja 0x4bd145
je 0x4bd0dd
mov eax, edi
sub eax, 8
je 0x4bcfb8
dec eax
je 0x4bcfa8
sub eax, 4
je 0x4bcf98
sub eax, 0x14
je 0x4bcf01
dec eax
je 0x4bce45
dec eax
jne 0x4bd3de
push 0x11
call ebx
test ax, ax
jge 0x4bce23
mov ecx, dword [esi + 0x90]
mov edi, dword [esi + 0xd0]
mov eax, ecx
xor edx, edx
div edi
mov dword [esi + 0x60], ecx
test edx, edx
jne 0x4bcdbb
mov eax, ecx
mov dword [esi + 0x6c], edi
div edi
sub eax, dword [esi + 0x74]
dec eax
jmp 0x4bcdc7
mov dword [esi + 0x6c], edx
mov eax, ecx
xor edx, edx
div edi
sub eax, dword [esi + 0x74]
push 0x10
mov dword [esi + 0x70], eax
call ebx
test ax, ax
jge 0x4bcde7
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bcde1
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
xor edi, edi
push edi
push 7
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 4]
cmp dword [esi + 0x60], eax
je 0x4bce12
push edi
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.004ba0bd
push 0xfffffc00
push dword [esi]
call fcn.004bbaa0
jmp 0x4bd3de
mov ecx, dword [esi + 0xd0]
cmp dword [esi + 0x6c], ecx
jne 0x4bce31
dec dword [esi + 0x60]
mov edi, dword [esi + 0x60]
xor edx, edx
mov eax, edi
div ecx
sub ecx, edx
lea eax, [ecx + edi - 1]
jmp 0x4bd2c5
push 0x11
call ebx
test ax, ax
jl 0x4bd3de
mov edi, dword [esi + 0xd0]
mov ecx, dword [esi + 0x90]
mov eax, edi
imul eax, dword [esi + 0x84]
add dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
cmp eax, ecx
ja 0x4bce76
cmp eax, dword [ebp - 4]
jae 0x4bce9b
mov eax, ecx
xor edx, edx
div edi
mov eax, ecx
mov dword [esi + 0x60], ecx
mov ebx, edx
xor edx, edx
div edi
mov dword [esi + 0x6c], ebx
sub eax, dword [esi + 0x74]
test ebx, ebx
mov dword [esi + 0x70], eax
jne 0x4bce9b
dec eax
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4bcebc
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bceb6
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
xor edi, edi
push edi
push 3
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x84]
push 1
pop ecx
cmp eax, ecx
jb 0x4bcedd
mov ecx, eax
mov edx, dword [esi + 0x7c]
sub edx, eax
mov eax, dword [esi + 0x74]
inc edx
add eax, ecx
cmp eax, edx
jbe 0x4bce0b
mov eax, dword [ebp - 4]
cmp dword [esi + 0x60], eax
je 0x4bce0b
jmp 0x4bce01
push 0x11
call ebx
test ax, ax
jl 0x4bd3de
mov eax, dword [esi + 0xd0]
xor edi, edi
imul eax, dword [esi + 0x84]
sub dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
cmp eax, dword [ebp - 4]
jae 0x4bcf2c
cmp eax, edi
jne 0x4bcf35
mov dword [esi + 0x60], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
push 0x10
call ebx
test ax, ax
jge 0x4bcf52
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bcf4c
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
push edi
push 2
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x84]
cmp eax, 1
jae 0x4bcf70
push 1
pop eax
cmp dword [esi + 0x74], eax
jae 0x4bcf87
mov eax, dword [ebp - 4]
cmp dword [esi + 0x60], eax
je 0x4bcf87
push edi
push edi
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.004ba0bd
push 0xfffffbfb
jmp 0x4bce17
lea ecx, [esi + 0xf8]
call fcn.004b9137
jmp 0x4bd3de
and dword [esi + 0x48], 0
mov ecx, esi
call fcn.004b668a
jmp 0x4bd3d7
mov eax, dword [esi + 0x60]
test eax, eax
jbe 0x4bcfc3
dec eax
mov dword [esi + 0x60], eax
mov ecx, dword [esi + 0x60]
mov edi, dword [esi + 0xd0]
mov eax, ecx
xor edx, edx
div edi
mov eax, ecx
mov dword [esi + 0x6c], edx
xor edx, edx
div edi
sub eax, dword [esi + 0x74]
mov dword [esi + 0x70], eax
jns 0x4bcff4
push 0
push 0
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
cmp dword [esi + 0x30], 0
jne 0x4bd2c8
cmp dword [esi + 0x34], 0
jne 0x4bd2c8
cmp dword [esi + 0x40], 1
jne 0x4bd2c8
mov ecx, dword [esi + 0x60]
cmp ecx, dword [ebp - 4]
je 0x4bd2c8
mov eax, dword [esi + 0x74]
push 1
mov dword [ebp - 0xc], eax
pop eax
lea edi, [esi + 0xf8]
push eax
push ecx
mov ecx, edi
mov dword [esi + 0x38], eax
call fcn.004b7b83
mov eax, dword [esi + 0x5c]
push dword [esi + 0x54]
imul eax, dword [esi + 0x70]
push dword [esi + 0x50]
push eax
mov eax, dword [esi + 0xe0]
imul eax, dword [esi + 0x58]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov ecx, edi
call fcn.004b8fcd
push eax
mov ecx, esi
mov dword [esi + 0x90], eax
call fcn.004b69cd
mov ecx, esi
mov dword [esi + 0x8c], eax
call fcn.004bad83
mov edi, dword [esi + 0x60]
mov ebx, dword [esi + 0xd0]
mov eax, edi
xor edx, edx
div ebx
mov eax, edi
mov ecx, dword [esi + 0x74]
mov dword [esi + 0x6c], edx
xor edx, edx
div ebx
sub eax, ecx
cmp ecx, dword [ebp - 0xc]
mov dword [esi + 0x70], eax
je 0x4bd0b7
mov eax, dword [esi + 0x7c]
sub eax, dword [esi + 0x84]
inc eax
cmp ecx, eax
jne 0x4bd0b7
push 0
push 0
jmp 0x4bd0bd
lea eax, [ebp - 0x28]
push 1
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, esi
call fcn.004ba0bd
push 0xfffffbfb
push dword [esi]
call fcn.004bbaa0
jmp 0x4bd2c8
push 0x11
call ebx
test ax, ax
jge 0x4bd116
xor edi, edi
push 0x10
mov dword [esi + 0x60], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
call ebx
test ax, ax
jge 0x4bd10e
mov eax, dword [esi + 0x64]
cmp eax, dword [esi + 0x68]
jne 0x4bd108
mov eax, dword [ebp - 4]
mov dword [esi + 0x64], eax
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
push edi
push 6
jmp 0x4bcdec
mov edi, dword [esi + 0xd0]
cmp dword [esi + 0x6c], edi
jne 0x4bd12c
mov eax, dword [esi + 0x60]
test eax, eax
jbe 0x4bd12c
dec eax
mov dword [esi + 0x60], eax
mov ecx, dword [esi + 0x60]
xor edx, edx
mov eax, ecx
div edi
cmp ecx, edx
jae 0x4bd13b
mov edx, ecx
sub ecx, edx
mov dword [esi + 0x60], ecx
jmp 0x4bd2c8
mov eax, edi
sub eax, 0x25
je 0x4bd29e
dec eax
je 0x4bd274
dec eax
je 0x4bd25a
dec eax
je 0x4bd1d3
sub eax, 5
je 0x4bd1af
dec eax
jne 0x4bd3de
cmp dword [esi + 0x30], 0
jne 0x4bd3de
mov ecx, esi
call fcn.004b70b8
test eax, eax
jne 0x4bd3de
mov ecx, esi
call fcn.004b6b5d
cmp eax, 1
jne 0x4bd3de
push 0x30
push str.HexView32
push str.Not_enough_memory_to_complete_this_operation
push dword [esi]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4bd3de
cmp dword [esi + 0x30], 0
jne 0x4bd3de
xor eax, eax
mov ecx, esi
cmp dword [esi + 0x40], eax
sete al
push eax
call fcn.004b6693
push 0xfffffbfa
jmp 0x4bce17
push 0x11
call ebx
test ax, ax
jge 0x4bd1ea
push 0
push 1
push 0x115
jmp 0x4bd2b0
mov ecx, dword [esi + 0xd0]
mov eax, dword [ebp - 4]
add dword [esi + 0x60], ecx
cmp dword [esi + 0x60], eax
jae 0x4bd1fe
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x60]
mov edi, dword [esi + 0x90]
cmp eax, edi
jb 0x4bd21c
mov ebx, dword [esi + 0x6c]
cmp ebx, ecx
je 0x4bd21c
mov eax, edi
xor edx, edx
div ecx
cmp ebx, edx
jl 0x4bd255
mov ebx, dword [esi + 0x60]
cmp ebx, edi
jb 0x4bd2c8
mov eax, edi
xor edx, edx
div ecx
mov eax, dword [esi + 0x6c]
cmp eax, edx
jl 0x4bd24c
test eax, eax
je 0x4bd24c
test edx, edx
je 0x4bd24c
cmp eax, ecx
mov dword [esi + 0x60], edi
jne 0x4bd2c8
mov dword [esi + 0x6c], edx
jmp 0x4bd2c8
cmp ebx, edi
jb 0x4bd2c8
cmp dword [esi + 0x6c], ecx
je 0x4bd2c8
mov eax, dword [ebp - 4]
jmp 0x4bd2c5
push 0x11
call ebx
test ax, ax
jge 0x4bd269
push 0
push 1
jmp 0x4bd2ab
inc dword [esi + 0x60]
jne 0x4bd2c8
or dword [esi + 0x60], 0xffffffff
jmp 0x4bd2c8
push 0x11
call ebx
test ax, ax
jge 0x4bd286
push 0
push 0
jmp 0x4bd1e0
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0xd0]
cmp eax, ecx
ja 0x4bd29a
jne 0x4bd2c8
cmp dword [esi + 0x6c], ecx
je 0x4bd2c8
sub eax, ecx
jmp 0x4bd2c5
push 0x11
call ebx
test ax, ax
jge 0x4bd2bd
push 0
push 0
push 0x114
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x4bd3de
mov eax, dword [esi + 0x60]
test eax, eax
jbe 0x4bd2c8
dec eax
mov dword [esi + 0x60], eax
mov eax, dword [esi + 0x90]
cmp dword [esi + 0x60], eax
jbe 0x4bd2d6
mov dword [esi + 0x60], eax
mov ebx, dword [ebp + 8]
cmp ebx, 0x26
jne 0x4bd2ee
mov eax, dword [esi + 0x6c]
cmp eax, dword [esi + 0xd0]
jne 0x4bd303
dec dword [esi + 0x70]
jmp 0x4bd32b
cmp ebx, 0x28
jne 0x4bd303
mov eax, dword [esi + 0x6c]
cmp eax, dword [esi + 0xd0]
jne 0x4bd303
inc dword [esi + 0x70]
jmp 0x4bd32b
mov ecx, dword [esi + 0x60]
mov edi, dword [esi + 0xd0]
mov eax, ecx
xor edx, edx
div edi
mov eax, ecx
mov dword [esi + 0x6c], edx
xor edx, edx
div edi
sub eax, dword [esi + 0x74]
cmp ebx, 0x26
mov dword [esi + 0x70], eax
je 0x4bd32b
cmp ebx, 0x28
jne 0x4bd36b
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x4bd36b
mov eax, dword [esi + 0x70]
xor ebx, ebx
cmp eax, ebx
jge 0x4bd34d
mov ecx, esi
call fcn.004bb117
mov dword [esi + 0x70], ebx
jmp 0x4bd368
cmp eax, dword [esi + 0x84]
lea edi, [esi + 0x84]
jl 0x4bd36b
mov ecx, esi
call fcn.004bb1b2
mov eax, dword [edi]
dec eax
mov dword [esi + 0x70], eax
mov dword [ebp - 8], ebx
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4bd39f
mov eax, dword [esi + 0x68]
cmp dword [esi + 0x64], eax
jne 0x4bd386
mov ecx, dword [ebp - 4]
mov dword [esi + 0x64], ecx
cmp dword [ebp - 8], 0
je 0x4bd399
push dword [esi + 0x60]
mov ecx, esi
push eax
push dword [esi]
call fcn.004ba1ed
mov eax, dword [esi + 0x60]
mov dword [esi + 0x68], eax
mov eax, dword [esi + 0x70]
cmp eax, dword [esi + 0x84]
jl 0x4bd3bb
push 0
push 1
push 0x115
push dword [esi]
call dword [sym.imp.USER32.dll_PostMessageW]
push 0xfffffc00
push dword [esi]
call fcn.004bbaa0
push 0xfffffbff
push dword [esi]
call fcn.004bbaa0
and dword [esi + 0x48], 0
mov ecx, esi
call fcn.004ba0bd
lea ecx, [ebp - 0x18]
call fcn.004b732e
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8