Function at 0x4b2ca0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call esi
mov ecx, 0x8000
test cx, ax
jne 0x4b31f4
push ebx
push 0x10
call esi
mov ebx, eax
push 0x11
and ebx, 0x8000
call esi
mov edx, eax
mov eax, dword [ebp + 0xc]
and edx, 0x8000
lea ecx, [eax - 0xd]
cmp ecx, 0x66
ja case.default.0x4b2cef
movzx ecx, byte [ecx + 0x4b3228]
push edi
jmp dword [ecx*4 + 0x4b31fc]
cmp eax, 0x73
je case.0x4b2cef.23
mov edi, dword [ebp + 8]
test byte [edi + 0xfe4], 4
je 0x4b2d79
cmp eax, 0x26
jne 0x4b2d79
movzx eax, word [edi + 0xfe8]
mov ecx, edi
mov esi, dword [edi + 0xffc]
and eax, 0x80
push eax
push dword [edi + 0x1000]
mov dword [ebp + 8], eax
call fcn.004b3a30
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
cwde
shr ecx, 0x10
movsx ecx, cx
sub ecx, dword [edi + 0xfdc]
push ecx
push eax
mov ecx, edi
call fcn.004b1bb0
push dword [ebp + 8]
mov ecx, dword [edi]
test ebx, ebx
push eax
cmove esi, eax
push esi
push edi
call dword [ecx + 0x190]
mov ecx, edi
call fcn.004b4460
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, edi
test edx, edx
je 0x4b2e16
mov esi, dword [edi + 0x1000]
mov eax, dword [edi + 0xffc]
push esi
mov dword [ebp - 8], eax
call fcn.004b1fc0
push esi
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.004b20d0
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp + 0xc], eax
call fcn.004b2030
mov ecx, esi
mov dword [ebp - 4], eax
sub ecx, eax
jne 0x4b2dd9
mov eax, dword [ebp + 8]
test eax, eax
je 0x4b2dec
dec eax
mov ecx, edi
push eax
call fcn.004b2030
mov esi, eax
mov ecx, edi
push esi
call fcn.004b20d0
add eax, esi
mov esi, eax
jmp 0x4b2dec
push 0
push dword [ebp + 0xc]
push ecx
push eax
mov ecx, edi
call fcn.004b19c0
mov esi, eax
add esi, dword [ebp - 4]
mov eax, dword [edi]
test ebx, ebx
push 0
push esi
cmovne esi, dword [ebp - 8]
push esi
push edi
call dword [eax + 0x190]
mov ecx, edi
call fcn.004b4460
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
call fcn.004b23a0
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
test byte [edi + 0xfe4], 4
je 0x4b2e55
cmp eax, 0x28
jne 0x4b2e55
push ebx
mov ecx, edi
call fcn.004b2410
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, edi
test edx, edx
je 0x4b2efe
mov esi, dword [edi + 0x1000]
mov eax, dword [edi + 0xffc]
push esi
mov dword [ebp - 4], eax
call fcn.004b1fc0
push esi
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.004b20d0
push dword [ebp + 8]
mov ecx, edi
mov dword [ebp + 0xc], eax
call fcn.004b2030
mov edx, dword [ebp + 0xc]
mov ecx, eax
mov eax, esi
mov dword [ebp - 8], ecx
sub eax, ecx
cmp eax, edx
jne 0x4b2ec2
test byte [edi + 0xfe4], 4
je 0x4b2ed4
mov eax, dword [edi + 0x1030]
mov ecx, dword [ebp + 8]
dec eax
cmp ecx, eax
je 0x4b2ed4
lea eax, [ecx + 1]
mov ecx, edi
push eax
call fcn.004b2030
mov esi, eax
jmp 0x4b2ed4
push 1
push edx
inc eax
push eax
push ecx
mov ecx, edi
call fcn.004b19c0
mov esi, eax
add esi, dword [ebp - 8]
mov eax, dword [edi]
test ebx, ebx
push 0
push esi
cmovne esi, dword [ebp - 4]
push esi
push edi
call dword [eax + 0x190]
mov ecx, edi
call fcn.004b4460
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
call fcn.004b2500
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
test edx, edx
je 0x4b2f41
mov eax, dword [edi]
push 0
push 0
push 0
push edi
call dword [eax + 0x190]
mov ecx, edi
call fcn.004b4460
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov ecx, edi
call fcn.004b2570
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
test edx, edx
je 0x4b2f95
mov eax, dword [edi + 0xfcc]
test eax, eax
je 0x4b2f95
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [edi]
push 0
push eax
push eax
push edi
call dword [ecx + 0x190]
mov ecx, edi
call fcn.004b4460
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
push ebx
mov ecx, edi
call fcn.004b2480
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
mov ecx, edi
movzx eax, word [edi + 0xfe8]
mov esi, dword [edi + 0xffc]
and eax, 0x80
push eax
push dword [edi + 0x1000]
mov dword [ebp + 8], eax
call fcn.004b3a30
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
cwde
shr ecx, 0x10
movsx ecx, cx
sub ecx, dword [edi + 0x101c]
add ecx, dword [edi + 0x1014]
push ecx
push eax
mov ecx, edi
call fcn.004b1bb0
push dword [ebp + 8]
mov edx, dword [edi]
test ebx, ebx
push eax
cmove esi, eax
push esi
push edi
call dword [edx + 0x190]
mov ecx, edi
call fcn.004b4460
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [ebp + 8]
mov ecx, edi
movzx eax, word [edi + 0xfe8]
mov esi, dword [edi + 0xffc]
and eax, 0x80
push eax
push dword [edi + 0x1000]
mov dword [ebp + 8], eax
call fcn.004b3a30
lea ecx, [ebp + 8]
push ecx
mov ecx, eax
cwde
shr ecx, 0x10
movsx ecx, cx
sub ecx, dword [edi + 0x1014]
add ecx, dword [edi + 0x101c]
push ecx
push eax
mov ecx, edi
call fcn.004b1bb0
push dword [ebp + 8]
mov edx, dword [edi]
test ebx, ebx
push eax
cmove esi, eax
push esi
push edi
call dword [edx + 0x190]
mov ecx, edi
call fcn.004b4460
mov ecx, edi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp + 8]
test dword [esi + 0xfe4], 0x800
jne case.0x4b2cef.23
test ebx, ebx
je 0x4b30b0
test edx, edx
jne case.0x4b2cef.23
mov eax, dword [esi + 0xffc]
cmp eax, dword [esi + 0x1000]
je 0x4b30ff
mov ecx, esi
test ebx, ebx
je 0x4b316b
call fcn.004b27f0
test dword [esi + 0xfe4], 0x800
jne 0x4b3170
push 1
push 1
push 0x544b14
push 1
mov ecx, esi
call fcn.004b3e20
mov ecx, esi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [esi]
push 0
push 0
push 0xffffffffffffffff
push esi
test ebx, ebx
je 0x4b3132
call dword [eax + 0x190]
push 1
mov ecx, esi
call fcn.004b23a0
mov ecx, esi
call fcn.004b27d0
mov ecx, esi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [eax + 0x190]
test edx, edx
je 0x4b315e
call eax
push 1
mov ecx, esi
call fcn.004b2480
mov ecx, esi
call fcn.004b27d0
mov ecx, esi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
call eax
push 1
mov ecx, esi
call fcn.004b2500
mov ecx, esi
call fcn.004b27d0
mov ecx, esi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
test ebx, ebx
je 0x4b31aa
mov esi, dword [ebp + 8]
test dword [esi + 0xfe4], 0x800
jne case.0x4b2cef.23
mov ecx, esi
call fcn.004b3560
mov ecx, esi
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
test edx, edx
je case.0x4b2cef.23
mov ecx, dword [ebp + 8]
call fcn.004b27f0
mov ecx, dword [ebp + 8]
call fcn.004b4e90
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
test dword [eax + 0xfe4], 0x1000
jne case.0x4b2cef.23
push dword [eax + 0xc38]
call dword [sym.imp.USER32.dll_GetParent]
push 0
push 0
push 0x400
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10