Function at 0x4bfc10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov esi, ecx
call sub.MFC80U.DLL_Ordinal_1894
mov eax, dword [esi + 0x58]
push 0
push 0x624c18
push 0x624784
push 0
push eax
call sub.MSVCR80.dll___RTDynamicCast
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 8]
add esp, 0x14
cmp eax, 0x26
je 0x4bfc50
cmp eax, 0x28
jne 0x4bfe45
cmp eax, 0x26
mov edi, dword [esi + 0x120]
jne 0x4bfc60
sub edi, 1
jmp 0x4bfc63
add edi, 1
test edi, edi
jge 0x4bfc6b
xor edi, edi
jmp 0x4bfc78
mov eax, dword [esi + 0x110]
cmp edi, eax
jl 0x4bfc78
lea edi, [eax - 1]
push 1
push edi
mov ecx, esi
call fcn.004be0e0
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
call ebx
test ax, ax
jns 0x4bfd08
mov ecx, dword [esp + 0xc]
cmp dword [ecx + 0xc0], 0
je 0x4bfd08
mov eax, dword [esi + 0x11c]
test eax, eax
jl 0x4bfcb0
cmp eax, dword [esi + 0x110]
jl 0x4bfcb6
mov dword [esi + 0x11c], edi
mov eax, dword [esi + 0x11c]
cmp eax, edi
jle 0x4bfcc8
mov ebx, edi
mov dword [esp + 0xc], eax
jmp 0x4bfcce
mov ebx, eax
mov dword [esp + 0xc], edi
call fcn.004beb80
cmp ebx, dword [esp + 0xc]
jg 0x4bfcf2
lea esp, [esp]
push 1
push ebx
push esi
call fcn.004bea00
add ebx, 1
cmp ebx, dword [esp + 0xc]
jle 0x4bfce0
mov eax, dword [esi + 0x5c]
test eax, eax
mov ebx, dword [0x6279cc]
je 0x4bfd72
mov edx, dword [eax + 0x20]
push esi
push edi
push ebx
push edx
jmp 0x4bfd6c
push 0x11
call ebx
test ax, ax
jns 0x4bfd1e
mov eax, dword [esp + 0xc]
cmp dword [eax + 0xc0], 0
jne 0x4bfd86
cmp edi, dword [esi + 0x11c]
jne 0x4bfd44
cmp dword [esi + 0x13c], 1
jne 0x4bfd44
mov ebx, dword [0x6279cc]
push esi
call fcn.004a5110
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.004beb80
push 1
push edi
push esi
call fcn.004bea00
mov eax, dword [esi + 0x5c]
test eax, eax
mov ebx, dword [0x6279cc]
mov dword [esi + 0x11c], edi
je 0x4bfd72
mov ecx, dword [eax + 0x20]
push esi
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x94]
test eax, eax
je 0x4bfd86
push 0
push esi
push edi
push ebx
call eax
add esp, 0x10
mov edx, dword [esi + 0x108]
cmp edi, edx
jl 0x4bfddc
jne 0x4bfd9b
cmp dword [esi + 0x104], 0
jl 0x4bfddc
mov ecx, dword [esi + 0xe4]
test ecx, ecx
jne 0x4bfda9
xor eax, eax
jmp 0x4bfdb4
mov eax, dword [esi + 0xe8]
sub eax, ecx
sar eax, 2
lea edx, [edx + eax - 2]
cmp edi, edx
jl 0x4bfe11
mov eax, dword [esi + 0x144]
mov ecx, dword [eax + 0xd8]
add ecx, dword [eax + 0xb8]
mov edx, dword [eax + 0xdc]
adc edx, dword [eax + 0xbc]
jmp 0x4bfdfa
mov eax, dword [esi + 0x144]
mov ecx, dword [eax + 0xb8]
sub ecx, dword [eax + 0xd8]
mov edx, dword [eax + 0xbc]
sbb edx, dword [eax + 0xdc]
push edx
push ecx
call fcn.00486de0
mov eax, dword [esi + 0x144]
push eax
push 0
mov ecx, esi
call fcn.004bdea0
mov eax, dword [esi + 0x5c]
test eax, eax
mov edi, dword [esi + 0x11c]
mov ebx, dword [0x6279cc]
je 0x4bfe31
mov ecx, dword [eax + 0x20]
push esi
push edi
push ebx
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esi + 0x94]
test eax, eax
je 0x4bfe45
push 0
push esi
push edi
push ebx
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc