Function at 0x4ecdd0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x24
push ebx
push esi
mov eax, dword [ecx + 0xf4]
push edi
push ebp
mov esi, ecx
test eax, eax
je 0x4ed07c
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x4ed082
mov eax, dword [esi + 0x70]
test eax, eax
je 0x4ed088
mov eax, dword [esi + 0x104]
mov ebx, dword [esp + 0x3c]
test eax, eax
jne case.0x4ece41.259
cmp ebx, 0x14
mov eax, ebx
ja 0x4ece22
je 0x4ece5c
cmp eax, 0xf
je 0x4ece48
jmp case.0x4ece41.259
cmp eax, 0x200
ja case.0x4ece41.259
je 0x4ed05a
sub eax, 0x100
cmp eax, 4
ja case.0x4ece41.259
jmp dword [eax*4 + 0x4ed1e0]
mov eax, dword [esp + 0x38]
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp case.0x4ece41.259
mov eax, dword [esi + 0x108]
mov edi, dword [esp + 0x40]
test eax, eax
je 0x4ed090
push eax
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x24]
mov ecx, dword [esp + 0x38]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [esi + 0x108]
lea eax, [esp + 0x24]
push ecx
push eax
push edi
call dword [sym.imp.USER32.dll_FillRect]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x4ecfab
mov eax, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
push eax
push edi
mov eax, dword [ecx]
push ebx
push edx
call dword [eax + 0x48]
test eax, eax
je 0x4eced8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
cmp edi, 9
jne 0x4ecf47
push 0x12
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
call ebp
test ax, ax
push 0x11
setl bl
call ebp
mov ecx, dword [esp + 0x10]
push 0x10
mov edx, ecx
xor edx, ecx
test ax, ax
mov dword [esp + 0x14], edx
setl byte [esp + 0x14]
call ebp
mov dword [0x56862c], 1
xor ecx, ecx
mov edx, dword [esp + 0x44]
test ax, ax
mov eax, dword [esp + 0x10]
setl cl
push ecx
push eax
push ebx
mov ecx, esi
push edx
mov ebx, dword [esi]
push edi
call dword [ebx + 0x58]
xor eax, eax
pop ebp
mov dword [0x56862c], 0
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
cmp edi, 0xd
jne 0x4ecf6a
mov ecx, dword [esi + 0x40]
push 0
push 0
push 0
push esi
mov eax, dword [ecx]
call dword [eax + 0xb4]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
cmp edi, 0x1b
jne 0x4ed090
mov ecx, dword [esi + 0x40]
push 0
push 0
push 1
push esi
mov eax, dword [ecx]
call dword [eax + 0xb4]
test eax, eax
jne 0x4ecf9f
push 0
mov eax, dword [esi + 0xf4]
push 0
push 0xc7
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
mov edi, dword [esp + 0x40]
cmp edi, 0x1b
jne 0x4ed090
push 0
mov eax, dword [esi + 0xf4]
push 0
push 0xc7
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
mov edi, dword [esp + 0x40]
cmp edi, 9
jne 0x4ed090
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
mov edi, dword [esp + 0x40]
mov ecx, esi
push edi
call fcn.004ed200
test eax, eax
jne 0x4ed090
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
mov eax, dword [esi + 0x160]
test eax, eax
je 0x4ed027
mov eax, dword [esi + 0x164]
test eax, eax
jne 0x4ed04e
mov eax, dword [esi + 0x20]
mov ebp, dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [eax + 4]
push ecx
call ebp
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x40]
push ecx
mov eax, dword [esi + 0x20]
push edi
push ebx
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10
mov eax, dword [0x5681d8]
mov ecx, dword [eax + 0x1d0]
test ecx, ecx
jne case.0x4ece41.259
mov dword [0x7ddfa8], 1
mov ecx, eax
call fcn.004e96f0
jmp case.0x4ece41.259
mov ebx, dword [esp + 0x3c]
jmp case.0x4ece41.259
mov ebx, dword [esp + 0x3c]
jmp case.0x4ece41.259
mov ebx, dword [esp + 0x3c]
mov edi, dword [esp + 0x40]
xor eax, eax
mov ecx, dword [esi + 0xf4]
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
test ecx, ecx
je 0x4ed0b9
mov ebp, 1
cmp ebx, 0xb0
jne 0x4ed0bb
xor ebp, ebp
test ebp, ebp
je 0x4ed0d5
lea eax, [esp + 0x1c]
lea edx, [esp + 0x14]
push eax
push edx
push 0xb0
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x38]
push eax
mov edx, dword [esi + 0x110]
push edi
push ebx
push ecx
push edx
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x4ed14a
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
mov edx, dword [esi + 0xf4]
push ecx
push 0xb0
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, ecx
jne 0x4ed12a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
cmp ecx, eax
je 0x4ed14a
push 1
mov eax, dword [esi + 0xf4]
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0xf4]
mov ebp, dword [sym.imp.USER32.dll_UpdateWindow]
push eax
call ebp
cmp ebx, 0x302
jne 0x4ed159
mov ecx, esi
call fcn.004ec770
cmp ebx, 0x201
je 0x4ed179
cmp ebx, 0x202
je 0x4ed179
cmp ebx, 0x204
je 0x4ed179
cmp ebx, 0x205
jne 0x4ed1d1
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x44]
and ecx, 0xffff
mov ebp, dword [esp + 0x44]
shr ebp, 0x10
add eax, ecx
and ebp, 0xffff
mov edx, dword [esi + 0x10]
add ebp, edx
mov ecx, 0x56d5f8
and ebp, 0xffff
mov dword [esp + 0x10], eax
shl ebp, 0x10
call fcn.00421410
mov ecx, eax
mov eax, dword [esp + 0x10]
and eax, 0xffff
mov edx, dword [esi + 0x20]
or ebp, eax
push ebp
mov eax, dword [edx + 4]
push edi
push ebx
push eax
mov ebx, dword [ecx]
call dword [ebx + 0x48]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x10