Function at 0x4b2b30
Capabilities:
Inspect section memory permissions
Log keystrokes via polling

Disassembly:
sub esp, 8
xor eax, eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ebx, 0x20000000
mov dword [esi + 0x210], eax
mov dword [esi + 0x214], eax
test byte [esi + 0x1cc], 1
je 0x4b2cde
mov eax, dword [esi + 0x1dc]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4b2b7c
or dword [esi + 0x210], 0x10000000
mov edx, dword [esi + 0x1e0]
push edx
call edi
movsx eax, ax
test eax, 0x80000000
je 0x4b2b95
or dword [esi + 0x210], ebx
mov ecx, dword [esi + 0x1e4]
push ecx
call edi
movsx edx, ax
test edx, 0x80000000
je 0x4b2bb3
or dword [esi + 0x210], 0x40000000
mov eax, dword [esi + 0x1e8]
push eax
call edi
movsx ecx, ax
test ecx, 0x80000000
je 0x4b2bd1
or dword [esi + 0x210], 0x80000000
mov edx, dword [esi + 0x1ec]
push edx
call edi
movsx eax, ax
test eax, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2bf2
mov eax, dword [esi + 0x210]
or al, 1
mov dword [esi + 0x210], eax
mov ecx, dword [esi + 0x1f0]
push ecx
call edi
movsx edx, ax
test edx, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2c14
mov eax, dword [esi + 0x210]
or al, 2
mov dword [esi + 0x210], eax
mov eax, dword [esi + 0x1f4]
push eax
call edi
movsx ecx, ax
test ecx, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2c36
mov eax, dword [esi + 0x210]
or al, 4
mov dword [esi + 0x210], eax
mov edx, dword [esi + 0x1f8]
push edx
call edi
movsx eax, ax
test eax, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2c57
mov eax, dword [esi + 0x210]
or al, 8
mov dword [esi + 0x210], eax
mov ecx, dword [esi + 0x1fc]
push ecx
call edi
movsx edx, ax
test edx, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2c79
mov eax, dword [esi + 0x210]
or al, 0x10
mov dword [esi + 0x210], eax
mov eax, dword [esi + 0x200]
push eax
call edi
movsx ecx, ax
test ecx, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2c9b
mov eax, dword [esi + 0x210]
or al, 0x20
mov dword [esi + 0x210], eax
mov edx, dword [esi + 0x204]
push edx
call edi
movsx eax, ax
test eax, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2cbc
mov eax, dword [esi + 0x210]
or al, 0x40
mov dword [esi + 0x210], eax
mov ecx, dword [esi + 0x208]
push ecx
call edi
movsx edx, ax
test edx, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2cde
mov eax, dword [esi + 0x210]
or al, 0x80
mov dword [esi + 0x210], eax
test byte [esi + 0x1cc], 4
je 0x4b2d97
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 0x238]
mov ecx, dword [esi + 0x230]
mov edx, eax
neg edx
cmp ecx, edx
jge 0x4b2d14
or dword [esi + 0x210], 0x10000000
cmp ecx, eax
jle 0x4b2d1e
or dword [esi + 0x210], ebx
mov eax, dword [esi + 0x23c]
mov ecx, dword [esi + 0x234]
mov edx, eax
neg edx
cmp ecx, edx
jge 0x4b2d3c
or dword [esi + 0x210], 0x40000000
cmp ecx, eax
jle 0x4b2d4a
or dword [esi + 0x210], 0x80000000
push 1
call edi
movsx eax, ax
test eax, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2d66
mov eax, dword [esi + 0x210]
or al, 1
mov dword [esi + 0x210], eax
push 2
call edi
movsx ecx, ax
test ecx, reloc.DPLAYX.dll_Ordinal_1
je 0x4b2d83
mov eax, dword [esi + 0x210]
or al, 2
mov dword [esi + 0x210], eax
mov edx, dword [esi + 0x244]
mov eax, dword [esi + 0x240]
push edx
push eax
call dword [sym.imp.USER32.dll_SetCursorPos]
mov al, byte [esi + 0x1cc]
mov edi, 0x100
test al, 2
je 0x4b2ea2
mov edx, dword [esi]
lea ecx, [esi + 0x198]
push ecx
push edx
mov dword [esi + 0x19c], 0x83
call dword [sym.imp.WINMM.dll_joyGetPosEx]
mov eax, dword [esi + 0x1a0]
mov ecx, dword [esi + 0x220]
cmp eax, ecx
jae 0x4b2dde
or dword [esi + 0x210], 0x10000000
cmp eax, dword [esi + 0x224]
jbe 0x4b2dec
or dword [esi + 0x210], ebx
mov eax, dword [esi + 0x1a4]
mov ecx, dword [esi + 0x228]
cmp eax, ecx
jae 0x4b2e06
or dword [esi + 0x210], 0x40000000
cmp eax, dword [esi + 0x22c]
jbe 0x4b2e18
or dword [esi + 0x210], 0x80000000
mov eax, dword [esi + 0x1b8]
test al, 1
je 0x4b2e29
or dword [esi + 0x210], 1
test al, 2
je 0x4b2e34
or dword [esi + 0x210], 2
test al, 4
je 0x4b2e3f
or dword [esi + 0x210], 4
test al, 8
je 0x4b2e4a
or dword [esi + 0x210], 8
mov ecx, dword [esi + 0x1d4]
test ecx, ecx
je 0x4b2ea2
test al, 0x10
je 0x4b2e5f
or dword [esi + 0x210], 0x10
test al, 0x20
je 0x4b2e6a
or dword [esi + 0x210], 0x20
test al, 0x40
je 0x4b2e75
or dword [esi + 0x210], 0x40
test al, 0x80
je 0x4b2e88
mov ecx, dword [esi + 0x210]
or cl, 0x80
mov dword [esi + 0x210], ecx
cmp dword [esi + 0x40], 9
jb 0x4b2ea2
mov ecx, dword [esi + 0x1d8]
test ecx, ecx
jne 0x4b2ea2
test edi, eax
je 0x4b2ea2
or dword [esi + 0x210], edi
mov eax, dword [esi + 0x210]
mov dword [esi + 0x214], eax
test eax, 0x10000000
mov eax, dword [esi + 0x20c]
je 0x4b2ed5
test eax, 0x10000000
je 0x4b2ece
and dword [esi + 0x210], 0xefffffff
jmp 0x4b2ee0
or eax, 0x10000000
jmp 0x4b2eda
and eax, 0xefffffff
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], ebx
mov eax, dword [esi + 0x20c]
je 0x4b2f02
test ebx, eax
je 0x4b2efe
and dword [esi + 0x210], 0xdfffffff
jmp 0x4b2f0d
or eax, ebx
jmp 0x4b2f07
and eax, 0xdfffffff
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], 0x40000000
mov eax, dword [esi + 0x20c]
je 0x4b2f39
test eax, 0x40000000
je 0x4b2f32
and dword [esi + 0x210], 0xbfffffff
jmp 0x4b2f44
or eax, 0x40000000
jmp 0x4b2f3e
and eax, 0xbfffffff
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], 0x80000000
mov eax, dword [esi + 0x20c]
je 0x4b2f70
test eax, 0x80000000
je 0x4b2f69
and dword [esi + 0x210], 0x7fffffff
jmp 0x4b2f7b
or eax, 0x80000000
jmp 0x4b2f75
and eax, 0x7fffffff
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 1
mov eax, dword [esi + 0x20c]
je 0x4b2fa2
test al, 1
je 0x4b2f9e
mov eax, dword [esi + 0x210]
and al, 0xfe
mov dword [esi + 0x210], eax
jmp 0x4b2faa
or al, 1
jmp 0x4b2fa4
and al, 0xfe
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 2
mov eax, dword [esi + 0x20c]
je 0x4b2fd1
test al, 2
je 0x4b2fcd
mov eax, dword [esi + 0x210]
and al, 0xfd
mov dword [esi + 0x210], eax
jmp 0x4b2fd9
or al, 2
jmp 0x4b2fd3
and al, 0xfd
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 4
mov eax, dword [esi + 0x20c]
je 0x4b3000
test al, 4
je 0x4b2ffc
mov eax, dword [esi + 0x210]
and al, 0xfb
mov dword [esi + 0x210], eax
jmp 0x4b3008
or al, 4
jmp 0x4b3002
and al, 0xfb
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 8
mov eax, dword [esi + 0x20c]
je 0x4b302f
test al, 8
je 0x4b302b
mov eax, dword [esi + 0x210]
and al, 0xf7
mov dword [esi + 0x210], eax
jmp 0x4b3037
or al, 8
jmp 0x4b3031
and al, 0xf7
mov dword [esi + 0x20c], eax
mov eax, dword [esi + 0x1d4]
test eax, eax
je 0x4b3141
test byte [esi + 0x214], 0x10
mov eax, dword [esi + 0x20c]
je 0x4b306c
test al, 0x10
je 0x4b3068
mov eax, dword [esi + 0x210]
and al, 0xef
mov dword [esi + 0x210], eax
jmp 0x4b3074
or al, 0x10
jmp 0x4b306e
and al, 0xef
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 0x20
mov eax, dword [esi + 0x20c]
je 0x4b309b
test al, 0x20
je 0x4b3097
mov eax, dword [esi + 0x210]
and al, 0xdf
mov dword [esi + 0x210], eax
jmp 0x4b30a3
or al, 0x20
jmp 0x4b309d
and al, 0xdf
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 0x40
mov eax, dword [esi + 0x20c]
je 0x4b30ca
test al, 0x40
je 0x4b30c6
mov eax, dword [esi + 0x210]
and al, 0xbf
mov dword [esi + 0x210], eax
jmp 0x4b30d2
or al, 0x40
jmp 0x4b30cc
and al, 0xbf
mov dword [esi + 0x20c], eax
test byte [esi + 0x214], 0x80
mov eax, dword [esi + 0x20c]
je 0x4b30f9
test al, 0x80
je 0x4b30f5
mov eax, dword [esi + 0x210]
and al, 0x7f
mov dword [esi + 0x210], eax
jmp 0x4b3101
or al, 0x80
jmp 0x4b30fb
and al, 0x7f
mov dword [esi + 0x20c], eax
test dword [esi + 0x214], edi
mov eax, dword [esi + 0x20c]
je 0x4b3138
test edi, eax
je 0x4b3129
mov eax, dword [esi + 0x210]
pop edi
and ah, 0xfe
mov dword [esi + 0x210], eax
pop esi
pop ebx
add esp, 8
ret
or eax, edi
pop edi
mov dword [esi + 0x20c], eax
pop esi
pop ebx
add esp, 8
ret
and ah, 0xfe
mov dword [esi + 0x20c], eax
pop edi
pop esi
pop ebx
add esp, 8
ret