Function at 0x4f296c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
push 0
mov eax, dword [ebp - 8]
test eax, eax
jns 0x4f298f
call fcn.00403be4
push eax
call sub.user32.dll_MapVirtualKeyA
test eax, eax
jns 0x4f299e
call fcn.00403be4
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 8], 0xa1
je 0x4f29ca
cmp dword [ebp - 8], 0xa3
je 0x4f29ca
cmp dword [ebp - 8], 0xa5
je 0x4f29ca
cmp dword [ebp - 8], 0x385
jne 0x4f2a13
cmp dword [ebp - 8], 0xa1
jne 0x4f29da
mov dword [ebp - 8], 0x10
cmp dword [ebp - 8], 0xa3
jne 0x4f29ea
mov dword [ebp - 8], 0x11
cmp dword [ebp - 8], 0xa5
jne 0x4f29fa
mov dword [ebp - 8], 0x12
cmp dword [ebp - 8], 0x385
jne 0x4f2a0a
mov dword [ebp - 8], 0xd
mov dword [ebp - 0x18], 1
jmp 0x4f2a65
cmp dword [ebp - 8], 0x26
je 0x4f2a2b
cmp dword [ebp - 8], 0x28
je 0x4f2a2b
cmp dword [ebp - 8], 0x25
je 0x4f2a2b
cmp dword [ebp - 8], 0x27
jne 0x4f2a34
mov dword [ebp - 0x18], 1
jmp 0x4f2a65
cmp dword [ebp - 8], 0x2d
je 0x4f2a5e
cmp dword [ebp - 8], 0x2e
je 0x4f2a5e
cmp dword [ebp - 8], 0x24
je 0x4f2a5e
cmp dword [ebp - 8], 0x23
je 0x4f2a5e
cmp dword [ebp - 8], 0x21
je 0x4f2a5e
cmp dword [ebp - 8], 0x22
je 0x4f2a5e
cmp dword [ebp - 8], 0x6f
jne 0x4f2a65
mov dword [ebp - 0x18], 1
cmp byte [ebp + 8], 0
je 0x4f2e74
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b4]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4f2fea
cmp dword [ebp - 8], 0x10
jne 0x4f2a98
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x7e4], eax
cmp dword [ebp - 8], 0x11
jne 0x4f2aaa
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x7e8], eax
cmp dword [ebp - 8], 0x12
jne 0x4f2abc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
mov dword [edx + 0x7ec], eax
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x14]
and eax, 0xff
shl eax, 0x10
add dword [ebp - 0x2c], eax
jae 0x4f2ad8
call fcn.00403bec
cmp dword [ebp - 0x18], 0
je 0x4f2aec
add dword [ebp - 0x2c], 0x1000000
jae 0x4f2aec
call fcn.00403bec
cmp dword [ebp - 0xc], 0
je 0x4f2afc
cmp dword [ebp - 0xc], 1
jne 0x4f2df8
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x7e4], 0
je 0x4f2b4d
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7e4]
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
jne 0x4f2ba5
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7e4]
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x20], 1
jmp 0x4f2ba5
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
je 0x4f2b79
push 0
mov ecx, 2
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x20], 0xffffffff
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
je 0x4f2ba5
push 0
mov ecx, 2
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x20], 0xfffffffe
mov eax, dword [ebp - 4]
cmp dword [eax + 0x7e8], 0
je 0x4f2be7
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7e8]
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
jne 0x4f2c3f
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7e8]
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x24], 1
jmp 0x4f2c3f
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
je 0x4f2c13
push 0
mov ecx, 2
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x24], 0xffffffff
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
je 0x4f2c3f
push 0
mov ecx, 2
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x24], 0xfffffffe
mov eax, dword [ebp - 4]
cmp dword [eax + 0x7ec], 0
je 0x4f2c81
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7ec]
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
jne 0x4f2cd9
push 0
mov ecx, 1
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7ec]
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x28], 1
jmp 0x4f2cd9
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
je 0x4f2cad
push 0
mov ecx, 2
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x28], 0xffffffff
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.004fa2a8
test al, al
je 0x4f2cd9
push 0
mov ecx, 2
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.004f296c
mov dword [ebp - 0x28], 0xfffffffe
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 8]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b4]
push eax
call sub.user32.dll_PostMessageA
mov edx, 0x28
mov eax, dword [ebp - 4]
call fcn.00520b78
cmp dword [ebp - 0x20], 1
jne 0x4f2d20
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7e4]
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x24], 1
jne 0x4f2d3e
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7e8]
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x28], 1
jne 0x4f2d5c
push 0
mov ecx, 2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x7ec]
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x20], 0xffffffff
jne 0x4f2d76
push 0
mov ecx, 1
mov edx, 0xa0
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x24], 0xffffffff
jne 0x4f2d90
push 0
mov ecx, 1
mov edx, 0xa2
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4f2daa
push 0
mov ecx, 1
mov edx, 0xa4
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x20], 0xfffffffe
jne 0x4f2dc4
push 0
mov ecx, 1
mov edx, 0xa1
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x24], 0xfffffffe
jne 0x4f2dde
push 0
mov ecx, 1
mov edx, 0xa3
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0x28], 0xfffffffe
jne 0x4f2df8
push 0
mov ecx, 1
mov edx, 0xa5
mov eax, dword [ebp - 4]
call fcn.004f296c
cmp dword [ebp - 0xc], 0
je 0x4f2e08
cmp dword [ebp - 0xc], 2
jne 0x4f2fea
cmp dword [ebp - 8], 0x10
jne 0x4f2e19
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x7e4], edx
cmp dword [ebp - 8], 0x11
jne 0x4f2e2a
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x7e8], edx
cmp dword [ebp - 8], 0x12
jne 0x4f2e3b
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x7ec], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x40000000
jae 0x4f2e4a
call fcn.00403bec
add eax, 0x80000000
jae 0x4f2e56
call fcn.00403bec
push eax
mov eax, dword [ebp - 8]
push eax
push 0x101
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4b4]
push eax
call sub.user32.dll_PostMessageA
jmp 0x4f2fea
cmp dword [ebp - 0xc], 0
je 0x4f2e84
cmp dword [ebp - 0xc], 1
jne 0x4f2f3b
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x744], 0
jne 0x4f2ed5
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jns 0x4f2ead
call fcn.00403be4
push eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xff
jbe 0x4f2ebd
call fcn.00403be4
push eax
mov eax, dword [ebp - 8]
cmp eax, 0xff
jbe 0x4f2ecd
call fcn.00403be4
push eax
call sub.user32.dll_keybd_event
jmp 0x4f2f2c
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4f2eeb
call fcn.00403be4
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffff
jbe 0x4f2efe
call fcn.00403be4
mov word [ebp - 0x42], ax
mov eax, dword [ebp - 0x18]
test eax, eax
jns 0x4f2f0e
call fcn.00403be4
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
push 0x1c
lea eax, [ebp - 0x48]
push eax
push 1
mov eax, dword [ebp - 4]
call dword [eax + 0x744]
cmp dword [ebp - 0x1c], 0
jne 0x4f2f3b
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetAsyncKeyState
cmp dword [ebp - 0xc], 0
je 0x4f2f4b
cmp dword [ebp - 0xc], 2
jne 0x4f2fea
mov eax, dword [ebp - 4]
cmp dword [eax + 0x744], 0
jne 0x4f2f90
push 0
mov eax, dword [ebp - 0x18]
or eax, 2
test eax, eax
jns 0x4f2f68
call fcn.00403be4
push eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xff
jbe 0x4f2f78
call fcn.00403be4
push eax
mov eax, dword [ebp - 8]
cmp eax, 0xff
jbe 0x4f2f88
call fcn.00403be4
push eax
call sub.user32.dll_keybd_event
jmp 0x4f2fea
mov dword [ebp - 0x48], 1
mov eax, dword [ebp - 8]
cmp eax, 0xffff
jbe 0x4f2fa6
call fcn.00403be4
mov word [ebp - 0x44], ax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffff
jbe 0x4f2fb9
call fcn.00403be4
mov word [ebp - 0x42], ax
mov eax, dword [ebp - 0x18]
or eax, 2
test eax, eax
jns 0x4f2fcc
call fcn.00403be4
mov dword [ebp - 0x40], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
xor eax, eax
mov dword [ebp - 0x38], eax
push 0x1c
lea eax, [ebp - 0x48]
push eax
push 1
mov eax, dword [ebp - 4]
call dword [eax + 0x744]
mov esp, ebp
pop ebp
ret 4