Function at 0x4f89dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebp - 0x32]
mov byte [ebp - 5], 1
xor edx, edx
push ebp
push 0x4f9131
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 1
mov eax, dword [0x567ef4]
mov eax, dword [eax]
xor edx, edx
call fcn.00465134
push eax
call sub.user32.dll_SetCursor
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004f6260
test eax, eax
jle 0x4f8ae2
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004f6260
mov edx, eax
dec edx
mov eax, ebx
call fcn.004f6268
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x30]
mov ebx, dword [esi + 0x8c]
test ebx, ebx
jl 0x4f8ace
mov eax, esi
call fcn.004f6260
cmp ebx, eax
jge 0x4f8ace
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
mov eax, ebx
call fcn.004f6268
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x78], 0
je 0x4f8aba
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov eax, ebx
call fcn.004f6260
mov edx, dword [ebx + 0x8c]
inc edx
cmp eax, edx
jle 0x4f8aba
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x30]
mov edx, dword [ebx + 0x8c]
inc edx
mov eax, ebx
call fcn.004f6268
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4f8ace
mov edx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
lea eax, [ebp - 0xe]
push eax
call sub.user32.dll_GetCursorPos
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
call fcn.004f7f90
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
test ebx, ebx
je 0x4f8af8
mov eax, ebx
call fcn.0044c8e0
call fcn.004c464c
mov byte [ebp - 6], 1
jmp 0x4f90f9
cmp byte [ebp - 6], 0
jne 0x4f8b0c
call sub.user32.dll_WaitMessage
mov byte [ebp - 6], 0
jmp 0x4f90d8
mov eax, dword [edi + 4]
sub eax, 0x12
je 0x4f8c1a
sub eax, 0x34
je 0x4f8b3e
add eax, 0xffffffa5
sub eax, 9
jb 0x4f8c1a
sub eax, 0x157
je 0x4f8b4f
jmp 0x4f8c26
push ebp
call fcn.004f8988
pop ecx
call fcn.0040428c
jmp 0x4f9138
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00408038
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00445c1c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4f8bcb
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4f8bcb
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4f8c26
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4f8bfd
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00445c1c
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4f8bfa
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4f8c05
test bl, bl
je 0x4f8bd2
test bl, bl
jne 0x4f8c26
push ebp
call fcn.004f8988
pop ecx
call fcn.0040428c
jmp 0x4f9138
push ebp
call fcn.004f8988
pop ecx
jmp 0x4f90d8
push 3
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
je 0x4f90d8
mov eax, dword [edi + 4]
sub eax, 0x7b
je 0x4f90d8
add eax, 0xffffff7b
sub eax, 9
jb 0x4f8c78
add eax, 0xffffff09
sub eax, 0xb
jb 0x4f8f39
sub eax, 0x264
jne 0x4f90d2
mov eax, dword [ebp - 4]
call fcn.004f8640
jmp 0x4f90d8
push 1
call sub.user32.dll_GetKeyState
test ax, ax
jl 0x4f90d8
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x4f8cae
sub eax, 2
je 0x4f8ee0
sub eax, 2
je 0x4f8cae
sub eax, 2
je 0x4f8ee0
jmp 0x4f90d8
mov eax, dword [edi + 8]
cmp eax, 0x25
jg 0x4f8cf1
je 0x4f8da3
cmp eax, 0x12
jg 0x4f8cda
je 0x4f8ec9
sub eax, 9
je 0x4f90d8
sub eax, 4
je 0x4f8d16
jmp 0x4f8ed5
sub eax, 0x1b
je 0x4f8d7b
sub eax, 5
je 0x4f90d8
jmp 0x4f8ed5
sub eax, 0x26
je 0x4f8e8c
dec eax
je 0x4f8e0d
dec eax
je 0x4f8ea6
sub eax, 0x51
je 0x4f8ec9
jmp 0x4f8ed5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
test eax, eax
je 0x4f8d29
mov si, 0xffef
call fcn.00403b4c
mov eax, dword [ebp - 4]
call fcn.004f8640
test al, al
jne 0x4f90d8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x40], 0
je 0x4f90d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
mov eax, dword [eax + 0x30]
mov edx, 0x4f9148
call fcn.00405208
je 0x4f90d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x40]
cmp byte [eax + 0x35], 0
je 0x4f90d8
push ebp
call fcn.004f8988
pop ecx
jmp 0x4f90d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4f8d89
mov byte [eax + 0x44], 0
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x40], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x38]
call fcn.0040428c
jmp 0x4f9138
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4f8db9
mov eax, dword [ebp - 4]
call fcn.004f8848
jmp 0x4f90d8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
test ebx, ebx
je 0x4f90d8
cmp byte [ebx + 0x34], 0
je 0x4f8dee
push 0
push 0x25
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
call fcn.0040428c
jmp 0x4f9138
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4f90d8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
je 0x4f8e23
mov eax, dword [ebp - 4]
call fcn.004f8718
jmp 0x4f90d8
mov eax, dword [ebp - 4]
cmp dword [eax + 0x48], 0
je 0x4f90d8
mov eax, dword [ebp - 4]
call fcn.004f8640
test al, al
jne 0x4f90d8
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x48]
cmp byte [ebx + 0x34], 0
je 0x4f8e6d
push 0
push 0x27
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
call fcn.0040428c
jmp 0x4f9138
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4f90d8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4f90d8
mov eax, dword [ebp - 4]
call fcn.004f8848
jmp 0x4f90d8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x34], 0
jne 0x4f8ebc
mov eax, dword [ebp - 4]
call fcn.004f8718
jmp 0x4f90d8
mov eax, dword [ebp - 4]
call fcn.004f8640
jmp 0x4f90d8
push ebp
call fcn.004f8988
pop ecx
jmp 0x4f90d8
push edi
call sub.user32.dll_TranslateMessage
jmp 0x4f90d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004f7510
test eax, eax
je 0x4f90d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dl, byte [edi + 8]
call fcn.004f7510
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], ebx
test ebx, ebx
je 0x4f8f1a
mov edx, ebx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4f90d8
mov eax, dword [edi + 4]
sub eax, 0x200
je 0x4f8f51
sub eax, 2
je 0x4f900f
jmp 0x4f90d8
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00408038
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
cmp eax, dword [0x57c790]
jne 0x4f8f82
mov eax, dword [ebp - 0xa]
cmp eax, dword [0x57c794]
je 0x4f90d8
mov esi, dword [ebp - 4]
jmp 0x4f8f89
mov esi, eax
mov eax, dword [esi + 0x48]
test eax, eax
jne 0x4f8f87
test esi, esi
je 0x4f8ff8
mov ebx, dword [esi + 0x40]
lea edx, [ebp - 0xe]
mov eax, esi
call fcn.004f7f90
cmp ebx, dword [esi + 0x40]
je 0x4f8ff1
cmp esi, dword [ebp - 4]
je 0x4f8ff1
mov ebx, dword [ebp - 4]
cmp esi, ebx
je 0x4f8fd0
push 0
push 0x1b
push pe_nt_image_headers32
mov eax, dword [ebx + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
mov ebx, dword [ebx + 0x48]
cmp esi, ebx
jne 0x4f8fb2
push 0
push 0
push 0x46f
mov eax, dword [esi + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
call fcn.0040428c
jmp 0x4f9138
mov esi, dword [esi + 0x4c]
test esi, esi
jne 0x4f8f94
mov eax, dword [ebp - 0xe]
mov dword [0x57c790], eax
mov eax, dword [ebp - 0xa]
mov dword [0x57c794], eax
jmp 0x4f90d8
lea edx, [ebp - 0xe]
mov eax, dword [edi + 0xc]
call fcn.00408038
lea eax, [ebp - 0xe]
push eax
mov eax, dword [edi]
push eax
call sub.user32.dll_ClientToScreen
mov eax, dword [ebp - 0xe]
mov dword [ebp - 0x16], eax
mov eax, dword [ebp - 0xa]
mov dword [ebp - 0x12], eax
lea ecx, [ebp - 0x3c]
lea edx, [ebp - 0xe]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00445c1c
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xe], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa], eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x40]
test ebx, ebx
je 0x4f908b
push dword [ebp - 0xa]
push dword [ebp - 0xe]
lea eax, [ebx + 0x95]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4f908b
push 0
push 0xd
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.0044c8e0
push eax
call sub.user32.dll_PostMessageA
jmp 0x4f90d8
mov esi, dword [ebp - 4]
xor ebx, ebx
jmp 0x4f90bd
lea ecx, [ebp - 0xe]
lea edx, [ebp - 0x16]
mov eax, dword [esi + 0x3c]
call fcn.00445c1c
push dword [ebp - 0xa]
push dword [ebp - 0xe]
mov eax, dword [esi + 0x40]
add eax, 0x95
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x4f90ba
mov bl, 1
mov esi, dword [esi + 0x48]
test esi, esi
je 0x4f90c5
test bl, bl
je 0x4f9092
test bl, bl
jne 0x4f90d8
push ebp
call fcn.004f8988
pop ecx
jmp 0x4f90d8
push edi
call sub.user32.dll_DispatchMessageA
push ebp
call fcn.004f89b4
pop ecx
test al, al
je 0x4f90f9
push 0
push 0
push 0
push 0
push edi
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4f8b15
push ebp
call fcn.004f89b4
pop ecx
test al, al
jne 0x4f8b01
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9138
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
test eax, eax
je 0x4f9124
mov edx, dword [eax]
call dword [edx + 0x38]
mov eax, dword [ebp - 4]
mov byte [eax + 0x45], 0
call fcn.004c466c
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret