Function at 0x4b0a20
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x13c
cmp word [esp + 0x14c], 0
push ebx
push esi
mov esi, ecx
je 0x4b0a72
cmp word [0x65af54], 0
jne 0x4b0a72
cmp word [esi + 0x96], 0xffff
je 0x4b0a72
mov ebx, dword [esp + 0x14c]
cmp bx, 0x11
je 0x4b0a72
cmp bx, 0x10
je 0x4b0a72
cmp bx, 0x1b
jne 0x4b0a82
mov eax, dword [esp + 0x148]
push 1
push eax
call fcn.00498880
pop esi
mov eax, 1
pop ebx
add esp, 0x13c
ret 0x14
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.004af580
mov eax, 1
cmp word [esi + 0x42c], ax
jne 0x4b0ac0
mov edx, ebx
and edx, 0xffff
lea eax, [edx - 0x25]
cmp eax, 3
ja case.default.0x4b0aab
jmp dword [eax*4 + 0x4b164c]
mov ebx, 0x28
jmp case.default.0x4b0aab
mov ebx, 0x26
jmp case.default.0x4b0aab
cmp word [esi + 0x5bc], ax
jne case.default.0x4b0aab
mov eax, ebx
and eax, 0xffff
sub eax, 0x25
je case.0x4b0aab.40
sub eax, 2
jne case.default.0x4b0aab
mov ebx, 0x25
jmp case.default.0x4b0aab
mov ebx, 0x27
push ebp
xor ebp, ebp
cmp word [esi + 0x3dc], bp
push edi
mov edi, ebx
jne 0x4b0b9e
and edi, 0xffff
cmp edi, 9
jne case.0x4b0bb8.15
mov eax, dword [esi + 0xdc]
mov edi, dword [esp + 0x150]
cmp eax, 0xffffffff
je 0x4b0b22
push edi
mov ecx, esi
call fcn.0049c430
mov eax, dword [0x65b368]
mov ecx, dword [esi + 0xdc]
add ecx, eax
mov dword [esi + 0xdc], ecx
lea ecx, [esp + 0x28]
push ecx
push 0x3fff7fff
push edi
mov ecx, esi
call fcn.0049cc40
mov eax, dword [esp + 0x28]
cmp eax, 0x3fff7fff
jne 0x4b0b73
lea edx, [esp + 0x28]
mov ecx, esi
push edx
push 0
push edi
call fcn.0049cc40
mov eax, dword [esp + 0x28]
cmp eax, 0x3fff7fff
jne 0x4b0b73
or eax, 0xffffffff
mov dword [esp + 0x28], eax
cmp eax, 0xffffffff
mov dword [esi + 0xdc], eax
je 0x4b14e4
push edi
mov ecx, esi
call fcn.0049c430
mov ebp, 1
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x13c
ret 0x14
and edi, 0xffff
lea eax, [edi - 8]
cmp eax, 0x26
ja case.0x4b0bb8.15
xor ecx, ecx
mov cl, byte [eax + 0x4b167c]
jmp dword [ecx*4 + 0x4b165c]
mov ecx, esi
xor edi, edi
call fcn.0049eb00
lea edx, [esp + 0x34]
lea eax, [esp + 0x18]
push edx
lea ecx, [esp + 0x14]
push eax
push ecx
push 2
push edi
mov ecx, esi
call fcn.004aa090
mov ebp, dword [esp + 0x150]
test eax, eax
je 0x4b0bf6
mov edx, dword [esp + 0x10]
mov dword [esp + 0x18], edx
jmp 0x4b0c61
mov ax, word [esi + 0x3ba]
mov cl, byte [esp + 0x158]
imul ax, word [esi + 0x3b4]
add ax, word [esi + 0x3b6]
add ax, word [esi + 0x3bc]
test cl, 1
push eax
mov ecx, esi
je 0x4b0c7f
call fcn.00488030
push eax
call fcn.0049eaf0
add esp, 4
test eax, eax
je 0x4b0c61
push eax
call fcn.00433030
mov ebx, eax
add esp, 4
cmp bx, word [esi + 0x3bc]
jb 0x4b0c61
push ebx
mov ecx, esi
call fcn.0048f9d0
push ebx
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.0048fa90
dec eax
mov dword [esp + 0x18], eax
mov ecx, esi
call fcn.0049eb50
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
or edi, 0x30d
push edi
push eax
push ecx
push ebp
jmp 0x4b14d7
call fcn.00486cc0
push eax
call fcn.00488900
add esp, 4
mov ecx, esi
mov ebx, eax
call fcn.00488940
push eax
call fcn.00488900
add esp, 4
cmp bx, ax
jb 0x4b0c48
push 1
push 0
push ebp
mov ecx, esi
mov edi, 0x10
call fcn.00488950
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
jmp 0x4b0c68
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp eax, ecx
je 0x4b0ce9
test byte [esp + 0x158], 1
jne 0x4b0ce9
push ecx
push eax
call fcn.00412540
add esp, 8
mov edi, eax
push 0x30d
jmp 0x4b14cd
mov dx, word [esi + 0x96]
mov ecx, esi
push edx
call fcn.0048f9d0
mov edi, dword [esi + 8]
mov ebx, eax
cmp edi, ebx
mov dword [esp + 0x10], ebx
jle 0x4b0e73
push edi
mov ecx, esi
call fcn.004986b0
mov ebp, eax
mov al, byte [esp + 0x158]
test al, 2
je 0x4b0df7
mov edi, dword [esi + 8]
and ebp, 0xffff
mov ebx, edi
sub ebx, ebp
mov ecx, esi
push ebx
call fcn.004af580
mov eax, dword [esi + 0x3f4]
mov ecx, esi
push eax
call fcn.004858d0
mov ebp, eax
mov eax, dword [esp + 0x10]
cmp edi, eax
je 0x4b0ddd
mov ecx, dword [esi + 0x3f8]
mov edx, ebp
sub edx, ecx
mov al, byte [edx + edi - 1]
cmp al, 0x20
jae 0x4b0d74
cmp al, 4
je 0x4b0d74
cmp al, 5
je 0x4b0d74
mov eax, dword [esp + 0x10]
dec edi
jmp 0x4b0dae
lea eax, [esp + 0x20]
lea edx, [esp + 0x24]
push eax
push edx
mov edx, dword [esi + 0x3fc]
lea eax, [esp + 0x20]
push eax
sub edx, ecx
push ebp
sub ebx, ecx
push edx
push ebx
push 1
call fcn.0040e6c0
mov edi, dword [esi + 0x3f8]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
add edi, edx
add esp, 0x1c
cmp edi, eax
jle 0x4b0ddb
cmp edi, eax
je 0x4b0ddd
mov ebx, dword [esp + 0x15c]
push edi
add ebx, 0xffff
mov ecx, esi
mov dword [esp + 0x160], ebx
call fcn.004986b0
test bx, bx
mov ebp, eax
jne 0x4b0d25
jmp 0x4b0ddd
mov edi, eax
test byte [esp + 0x158], 1
jne 0x4b0e73
mov eax, edi
push 0x30d
jmp 0x4b14cd
mov edi, dword [esp + 0x15c]
add edi, 0xffff
test di, di
je 0x4b0e2f
mov eax, dword [esi + 8]
mov ecx, ebp
and ecx, 0xffff
sub eax, ecx
cmp eax, ebx
jle 0x4b0e2f
push eax
mov ecx, esi
call fcn.004986b0
add edi, 0xffff
add ebp, eax
test di, di
jne 0x4b0e09
test byte [esp + 0x158], 1
je 0x4b0e51
mov edi, dword [esi + 8]
mov eax, dword [esi + 4]
and ebp, 0xffff
push 0x30d
sub edi, ebp
jmp 0x4b14cd
mov eax, dword [esi + 8]
mov edi, dword [esi + 8]
mov edx, ebp
and ebp, 0xffff
and edx, 0xffff
push 0x30d
sub eax, edx
sub edi, ebp
jmp 0x4b14cd
mov eax, dword [esi + 4]
push 0x30d
jmp 0x4b14cd
mov cx, word [esi + 0x96]
push ecx
mov ecx, esi
call fcn.0048fa90
mov ecx, dword [esp + 0x158]
mov ebx, eax
mov ebp, ecx
and ebp, 1
test bp, bp
mov dword [esp + 0x10], ebp
jne 0x4b0ea7
dec ebx
mov eax, dword [esi + 4]
mov edi, dword [esi + 8]
cmp eax, edi
je 0x4b0ed8
test bp, bp
jne 0x4b0ed8
push ebx
push edi
push eax
call fcn.00412550
add esp, 8
push eax
call fcn.00412540
add esp, 8
mov edi, eax
mov eax, edi
push 0x30d
jmp 0x4b14cd
cmp edi, ebx
jge 0x4b0ff6
test cl, 2
je 0x4b0fa2
push edi
mov ecx, esi
call fcn.004af580
cmp dword [esi + 8], ebx
je 0x4b0f8c
mov edx, dword [esi + 0x3f4]
mov ecx, esi
push edx
call fcn.004858d0
mov edx, dword [esi + 0x3f8]
mov ecx, eax
sub ecx, edx
mov cl, byte [ecx + edi]
cmp cl, 0x20
jae 0x4b0f2a
cmp cl, 4
je 0x4b0f2a
cmp cl, 5
je 0x4b0f2a
mov edi, dword [esi + 8]
inc edi
jmp 0x4b0f70
lea edx, [esp + 0x24]
mov ebp, dword [esi + 0x3f8]
push edx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
mov eax, dword [esi + 0x3fc]
push ebx
push eax
call fcn.00412540
add esp, 8
sub eax, ebp
sub edi, ebp
push eax
push edi
push 1
call fcn.0040e6c0
mov edi, dword [esi + 0x3f8]
mov eax, dword [esp + 0x34]
mov ebp, dword [esp + 0x2c]
add esp, 0x1c
add edi, eax
mov eax, dword [esp + 0x15c]
add eax, 0xffff
test ax, ax
mov dword [esp + 0x15c], eax
jne 0x4b0ee9
test bp, bp
je 0x4b0ecc
mov eax, dword [esi + 4]
push 0x30d
jmp 0x4b14cd
mov ebp, dword [esp + 0x15c]
xor edi, edi
mov edx, dword [esi + 8]
mov ecx, edi
and ecx, 0xffff
lea eax, [ecx + edx]
cmp eax, ebx
jge 0x4b0fd2
push eax
mov ecx, esi
call fcn.004987e0
add ebp, 0xffff
add edi, eax
test bp, bp
jne 0x4b0fab
cmp word [esp + 0x10], 0
je 0x4b0fdf
mov eax, dword [esi + 4]
jmp 0x4b0feb
mov ecx, dword [esi + 8]
mov eax, edi
and eax, 0xffff
add eax, ecx
mov ecx, dword [esi + 8]
and edi, 0xffff
add edi, ecx
push 0x30d
jmp 0x4b14cd
mov ecx, dword [esp + 0x158]
mov edx, dword [esp + 0x150]
push ecx
push ebx
push edx
mov ecx, esi
call fcn.004b0450
mov ebp, 1
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x13c
ret 0x14
mov ecx, dword [esi + 4]
mov eax, dword [esi + 8]
cmp ecx, eax
je 0x4b1053
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x18]
push edx
push eax
push ecx
call fcn.0048df70
mov ecx, dword [esp + 0x2c]
add esp, 0x10
jmp 0x4b119b
cmp bx, 8
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], ecx
jne 0x4b110f
test ecx, ecx
je 0x4b119b
mov di, word [esi + 0x5f6]
push ecx
mov ecx, esi
mov word [esi + 0x5f6], 1
call fcn.004986b0
mov bp, ax
mov al, byte [esp + 0x158]
and ebp, 0xffff
mov word [esi + 0x5f6], di
test al, 2
je 0x4b10fc
mov eax, dword [esp + 0x14]
mov ecx, esi
sub eax, ebp
push eax
call fcn.004af580
mov edi, dword [esp + 0x14]
mov ecx, dword [esi + 0x3f8]
sub edi, ecx
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esi + 0x3f4]
lea eax, [esp + 0x14]
push edx
push eax
push ecx
mov ecx, esi
sub edi, ebp
call fcn.004858d0
mov edx, dword [esi + 0x3fc]
mov ecx, dword [esi + 0x3f8]
sub edx, ecx
push eax
push edx
push edi
push 1
call fcn.0040e6c0
mov ecx, dword [esp + 0x2c]
add esp, 0x1c
sub edi, ecx
add ebp, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub eax, ebp
mov dword [esp + 0x14], eax
jmp 0x4b119b
test byte [esp + 0x158], 2
je 0x4b116d
push ecx
mov ecx, esi
call fcn.004af580
mov edi, dword [esp + 0x14]
mov edx, dword [esi + 0x3f8]
lea eax, [esp + 0x24]
sub edi, edx
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esi + 0x3f4]
lea edx, [esp + 0x24]
push ecx
push edx
push eax
mov ecx, esi
call fcn.004858d0
mov ecx, dword [esi + 0x3fc]
mov ebp, dword [esi + 0x3f8]
sub ecx, ebp
push eax
push ecx
push edi
push 1
call fcn.0040e6c0
mov eax, dword [esp + 0x2c]
add esp, 0x1c
sub eax, edi
jmp 0x4b118c
mov di, word [esi + 0x5f6]
push ecx
mov ecx, esi
mov word [esi + 0x5f6], 1
call fcn.004987e0
mov word [esi + 0x5f6], di
mov ecx, dword [esp + 0x1c]
and eax, 0xffff
add ecx, eax
mov dword [esp + 0x1c], ecx
mov edx, dword [esp + 0x14]
push 0
push ecx
push edx
mov ecx, esi
call fcn.0049e6d0
cmp bx, 8
jne 0x4b1222
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x4b1222
mov ecx, esi
call fcn.0049eb50
mov eax, dword [esi + 4]
push 0
push eax
push eax
mov ecx, esi
call fcn.0049e6d0
mov ecx, dword [esi + 4]
push ecx
mov ecx, esi
call fcn.004880a0
push eax
call fcn.0048feb0
add esp, 4
mov ecx, esi
test eax, eax
jne 0x4b120a
call fcn.0049eb50
push 0
call dword [sym.imp.USER32.dll_MessageBeep]
mov ebp, 1
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x13c
ret 0x14
call fcn.0049eb50
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push 0
push edx
push eax
mov ecx, esi
call fcn.0049e6d0
push 0
push 0
push 0xffffffffffffffff
call fcn.004ce9e0
add esp, 0xc
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x14]
push ecx
push edx
push eax
push 0
push 1
mov ecx, esi
call fcn.00495550
cmp bx, 8
mov ebp, eax
jne 0x4b1254
xor ebp, ebp
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x150]
xor edi, edi
cmp ecx, eax
jne 0x4b1280
test ebp, ebp
jne 0x4b1280
push ebp
call dword [sym.imp.USER32.dll_MessageBeep]
mov ecx, esi
call fcn.0049eb50
jmp 0x4b133a
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x64]
push 0x1cf4
mov ecx, esi
call fcn.004850c0
mov eax, dword [esi + 0x394]
test eax, eax
je 0x4b12c6
mov ecx, esi
call fcn.0049eb50
push ebx
mov ecx, esi
call fcn.00493f00
mov eax, dword [esi + 0x3d4]
mov ecx, dword [esi + 0x3d0]
push 0
push eax
push ecx
mov ecx, esi
call fcn.0049e6d0
jmp 0x4b12ce
push ebx
mov ecx, esi
call fcn.00493f00
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push 3
push edx
push eax
push ebx
mov ecx, esi
call fcn.004903e0
test eax, eax
jne 0x4b12ea
test edi, edi
je 0x4b12ef
mov edi, 1
test ebp, ebp
je 0x4b130d
lea ecx, [esp + 0x34]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
call fcn.00495a70
mov ebp, eax
jmp 0x4b12ce
push 1
push ebx
mov ecx, esi
call fcn.0049aa40
mov eax, dword [esi + 0x394]
test eax, eax
je 0x4b1332
mov ecx, esi
call fcn.0049eb50
push 1
push ebx
mov ecx, esi
call fcn.0049aa40
mov edx, dword [esi]
push ebx
mov ecx, esi
call dword [edx + 0x40]
mov eax, dword [esp + 0x14]
mov ecx, esi
neg edi
sbb edi, edi
and edi, 2
or edi, 0x29
push edi
push eax
push eax
push ebx
call fcn.00494a50
mov dword [esi + 0x90], eax
call fcn.004ceb00
mov ebp, 1
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x13c
ret 0x14
mov bl, byte [esp + 0x158]
mov ecx, esi
test bl, 2
je 0x4b1389
call fcn.0048fa30
mov edi, eax
jmp 0x4b13e4
call fcn.0049eb00
mov eax, dword [esi + 0x394]
test eax, eax
je 0x4b13a3
mov eax, dword [esi + 4]
mov ecx, esi
push eax
call fcn.004af580
mov ecx, dword [esi + 0x3fc]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x41c]
dec ecx
cmp eax, ecx
je 0x4b13dd
cmp eax, edi
jne 0x4b13dd
mov ecx, dword [esi + 0x8c]
test ecx, ecx
jne 0x4b13ca
cmp dword [esi + 4], eax
jge 0x4b13dd
push edi
mov ecx, esi
call fcn.00484770
push eax
call fcn.004952e0
add esp, 4
mov edi, eax
mov ecx, esi
call fcn.0049eb50
test bl, 1
je 0x4b1400
mov eax, dword [esi + 4]
mov edx, dword [esp + 0x150]
push 0x10d
push edi
push eax
push edx
jmp 0x4b14d7
mov edx, dword [esp + 0x150]
mov eax, edi
push 0x10d
push edi
push eax
push edx
jmp 0x4b14d7
mov bl, byte [esp + 0x158]
test bl, 2
jne 0x4b14a0
mov ecx, esi
call fcn.0049eb00
mov eax, dword [esi + 0x394]
test eax, eax
je 0x4b143e
mov eax, dword [esi + 4]
mov ecx, esi
push eax
call fcn.004af580
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x41c]
cmp eax, edi
jne 0x4b1474
mov ecx, dword [esi + 0x8c]
test ecx, ecx
jne 0x4b145a
cmp dword [esi + 4], eax
jge 0x4b1474
mov ecx, dword [esi + 0x3f8]
cmp eax, ecx
jne 0x4b148d
mov edx, dword [esi + 0x3fc]
dec edx
cmp eax, edx
je 0x4b148d
lea edi, [ecx - 1]
jmp 0x4b148d
mov ecx, dword [esi + 0x3fc]
mov eax, dword [esi + 0x420]
dec ecx
push eax
push ecx
call fcn.00412540
add esp, 8
mov edi, eax
mov ecx, esi
mov dword [esi + 0x8c], 1
call fcn.0049eb50
jmp 0x4b14bc
mov dx, word [esi + 0x96]
mov ecx, esi
push edx
call fcn.0048fa90
mov edi, eax
mov dword [esi + 0x8c], 0
dec edi
test bl, 1
je 0x4b14c6
mov eax, dword [esi + 4]
jmp 0x4b14c8
mov eax, edi
push 0x10c
push edi
push eax
mov eax, dword [esp + 0x15c]
push eax
mov ecx, esi
call fcn.00494a50
mov dword [esi + 0x90], eax
mov ebp, 1
pop edi
mov eax, ebp
pop ebp
pop esi
pop ebx
add esp, 0x13c
ret 0x14
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov cl, byte [esp + 0x5c]
mov dl, byte [esp + 0x5d]
mov al, 0x7f
push 0
and cl, al
and dl, al
mov byte [esp + 0x60], cl
mov ecx, dword [esp + 0x164]
mov byte [esp + 0x61], dl
lea edx, [esp + 0x1c]
sar ecx, 0x10
lea eax, [esp + 0x50]
push edx
and ecx, 0xff
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_ToAscii]
mov edx, dword [esp + 0x18]
and edx, 0xff
push edx
call dword [sym.imp.MSVCRT.dll_toupper]
mov ebx, eax
add esp, 4
test bx, bx
je 0x4b163b
cmp word [esi + 0x3dc], 1
jne 0x4b163b
mov eax, dword [esp + 0x158]
or al, 2
test ax, ax
je 0x4b163b
mov dword [esp + 0x10], 0
add esi, 0xc
mov eax, dword [esi]
test eax, eax
je 0x4b15d6
push eax
mov ecx, 0x651a58
call fcn.0041a8b0
mov edi, eax
xor ecx, ecx
mov cx, word [edi + 2]
push ecx
call dword [sym.imp.MSVCRT.dll_toupper]
mov edx, ebx
add esp, 4
and edx, 0xffff
cmp edx, eax
jne 0x4b15d6
mov eax, dword [esp + 0x158]
and eax, 1
test ax, ax
je 0x4b15d0
cmp word [edi], 0
jne 0x4b15f6
test ax, ax
jne 0x4b15d6
cmp word [edi], 0
je 0x4b15f6
mov eax, dword [esp + 0x10]
add esi, 4
inc eax
cmp eax, 0x20
mov dword [esp + 0x10], eax
jl 0x4b1587
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x13c
ret 0x14
mov eax, dword [0x65af58]
push 0x1be6
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor ecx, ecx
push 0
mov cx, word [edx*2 + 0x659144]
mov esi, eax
push ecx
push 0x14e
push esi
call edi
mov eax, dword [0x65af58]
push esi
push 0x11be6
push 0x111
push eax
call edi
mov eax, ebp
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x13c
ret 0x14