Function at 0x4cf2f4
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xf0
mov eax, 0x5124c1
call fcn.004f41e2
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0xec]
mov esi, dword [ebp + 8]
xor edx, edx
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xc0], eax
xor eax, eax
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf0], ecx
stosd dword es:[edi], eax
push 4
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xc4], esi
stosd dword es:[edi], eax
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xc8], edx
mov dword [ebp - 0xb8], edx
stosd dword es:[edi], eax
lea eax, [ebp - 0xfc]
push eax
call fcn.0041092a
pop ecx
pop ecx
mov ecx, dword [0x5a23ec]
push 4
call fcn.004673c5
mov edi, dword [ebp - 0xc0]
test eax, eax
je 0x4cf393
push dword [ebp - 0xb4]
mov ecx, dword [0x5a22a0]
push edi
push ebx
push esi
call fcn.00410a72
lea ecx, [ebp - 0xe0]
call fcn.004d840a
xor ecx, ecx
mov dword [ebp - 4], ecx
mov esi, ecx
mov dword [ebp - 0xc0], esi
cmp ebx, 1
je 0x4cf40a
cmp ebx, 0x81
je 0x4cf40a
mov edx, dword [ebp - 0xbc]
cmp edx, dword [0x5a5510]
je 0x4cf4b3
push ecx
lea eax, [ebp - 0xc0]
mov ecx, 0x5a241c
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0040eeeb
test al, al
je 0x4cf401
mov esi, dword [ebp - 0xc0]
lea ecx, [ebp - 0xe0]
push esi
call fcn.004d8598
test al, al
jne 0x4cf4ab
xor ecx, ecx
mov esi, ecx
jmp 0x4cf4ad
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xe0]
push dword [eax]
call fcn.004d8598
mov esi, dword [ebp - 0xdc]
mov dword [ebp - 0xc0], esi
test esi, esi
je 0x4cf4ab
lea eax, [ebp - 0xc0]
mov ecx, 0x5a241c
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.0041a8f9
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push 9
imul eax, eax, 0xa
xor edx, edx
pop ecx
div ecx
lea ecx, [esi + 0x74]
push eax
push 0xc84
push dword [ebp - 0xbc]
call fcn.004f3e15
mov eax, dword [0x5a23ec]
lea ecx, [esi + 0x8c]
push dword [eax + 0x11190]
push 0xc81
push dword [ebp - 0xbc]
call fcn.004f3e15
mov eax, dword [0x5a23ec]
lea ecx, [esi + 0x9c]
push dword [eax + 0x11194]
push 0xc82
push dword [ebp - 0xbc]
call fcn.004f3e15
xor ecx, ecx
mov edx, dword [ebp - 0xbc]
cmp ebx, 0x106
jne 0x4cf4ca
mov dword [ebp - 0xb8], 1
jmp 0x4cfa35
test esi, esi
jne 0x4cf4e8
push dword [ebp - 0xb4]
push edi
push ebx
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov dword [ebp - 0xb8], eax
jmp 0x4cfa35
cmp ebx, 0x18
ja 0x4cf612
je 0x4cf5da
cmp ebx, 6
ja 0x4cf54e
je 0x4cf81d
mov eax, ebx
sub eax, 1
je 0x4cfa35
sub eax, 1
je 0x4cf543
sub eax, 1
je 0x4cf532
dec eax
sub eax, 1
jne 0x4cf98e
push dword [ebp - 0xb4]
lea ecx, [esi + 0xc]
push edi
call fcn.004d07b3
jmp 0x4cf4dd
push dword [ebp - 0xb4]
lea ecx, [esi + 0xc]
push edi
call fcn.004d01ec
jmp 0x4cf4dd
push dword [ebp - 0xb4]
push edi
push 2
jmp 0x4cf4d6
mov eax, ebx
sub eax, 7
je 0x4cf5ce
sub eax, 1
je 0x4cf81d
sub eax, 7
je 0x4cf577
sub eax, 5
jne 0x4cf98e
mov dword [ebp - 0xb8], ecx
jmp 0x4cfa35
inc dword [esi + 0x18]
mov ecx, dword [0x5a23ec]
push 2
call fcn.004673c5
test eax, eax
je 0x4cf5bd
push dword [esi + 0x14]
mov ecx, esi
push dword [esi + 0x18]
call fcn.004dc016
push eax
lea eax, [ebp - 0xb0]
push str.VCon__i__WM_PAINT__u_times___u_pending
push eax
call fcn.004031fd
push 1
lea eax, [ebp - 0xb0]
push 1
push eax
call fcn.00421c79
add esp, 0x20
and dword [esi + 0x14], 0
lea ecx, [esi + 0xc]
call fcn.004d0263
jmp 0x4cf4dd
mov ecx, esi
call fcn.004e1a3b
jmp 0x4cfa41
mov ecx, esi
call fcn.004dbfc5
test eax, eax
je 0x4cf5fe
test edi, edi
je 0x4cf5fe
mov ecx, esi
call fcn.004de78b
mov ecx, eax
call fcn.00497542
xor ecx, ecx
test al, al
cmove edi, ecx
push dword [ebp - 0xb4]
push edi
push 0x18
push dword [ebp - 0xbc]
jmp 0x4cf4d7
mov eax, 0x112
cmp ebx, eax
ja 0x4cf6db
je 0x4cf6ce
cmp ebx, 0x47
ja 0x4cf687
je 0x4cf664
cmp ebx, 0x1c
je 0x4cf81d
cmp ebx, 0x20
je 0x4cf650
cmp ebx, 0x46
jne 0x4cf98e
push dword [ebp - 0xb4]
push edi
push ebx
jmp 0x4cf4d6
mov ecx, dword [0x5a22a0]
push 0xffffffffffffffff
push 0xffffffffffffffff
call fcn.00416270
jmp 0x4cf4dd
push dword [ebp - 0xb4]
push edi
push 0x47
push edx
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea ecx, [esi + 0xc]
mov dword [ebp - 0xb8], eax
call fcn.004d0829
jmp 0x4cfa35
cmp ebx, 0x50
jb 0x4cf98e
cmp ebx, 0x51
jbe 0x4cf4ce
cmp ebx, 0xff
jbe 0x4cf98e
cmp ebx, 0x101
jbe 0x4cf81d
cmp ebx, 0x103
jbe 0x4cf98e
cmp ebx, 0x105
jbe 0x4cf81d
jmp 0x4cf98e
push dword [ebp - 0xb4]
push edi
push eax
jmp 0x4cf4d6
cmp ebx, 0x20e
ja 0x4cf976
cmp ebx, 0x200
jae 0x4cf807
cmp ebx, 0x113
je 0x4cf73c
cmp ebx, 0x115
je 0x4cf836
lea eax, [ebx - 0x119]
cmp eax, 1
ja 0x4cf98e
mov ecx, dword [0x5a22a0]
lea esi, [ebp - 0xb8]
push esi
push dword [ebp - 0xb4]
add ecx, 0x114
push edi
push ebx
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4cfa35
sub edi, 0xc81
je 0x4cf7be
sub edi, 1
je 0x4cf784
dec edi
sub edi, 1
jne 0x4cfa35
lea ecx, [esi + 0x74]
call fcn.004f3e68
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x4cfa35
mov ecx, esi
call fcn.004de78b
mov ecx, eax
call fcn.00482fc9
jmp 0x4cfa35
lea ecx, [esi + 0xc]
call fcn.004cf171
test al, al
jne 0x4cf79c
push 1
lea ecx, [esi + 0xc]
call fcn.004cfc4a
jmp 0x4cf7a3
mov byte [esi + 0x86], 1
lea ecx, [esi + 0x9c]
call fcn.004f3e36
test al, al
je 0x4cfa35
lea ecx, [esi + 0x9c]
jmp 0x4cf7fd
lea ecx, [esi + 0xc]
call fcn.004cf171
test al, al
jne 0x4cf7da
cmp byte [esi + 0x87], al
jne 0x4cf7da
mov byte [esi + 0x86], al
jmp 0x4cf7e4
push 1
lea ecx, [esi + 0xc]
call fcn.004d0c7c
lea ecx, [esi + 0x8c]
call fcn.004f3e36
test al, al
je 0x4cfa35
lea ecx, [esi + 0x8c]
call fcn.004f3e68
jmp 0x4cfa35
mov ecx, esi
call fcn.004de78b
mov ecx, eax
call fcn.0049755a
test al, al
jne 0x4cfa35
cmp ebx, 0x115
je 0x4cf836
cmp ebx, 0x202
jne 0x4cf86d
mov byte [esi + 0x88], 0
jmp 0x4cf86d
movzx ecx, di
cmp ecx, 4
jb 0x4cf858
cmp ecx, 5
jbe 0x4cf851
cmp ecx, 8
jne 0x4cf858
mov byte [esi + 0x88], 0
jmp 0x4cf858
mov byte [esi + 0x88], 1
mov eax, edi
shr eax, 0x10
push eax
push ecx
mov ecx, esi
call fcn.004de78b
mov ecx, eax
call fcn.00485e04
cmp byte [0x5a551c], 0
mov edx, dword [0x5a22a4]
mov dword [ebp - 0xc0], edx
jne 0x4cf901
push dword [ebp - 0xbc]
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [0x5a22a4]
mov dword [ebp - 0xc0], eax
cmp eax, ecx
je 0x4cf8c4
push ecx
push dword [ebp - 0xbc]
mov byte [0x5a551c], 1
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [0x5a22a4]
mov byte [0x5a551c], 0
mov dword [ebp - 0xc0], eax
push 0xfffffffffffffff0
push dword [ebp - 0xbc]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esi + 0x24]
xor ecx, eax
test ecx, 0xff0000
je 0x4cf909
push dword [esi + 0x24]
mov esi, dword [ebp - 0xbc]
push 0xfffffffffffffff0
push esi
mov byte [0x5a551c], 1
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov byte [0x5a551c], 0
jmp 0x4cf90f
mov esi, dword [ebp - 0xbc]
jmp 0x4cf915
mov esi, dword [ebp - 0xbc]
mov edx, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xb4]
lea eax, [ebx - 0x200]
cmp eax, 0xe
ja 0x4cf95c
movzx eax, cx
push 1
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xd0]
push eax
push edx
shr ecx, 0x10
push esi
mov dword [ebp - 0xcc], ecx
call dword [sym.imp.USER32.dll_MapWindowPoints]
movzx ecx, word [ebp - 0xcc]
movzx eax, word [ebp - 0xd0]
shl ecx, 0x10
or ecx, eax
mov eax, dword [ebp - 0xc0]
push ecx
mov ecx, dword [0x5a22a0]
push edi
push ebx
push eax
call fcn.0041d742
jmp 0x4cf4dd
cmp ebx, 0x282
je 0x4cfa35
cmp ebx, 0x318
je 0x4cfa1e
cmp ebx, dword [esi + 0x3c]
jne 0x4cf9b8
mov eax, dword [0x5a23ec]
cmp byte [eax + 0x110b1], 0
je 0x4cfa35
mov ecx, dword [0x5a22a0]
mov ecx, dword [ecx + 0x3e64]
call fcn.004c0315
jmp 0x4cfa35
cmp ebx, dword [esi + 0x40]
jne 0x4cf9c8
push ecx
lea ecx, [esi + 0xc]
call fcn.004d0967
jmp 0x4cfa35
cmp ebx, dword [esi + 0x44]
jne 0x4cf9d6
mov ecx, esi
call fcn.004de906
jmp 0x4cfa35
cmp ebx, dword [esi + 0x48]
jne 0x4cf9fc
cmp dword [ebp - 0xb4], 1
push ecx
sete al
mov ecx, esi
movzx eax, al
push eax
push 1
call fcn.004de78b
mov ecx, eax
call fcn.00485799
jmp 0x4cfa35
cmp ebx, dword [0x5a5518]
jne 0x4cfa15
push 1
push dword [ebp - 0xb4]
call fcn.004d08f6
pop ecx
pop ecx
jmp 0x4cfa41
test ebx, ebx
je 0x4cfa35
jmp 0x4cf4ce
test edi, edi
je 0x4cfa35
test byte [ebp - 0xb4], 4
je 0x4cfa35
push ecx
push ecx
push edi
mov ecx, esi
call fcn.004de686
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xc8], eax
lea ecx, [ebp - 0xe0]
call fcn.004d84a5
mov eax, dword [ebp - 0xc8]
call fcn.004f418c
ret 0x10