Function at 0x4aeb58
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4af1e2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x11
call sub.user32.dll_GetKeyState
movsx eax, ax
and eax, 0x8000
cmp eax, 0x8000
sete al
cmp word [esi + 4], 0xd
jne 0x4aebae
mov edx, dword [ebx + 0x2e0]
cmp byte [edx + 0x57], 0
je 0x4aebae
mov eax, ebx
call fcn.004b26a4
jmp 0x4af1c7
mov dx, word [esi + 4]
sub dx, 9
je 0x4aebc2
sub dx, 4
je 0x4aebc2
xor edx, edx
jmp 0x4aebc4
mov dl, 1
test dl, al
je 0x4aebd6
mov edx, esi
mov eax, ebx
call fcn.00451828
jmp 0x4af1c7
cmp word [esi + 4], 0x24
jne 0x4aec05
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4aec05
xor edx, edx
mov eax, dword [ebx + 0x2e4]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4af1c7
cmp word [esi + 4], 0x23
jne 0x4aec42
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4aec42
mov edi, dword [ebx + 0x2e4]
mov eax, dword [edi + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4af1c7
cmp word [esi + 4], 0x22
jne 0x4aecd8
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4aecd8
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edi, eax
mov eax, dword [ebx + 0x2e8]
add edi, dword [eax + 0xc]
mov eax, dword [ebx + 0x2e4]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp edi, eax
jge 0x4aecae
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x2e8]
add edx, dword [eax + 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x4aeccc
mov edi, dword [ebx + 0x2e4]
mov eax, dword [edi + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4af1c7
cmp word [esi + 4], 0x21
jne 0x4aed47
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4aed47
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, dword [ebx + 0x2e8]
cmp eax, dword [edx + 0xc]
jle 0x4aed2b
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [ebx + 0x2e8]
sub edx, dword [eax + 0xc]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
jmp 0x4aed3b
xor edx, edx
mov eax, dword [ebx + 0x2e4]
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov dword [esi + 0xc], 1
jmp 0x4af1c7
cmp word [esi + 4], 0xd
jne 0x4aed84
cmp byte [ebx + 0x264], 0
je 0x4aed84
mov word [esi + 4], 9
mov eax, ebx
call fcn.0045296c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4aed84
push 0
push 9
push pe_nt_image_headers32
mov eax, ebx
call fcn.0045296c
push eax
call sub.user32.dll_PostMessageA
cmp word [esi + 4], 0x27
jne 0x4aedd8
cmp dword [ebx + 0x27c], 0
je 0x4aedd8
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.0045296c
push eax
call sub.user32.dll_SendMessageA
call fcn.00407acc
movzx edi, ax
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004b0564
mov eax, dword [ebp - 8]
call fcn.00404d48
cmp edi, eax
jl 0x4aedd8
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4af1c7
cmp word [esi + 4], 0x2e
jne 0x4aee43
cmp dword [ebx + 0x27c], 0
je 0x4aee43
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.0045296c
push eax
call sub.user32.dll_SendMessageA
call fcn.00407acc
movzx edi, ax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004b0564
mov eax, dword [ebp - 0xc]
call fcn.00404d48
cmp edi, eax
jl 0x4aee3a
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jne 0x4aee3a
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4af1c7
mov dl, 1
mov eax, ebx
call fcn.004b1638
cmp word [esi + 4], 0x25
jne 0x4aee90
cmp dword [ebx + 0x278], 0
je 0x4aee90
push 0
push 0
push 0xb0
mov eax, ebx
call fcn.0045296c
push eax
call sub.user32.dll_SendMessageA
call fcn.00407acc
movzx edi, ax
mov eax, dword [ebx + 0x278]
call fcn.00404d48
cmp edi, eax
jg 0x4aee90
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4af1c7
cmp word [esi + 4], 0x23
jne 0x4aef15
cmp dword [ebx + 0x27c], 0
je 0x4aef15
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
jne 0x4aeedb
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004b0564
mov eax, dword [ebp - 0x10]
call fcn.00404d48
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
jmp 0x4aef05
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.004b0564
mov eax, dword [ebp - 0x14]
call fcn.00404d48
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
pop edx
sub edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4af1c7
cmp word [esi + 4], 0x24
jne 0x4aefb1
cmp dword [ebx + 0x278], 0
je 0x4aefb1
push 0x10
call sub.user32.dll_GetKeyState
movsx eax, ax
test ah, 0x80
jne 0x4aef61
mov eax, dword [ebx + 0x278]
call fcn.00404d48
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor edx, edx
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xd8]
jmp 0x4aefa1
mov eax, dword [ebx + 0x278]
call fcn.00404d48
push eax
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.004b0564
mov eax, dword [ebp - 0x18]
call fcn.00404d48
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d48
add edi, eax
push edi
push 0xb1
mov eax, ebx
call fcn.0045296c
push eax
call sub.user32.dll_SendMessageA
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4af1c7
cmp word [esi + 4], 8
jne 0x4aeff6
cmp dword [ebx + 0x278], 0
je 0x4aeff6
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d48
inc eax
cmp edi, eax
jg 0x4aefed
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4af1c7
mov dl, 1
mov eax, ebx
call fcn.004b1638
cmp word [esi + 4], 0x2e
jne 0x4af0c8
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov edi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d48
cmp edi, eax
jl 0x4af0c8
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004b0564
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jne 0x4af061
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [ebx + 0x278]
call fcn.00404d48
pop edx
sub edx, eax
inc edx
lea eax, [ebp - 4]
mov ecx, 1
call fcn.00404fe8
jmp 0x4af08f
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xcc]
push eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
push eax
mov eax, dword [ebx + 0x278]
call fcn.00404d48
pop edx
sub edx, eax
inc edx
lea eax, [ebp - 4]
pop ecx
call fcn.00404fe8
cmp word [ebx + 0x272], 0
jle 0x4af0bf
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004b04d4
dec eax
movsx edx, word [ebx + 0x272]
cmp eax, edx
jle 0x4af0bf
mov word [esi + 4], 0
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4af1c7
mov dl, 1
mov eax, ebx
call fcn.004b1638
cmp word [esi + 4], 0x26
jne 0x4af110
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4af110
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jle 0x4af10a
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
dec edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov word [esi + 4], 0
cmp word [esi + 4], 0x28
jne 0x4af16c
mov eax, dword [ebx + 0x2e0]
cmp byte [eax + 0x57], 0
je 0x4af16c
mov eax, dword [ebx + 0x2e4]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edi, eax
inc edi
mov eax, dword [ebx + 0x2e4]
mov eax, dword [eax + 0x218]
mov edx, dword [eax]
call dword [edx + 0x14]
cmp edi, eax
jge 0x4af166
mov edi, dword [ebx + 0x2e4]
mov eax, edi
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
inc edx
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov word [esi + 4], 0
mov edx, esi
mov eax, ebx
call fcn.00451828
cmp word [esi + 4], 0x2e
jne 0x4af18c
cmp byte [ebx + 0x237], 7
jne 0x4af18c
mov eax, ebx
call fcn.004b0988
cmp dword [ebx + 0x278], 0
je 0x4af1c7
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0xd0]
mov esi, eax
mov eax, dword [ebx + 0x278]
call fcn.00404d48
cmp esi, eax
jge 0x4af1c7
mov eax, dword [ebx + 0x278]
call fcn.00404d48
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xdc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4af1e9
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404aac
ret