Function at 0x4c8e20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 0x2d
mov byte [0x598e88], 0
jne 0x4c8efc
mov eax, dword [ebp + 0x10]
and eax, 0xffff
cmp eax, 1
jne case.default.0x4c8f48
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call esi
test ah, 0x80
je 0x4c8ea4
mov eax, dword [0x598e44]
test eax, eax
je case.default.0x4c8f48
call fcn.004bb580
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0x3ec
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
test eax, eax
jne case.default.0x4c8f48
mov ecx, dword [ebp + 8]
push eax
push 0x3ec
push 0x111
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x10
call esi
test ah, 0x80
je case.default.0x4c8f48
mov eax, dword [0x598e48]
test eax, eax
je case.default.0x4c8f48
call fcn.004bb580
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 0
push 0x3fd
push eax
call dword [sym.imp.USER32.dll_GetMenuState]
test eax, eax
jne case.default.0x4c8f48
push eax
mov eax, dword [ebp + 8]
push 0x3fd
push 0x111
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push ebx
push edi
push esi
call fcn.004c8d00
add esp, 0xc
cmp eax, 1
je case.default.0x4c8f48
cmp dword [esi + 0x48], 1
je case.default.0x4c8f48
mov al, byte [esi + 0x20d]
test al, al
jne 0x4c9072
mov al, byte [esi + 0x20c]
test al, al
jne 0x4c9072
lea eax, [edi - 0x21]
cmp eax, 7
ja case.default.0x4c8f48
jmp dword [eax*4 + 0x4c9084]
mov edx, dword [esi]
push 0
push 0
push 0x115
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push 1
mov eax, dword [esi]
push 0x115
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [esi]
push 0
push 0
push 0x114
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [esi]
push 0
push 1
push 0x114
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
push 0
push 2
je 0x4c8fcf
mov eax, dword [esi]
push 0x114
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [esi]
push 0x115
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ah, 0x80
push 0
push 3
je 0x4c8f6a
mov edx, dword [esi]
push 0x114
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test ah, 0x80
je 0x4c902b
mov ecx, dword [esi]
push 0
push 6
push 0x115
push ecx
call edi
mov edx, dword [esi]
push 0
push 6
push 0x114
push edx
call edi
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test ah, 0x80
je 0x4c905f
mov eax, dword [esi]
push 0
push 7
push 0x115
push eax
call edi
mov ecx, dword [esi]
push 0
push 7
push 0x114
push ecx
call edi
pop edi
pop esi
pop ebx
pop ebp
ret
push ebx
push edi
push esi
call fcn.004c16a0
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret