Function at 0x4ec600
Capabilities:
Log keystrokes via polling
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5a7cf8
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push esi
push edi
mov eax, dword [0x6336a0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [esp + 0x3c], esi
mov eax, dword [edi + 4]
cmp eax, 0x233
jne 0x4ec66a
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, ebx
call fcn.004ed060
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 0x100
mov ecx, 1
jne 0x4ec67c
mov dword [ebx + 0xa4], ecx
cmp dword [edi + 4], 0x100
jne 0x4ec6d4
mov eax, dword [edi + 8]
cmp eax, 0x53
je 0x4ec692
cmp eax, 0x4f
jne 0x4ec6d4
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4ec6cf
mov edx, dword [edi + 8]
mov eax, dword [0x63c460]
push esi
push edx
push 0x4af
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, 1
mov eax, dword [edi + 4]
cmp eax, 0x201
mov dword [esp + 0x1c], esi
jne 0x4ec720
cmp dword [ebx + 0xcc], esi
mov dword [ebx + 0xa4], ecx
je 0x4ec715
cmp dword [ebx + 0x80], ecx
jne 0x4ec715
mov edx, dword [ebx]
mov eax, dword [edx + 0x1f0]
mov dword [esp + 0x1c], ecx
push esi
mov ecx, ebx
mov dword [ebx + 0x80], esi
mov dword [ebx + 0x88], esi
call eax
mov dword [ebx + 0x80], esi
jmp 0x4ecfd0
cmp eax, 0x200
jne 0x4ec811
cmp dword [ebx + 0x80], esi
je 0x4ecfdb
mov edx, dword [edi + 0x14]
cmp dword [ebx + 0x8c], edx
mov esi, dword [edi + 0x18]
lea ecx, [edi + 0x14]
lea eax, [ebx + 0x8c]
jne 0x4ec757
cmp dword [eax + 4], esi
je 0x4ecfdb
cmp dword [ebx + 0xac], 0
jne 0x4ecfdb
mov dword [ebx + 0x84], 1
mov edx, dword [ecx]
cmp dword [ebx + 0x94], edx
jle 0x4ec77e
mov dword [ebx + 0x94], edx
mov edx, dword [ecx]
cmp dword [ebx + 0x9c], edx
jge 0x4ec78e
mov dword [ebx + 0x9c], edx
mov edx, dword [edi + 0x18]
cmp edx, dword [ebx + 0x98]
jge 0x4ec79f
mov dword [ebx + 0x98], edx
mov edx, dword [edi + 0x18]
cmp edx, dword [ebx + 0xa0]
jle 0x4ec7b0
mov dword [ebx + 0xa0], edx
mov edx, dword [ebx + 0x9c]
sub edx, dword [ebx + 0x94]
cmp edx, 5
jge 0x4ec7d6
mov edx, dword [ebx + 0xa0]
sub edx, dword [ebx + 0x98]
cmp edx, 5
jl 0x4ecfdb
call fcn.004ebee0
mov esi, eax
call fcn.004ebf40
test eax, eax
je 0x4ec7ed
push eax
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [ebx + 0x88], esi
je 0x4ec650
mov eax, dword [ebx]
mov edx, dword [eax + 0x1f0]
push esi
mov ecx, ebx
mov dword [ebx + 0x88], esi
call edx
jmp 0x4ec650
cmp eax, 0x204
jne 0x4ecd2b
mov ecx, dword [ebx + 0x6c]
xor eax, eax
cmp ecx, esi
mov dword [ebx + 0xac], esi
mov dword [esp + 0x18], eax
je 0x4ec83e
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
mov eax, dword [esp + 0x18]
mov dword [ebx + 0x6c], esi
test byte [edi + 8], 8
jne 0x4ec857
mov edx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push edx
push eax
call fcn.004ebfd0
mov dword [esp + 0x18], eax
xor esi, esi
cmp eax, esi
je 0x4eccdf
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], esi
mov ecx, dword [eax]
push 0x5d1e60
push eax
mov eax, dword [ecx]
call eax
mov dword [esp + 0x78], esi
cmp dword [esp + 0x28], esi
je 0x4ecb3f
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x40]
mov edi, 1
call eax
cmp dword [esp + 0x20], 0
je 0x4ec96b
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [esp + 0x44]
push ecx
call esi
lea edx, [esp + 0x54]
push edx
call esi
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x44]
push edx
push eax
mov eax, dword [ecx + 0x1f0]
call eax
mov eax, dword [esp + 0x20]
mov ecx, dword [eax]
lea edx, [esp + 0x54]
push edx
push eax
mov eax, dword [ecx + 0x1f0]
call eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.004f20e0
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov byte [esp + 0x80], 1
call fcn.004f20e0
lea edx, [esp + 0x44]
mov byte [esp + 0x78], 2
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
push edx
call esi
lea eax, [esp + 0x54]
push eax
call esi
push str.100_
lea ecx, [esp + 0x38]
call fcn.004043e0
test eax, eax
jne 0x4ec94c
push str.100_
lea ecx, [esp + 0x3c]
call fcn.004043e0
test eax, eax
jne 0x4ec94c
xor edi, edi
lea ecx, [esp + 0x38]
call fcn.00401f20
lea ecx, [esp + 0x34]
mov byte [esp + 0x78], 0
call fcn.00401f20
test edi, edi
je 0x4ecb3f
mov ecx, dword [esp + 0x28]
xor esi, esi
xor eax, eax
cmp ecx, esi
mov dword [esp + 0x24], eax
je 0x4ec990
mov edx, dword [ecx]
lea eax, [esp + 0x24]
push eax
push 0x5d2010
push ecx
mov ecx, dword [edx]
call ecx
mov eax, dword [esp + 0x24]
cmp eax, esi
mov byte [esp + 0x78], 3
je 0x4ecb2e
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], esi
mov edx, dword [eax]
mov edx, dword [edx + 0x48]
push ecx
push eax
call edx
test eax, eax
jne 0x4ecb2a
mov eax, dword [esp + 0x38]
cmp eax, esi
je 0x4ecb2a
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x24], esi
mov ecx, dword [eax]
push str._D_3
push eax
mov eax, dword [ecx]
call eax
mov byte [esp + 0x78], 4
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x4ecb09
lea edx, [esp + 0x2c]
push edx
push 1
mov dword [esp + 0x34], 0
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x1ac]
call eax
cmp dword [esp + 0x2c], 0
je 0x4ecb09
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x2c]
lea esi, [esp + 0x34]
mov dword [esp + 0x18], eax
call fcn.004f1fa0
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x30]
call fcn.004f1fe0
mov byte [esp + 0x78], 6
mov ecx, dword [esp + 0x34]
test ecx, ecx
mov eax, dword [esp + 0x30]
jne 0x4ecae3
test eax, eax
jne 0x4ecae3
lea ecx, [esp + 0x54]
call fcn.00566008
lea eax, [esp + 0x54]
mov byte [esp + 0x78], 7
mov ecx, dword [esp + 0x20]
push eax
push ecx
call fcn.004ec280
add esp, 8
test eax, eax
jle 0x4ecacd
cmp dword [esp + 0x5c], 0
jg 0x4eca86
call fcn.00555520
mov edx, dword [esp + 0x58]
mov eax, dword [edx]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x5d1f80
push eax
mov eax, dword [ecx]
call eax
mov eax, dword [esp + 0x5c]
mov esi, 1
cmp eax, esi
jle 0x4ecacd
lea ebx, [ebx]
test eax, eax
jle 0x4eca81
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, dword [esp + 0x5c]
add esi, 1
cmp esi, eax
jl 0x4ecab0
lea ecx, [esp + 0x54]
mov byte [esp + 0x78], 6
call fcn.0056601f
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
test eax, eax
mov byte [esp + 0x78], 5
je 0x4ecaf8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov ecx, dword [esp + 0x34]
test ecx, ecx
mov byte [esp + 0x78], 4
je 0x4ecb09
mov eax, dword [ecx]
push ecx
mov ecx, dword [eax + 8]
call ecx
mov eax, dword [esp + 0x38]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x78], 3
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4ecb2a
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x24]
test eax, eax
mov byte [esp + 0x78], 0
je 0x4ecb3f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x40]
call fcn.004f1fa0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4ecbf8
mov dword [esp + 0x38], 0
lea edx, [esp + 0x38]
mov byte [esp + 0x78], 9
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
test eax, eax
jne 0x4ecba5
mov ecx, dword [esp + 0x38]
push ecx
lea ecx, [esp + 0x38]
call fcn.004023b0
mov eax, dword [eax]
push str.clsid:D27CDB6E_AE6D_11CF_96B8_444553540000
push eax
mov dword [esp + 0x44], 1
call fcn.00577334
add esp, 8
test eax, eax
mov byte [esp + 0x17], 1
je 0x4ecbaa
mov byte [esp + 0x17], 0
test byte [esp + 0x3c], 1
je 0x4ecbba
lea ecx, [esp + 0x34]
call fcn.00401f20
cmp byte [esp + 0x17], 0
mov edi, dword [ebp + 8]
je 0x4ecbe3
mov edx, dword [esp + 0x18]
mov dword [ebx + 0x6c], edx
mov eax, dword [edi + 0x14]
mov dword [ebx + 0x70], eax
mov ecx, dword [edi + 0x18]
mov eax, 1
mov dword [ebx + 0x74], ecx
mov dword [ebx + 0x78], eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x78], 8
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4ecca0
mov eax, dword [esp + 0x18]
lea esi, [esp + 0x3c]
call fcn.004f1fe0
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x4ecc8c
lea ecx, [esp + 0x24]
call fcn.00402700
lea eax, [esp + 0x24]
mov byte [esp + 0x78], 0xb
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.004f10e0
add esp, 8
lea edi, [esp + 0x24]
call fcn.00423a80
mov esi, dword [esp + 0x24]
cmp dword [esi - 0xc], 0
jl 0x4ecc7f
push 0x5dd328
push esi
call fcn.0057781d
add esp, 8
test eax, eax
je 0x4ecc7f
sub eax, esi
sar eax, 1
test eax, eax
jle 0x4ecc7f
mov edx, dword [esp + 0x18]
mov eax, dword [ebp + 8]
mov dword [ebx + 0x6c], edx
mov ecx, dword [eax + 0x14]
mov dword [ebx + 0x70], ecx
mov edx, dword [eax + 0x18]
mov dword [ebx + 0x74], edx
mov dword [ebx + 0x78], 2
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x24]
call fcn.00401f20
mov eax, dword [esp + 0x3c]
test eax, eax
mov byte [esp + 0x78], 8
je 0x4ecc9d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [ebp + 8]
cmp dword [ebx + 0x6c], 0
jne 0x4eccb2
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov byte [esp + 0x78], 0
mov eax, dword [esp + 0x40]
test eax, eax
je 0x4eccc7
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x78], 0xffffffff
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4eccdf
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [ebx + 0xcc], 0
je 0x4ecfd0
xor edx, edx
mov dword [ebx + 0x80], 1
mov dword [ebx + 0x84], edx
mov ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x14]
push ecx
push eax
push ecx
push eax
mov dword [ebx + 0x8c], eax
lea eax, [ebx + 0x94]
push eax
mov dword [ebx + 0x90], ecx
mov dword [ebx + 0x88], edx
call fcn.004e0030
jmp 0x4ecfd0
cmp eax, 0x205
jne 0x4ecdff
cmp dword [ebx + 0xac], esi
mov dword [ebx + 0x80], esi
je 0x4ecd4f
mov dword [ebx + 0xac], esi
jmp 0x4ec650
xor esi, esi
cmp dword [ebx + 0x84], esi
je 0x4ecdc2
mov ecx, dword [ebx + 0x9c]
sub ecx, dword [ebx + 0x94]
cmp ecx, 5
jge 0x4ecd7b
mov edx, dword [ebx + 0xa0]
sub edx, dword [ebx + 0x98]
cmp edx, 5
jl 0x4ecda8
mov eax, dword [ebx + 0x88]
test eax, eax
jle 0x4ecda8
mov edx, dword [ebx]
mov edx, dword [edx + 0x1f4]
lea ecx, [edi + 0x14]
push ecx
lea ecx, [ebx + 0x8c]
push ecx
mov esi, 1
push eax
mov ecx, ebx
mov dword [esp + 0x28], esi
call edx
jmp 0x4ecdb0
mov dword [esp + 0x1c], 1
test esi, esi
mov dword [ebx + 0x84], 0
jne 0x4ec650
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x4ecfd0
mov edx, dword [ebx]
mov edx, dword [edx + 0x1e8]
lea ecx, [ebx + 0x70]
push ecx
mov ecx, dword [ebx + 0x78]
push ecx
push eax
mov ecx, ebx
call edx
xor esi, esi
cmp eax, esi
mov dword [esp + 0x1c], eax
jne 0x4ecdf7
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebx + 0x6c], esi
jmp 0x4ecfd0
cmp eax, 0x207
jne 0x4eceab
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
push eax
push ecx
call fcn.004ebfd0
mov esi, eax
test esi, esi
je 0x4ecfdb
lea ecx, [esp + 0x34]
call fcn.00402700
lea ecx, [esp + 0x38]
mov dword [esp + 0x78], 0xc
call fcn.00402700
mov byte [esp + 0x78], 0xd
lea edi, [esp + 0x38]
call fcn.004efae0
mov edx, dword [esp + 0x38]
push 0x5d7ff8
push edx
call fcn.00577334
add esp, 8
test eax, eax
je 0x4ece84
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
push ecx
push esi
call edx
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov esi, dword [esp + 0x40]
test esi, esi
jne 0x4ece40
lea edx, [esp + 0x34]
push edx
mov ecx, str.href
mov edi, esi
call fcn.004ee290
mov eax, dword [esp + 0x38]
add esp, 4
cmp dword [eax - 0xc], 0
je 0x4ecf67
jmp 0x4ecf5f
cmp eax, 0x208
jne 0x4ecf92
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x14]
push eax
push ecx
call fcn.004ebfd0
mov esi, eax
test esi, esi
je 0x4ecfdb
lea ecx, [esp + 0x34]
call fcn.00402700
lea ecx, [esp + 0x38]
mov dword [esp + 0x78], 0xe
call fcn.00402700
mov byte [esp + 0x78], 0xf
lea esp, [esp]
lea edi, [esp + 0x38]
call fcn.004efae0
mov edx, dword [esp + 0x38]
push 0x5d7ff8
push edx
call fcn.00577334
add esp, 8
test eax, eax
je 0x4ecf34
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], 0
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
push ecx
push esi
call edx
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov esi, dword [esp + 0x40]
test esi, esi
jne 0x4ecef0
lea edx, [esp + 0x34]
push edx
mov ecx, str.href
mov edi, esi
call fcn.004ee290
mov eax, dword [esp + 0x38]
add esp, 4
cmp dword [eax - 0xc], 0
je 0x4ecf67
mov edx, dword [ebx]
push eax
mov eax, dword [edx + 0x1d0]
mov ecx, ebx
call eax
mov dword [esp + 0x1c], 1
test esi, esi
je 0x4ecf73
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
lea ecx, [esp + 0x38]
call fcn.00401f20
lea ecx, [esp + 0x34]
mov dword [esp + 0x78], 0xffffffff
call fcn.00401f20
mov edi, dword [ebp + 8]
jmp 0x4ecfd0
cmp eax, 0x20a
jne 0x4ecfdb
movzx ecx, word [edi + 8]
mov eax, ecx
and eax, 2
je 0x4ecfae
mov dword [ebx + 0xac], 1
test cl, 8
jne 0x4ecfb8
test ax, ax
je 0x4ecfdb
mov ecx, dword [edi + 0xc]
mov eax, dword [ebx]
mov edx, dword [edi + 8]
mov eax, dword [eax + 0x1d8]
push ecx
push edx
mov ecx, ebx
call eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
jne 0x4ec650
push edi
mov ecx, ebx
call fcn.00556359
test eax, eax
jne 0x4ec650
mov ebx, dword [ebx + 0x124]
xor esi, esi
test ebx, ebx
je 0x4ed046
lea edx, [esp + 0x38]
push edx
mov dword [esp + 0x3c], esi
mov ecx, dword [ebx]
mov eax, dword [ecx]
push 0x5fe328
push ebx
call eax
mov dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x38]
test eax, eax
je 0x4ed032
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push edi
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0x38]
neg esi
sbb esi, esi
add esi, 1
test eax, eax
mov dword [esp + 0x78], 0xffffffff
je 0x4ed046
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4